# High CPU usage in Monitoring Server due to ES
**URL:** https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734
**Category:** Elasticsearch
**Created:** [March 29, 2016, 9:12pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734 "2016-03-29T21:12:14Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@vuradam](https://discuss.elastic.co/u/vuradam)
#### Post date: [March 29, 2016, 9:12pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/1 "2016-03-29T21:12:14Z")
I am running CentOS, and I have ELK(ElasticSearch, Logstash, Kibana) and Graphite, Graphana on this VM.
When I run top I can see ES is the culprit
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
899 elasticsearch 20 0 6110m 1.2g 35m S 100.0 31.3 1262:28 java
I don't know why it started acting like this. I was told hot threads will help but I am new to ES and need help to understand it.
My hot\_threads: [https://gist.github.com/anonymous/7f75f702c0a5edf788bfa62ba83ffd21](https://gist.github.com/anonymous/7f75f702c0a5edf788bfa62ba83ffd21)
Thanks
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 29, 2016, 10:30pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/2 "2016-03-29T22:30:21Z")
There's not really that much there to explain this.
What about your ES logs, can you see much GC there?
---
### Author:  [@vuradam](https://discuss.elastic.co/u/vuradam)
#### Post date: [March 30, 2016, 2:28pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/3 "2016-03-30T14:28:13Z")
I can see it only once which is more than a week ago
[2016-03-12 10:29:59,364][INFO][monitor.jvm] [Amelia Voght] [gc][old][209984][63663] duration [5.1s], collections [1]/[5.4s], total [5.1s]/[13.6h], memory [952.1mb]-\>[960.5mb]/[1007.3mb], all\_pools {[young] [94.5mb]-\>[102.9mb]/[133.1mb]}{[survivor] [0b]-\>[0b]/[16.6mb]}{[old] [857.6mb]-\>[857.6mb]/[857.6mb]}
---
### Author:  [@vuradam](https://discuss.elastic.co/u/vuradam)
#### Post date: [March 31, 2016, 5:51pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/4 "2016-03-31T17:51:45Z")
I don't know if it is related but cluster health is yellow
curl [http://localhost:9200/\_cluster/health?pretty](http://localhost:9200/_cluster/health?pretty)
{
"cluster\_name" : "elasticsearch",
"status" : "yellow",
"timed\_out" : false,
"number\_of\_nodes" : 2,
"number\_of\_data\_nodes" : 1,
"active\_primary\_shards" : 1200,
"active\_shards" : 1200,
"relocating\_shards" : 0,
"initializing\_shards" : 0,
"unassigned\_shards" : 1200
}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 31, 2016, 9:02pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/5 "2016-03-31T21:02:51Z")
No it's not, but that's a _very_ high shard count for a single node.
I'd look to reduce that.
---
### Author:  [@vuradam](https://discuss.elastic.co/u/vuradam)
#### Post date: [March 31, 2016, 9:23pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/6 "2016-03-31T21:23:28Z")
Will it help if I reduce to shards, by archiving them since I can restore it to a local ES when it is needed to see historical data?
What is a healthy number for a single node?
We may increase the node number too I guess, if that is causing the CPU usage.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 31, 2016, 9:40pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/7 "2016-03-31T21:40:56Z")
If you are using Logstash then update the template to use 1 or 3 shards, or switch to weekly indices rather than daily.
---
### Author:  [@vuradam](https://discuss.elastic.co/u/vuradam)
#### Post date: [April 4, 2016, 4:39pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/9 "2016-04-04T16:39:33Z")
Hi warkolm,
Yes we are using logstash and keeping history, hence the large numbers I think.
Where can I make the said changes? elasticsearch.yml or is there a logstash config file that I need to change?
The person who knows elasticsearch is not with us anymore, so I am using your help and Google
Thanks
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 4, 2016, 9:08pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/10 "2016-04-04T21:08:14Z")
You need to look at the `_template` API, then find the logstash template and change the shard count 🙂
---
### Author:  [@vuradam](https://discuss.elastic.co/u/vuradam)
#### Post date: [April 5, 2016, 5:10pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/11 "2016-04-05T17:10:17Z")
Thanks for the reply, I will test this soon
---
### Author:  [@vuradam](https://discuss.elastic.co/u/vuradam)
#### Post date: [April 5, 2016, 5:30pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/12 "2016-04-05T17:30:00Z")
This is the template according to API.
Should I increase the 5seconds interval? 🙂
-\> curl -XGET localhost:9200/\_template/?pretty
{
"logstash" : {
"order" : 0,
"template" : "logstash-_",
"settings" : {
"index.refresh\_interval" : "5s"
},
"mappings" : {
"default" : {
"dynamic\_templates" : [ {
"string\_fields" : {
"mapping" : {
"index" : "analyzed",
"omit\_norms" : true,
"type" : "string",
"fields" : {
"raw" : {
"index" : "not\_analyzed",
"ignore\_above" : 256,
"type" : "string"
}
}
},
"match\_mapping\_type" : "string",
"match" : "_"
}
} ],
"properties" : {
"geoip" : {
"dynamic" : true,
"path" : "full",
"properties" : {
"location" : {
"type" : "geo\_point"
}
},
"type" : "object"
},
"@version" : {
"index" : "not\_analyzed",
"type" : "string"
}
},
"\_all" : {
"enabled" : true
}
}
},
"aliases" : { }
}
}
---
### Author:  [@vuradam](https://discuss.elastic.co/u/vuradam)
#### Post date: [April 5, 2016, 7:17pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/13 "2016-04-05T19:17:58Z")
Guess I found the reason. I introduced a collector for elasticsearch metrics and found out that JVM uses almost all the assigned memory.
I grepped the elasticsearch process and it is like "/usr/bin/java -Xms256m -Xmx1g -Xss256k" which limits its memory usage to 1gb. I still don't know what 256m and 256k does though 🙂
Correct me if I am wrong but increasing the limit should fix my problem right?
Thanks
---
### Author:  [@vuradam](https://discuss.elastic.co/u/vuradam)
#### Post date: [April 5, 2016, 8:29pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/14 "2016-04-05T20:29:35Z")
To answer my own question, increasing the heap size fixed my CPU problem. Thanks for the help Mark.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:02pm UTC](https://discuss.elastic.co/t/high-cpu-usage-in-monitoring-server-due-to-es/45734/15 "2017-07-05T23:02:08Z")