High cpu load, just a one node working on 100%

Elastic Stack Elasticsearch
1

Hi everyone, i`m newbie an elastic.
I have cluster of 3 nodes with ES 7.15.0.
Problem is just 1 node working on indexing.

curl -s -XGET -u user:pass "mv-elk-data-01:9200/_cat/thread_pool" |grep " write "
mv-elk-data-02 write                                  0   0 0
mv-elk-data-03 write                                  0   0 0
mv-elk-data-01 write                                  8 390 0

I use filebeat send logs to 2 logstash instances.

output.logstash:
  hosts: ["172.23.0.35:5044", "172.23.0.36:5044"]
  loadbalance: true

Logstash also have all my nodes in config.
xpack.monitoring.elasticsearch.hosts: ["http://172.23.0.37:9200", "http://172.23.0.38:9200", "http://172.23.0.39:9200"]

Nodes runs in this mode:

discovery.seed_hosts: ["mv-elk-data-01", "mv-elk-data-02", "mv-elk-data-03"]
cluster.initial_master_nodes: ["mv-elk-data-01", "mv-elk-data-02", "mv-elk-data-03"]

Also my problem node(mv-elk-data-01) have the minimal count of shards, in all of 3 nodes. Maybe is the reason?

2

Welcome to our community! :smiley:

What does Logstash have configured to talk to Elasticsearch?

3

Hi, thank you for replying.
My Logstash config:

grep -ve "#" /etc/logstash/logstash.yml
path.data: /var/lib/logstash
pipeline.workers: 64
pipeline.batch.size: 1024
pipeline.batch.delay: 10
pipeline.ordered: auto
queue.type: memory
log.level: info
path.logs: /var/log/logstash
xpack.monitoring.enabled: false
xpack.monitoring.elasticsearch.username: logstash_system
xpack.monitoring.elasticsearch.password: logstash_system
xpack.monitoring.elasticsearch.hosts: ["http://172.23.0.37:9200", "http://172.23.0.38:9200", "http://172.23.0.39:9200"]

P.S.
172.23.0.37-39 == mv-elk-data-01-03

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.