High Value of total_opened http connection in node stats when ES Cluster is idle

Elastic Stack Elasticsearch
1

I have a simple ELK deployment in which logstash is pushing log events to elasticsearch cluster. The elasticsearch cluster has 4 nodes out of which there are 3 master + data nodes and one client node. The logstash configuration for Elasticsearch output is as follows:-

output {
  elasticsearch {    
  index => "test-2015-08-18"
  }
}

I am seeing a high number of total_opened http connection about 50-60 K (per node) but this number is constant. This stays at this even when there are hardly any indexing or query being done on the elasticsearch. Is this expected?

The node-monitoring guide states:-

If you see a very large total_opened number that is constantly increasing, that is a sure sign that one of your HTTP clients is not using keep-alive connections.

Since in my case the number 50-60 K is constant so is it ok and nothing to worry about?

2

It's constant so I wouldn't worry too much, but it'd be interesting to see why it's that high.

3

Thanks Mark.

Is there a way I can see what all http connections are opened by elasticsearch. Doing netstat | grep http is returning empty results?

4

There's no way to get that from ES unfortunately, we just don't provide visibility into that :frowning: