# How to find out memory usage while aggregating some fields? **URL:** \ **Category:** Elasticsearch\ **Created:** [March 17, 2020, 10:11am UTC](https://discuss.elastic.co/t/how-to-find-out-memory-usage-while-aggregating-some-fields/223895 "2020-03-17T10:11:06Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![AshokBachchan](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@AshokBachchan](https://discuss.elastic.co/u/AshokBachchan)\ **Post date:** [March 17, 2020, 10:11am UTC](https://discuss.elastic.co/t/how-to-find-out-memory-usage-while-aggregating-some-fields/223895/1 "2020-03-17T10:11:06Z")
**Hello Everyone,** We are facing some latency issues while aggregating on some fields, due to this it is getting Java heap issue. I have few queries on these, we have 30GB Java heap for data node, index size was 100GB per whole day. Let us suppose we can aggregate on some fields only for specific period, and then what will happens? **1.** Specific period data only comes to RAM? **2.** Whole index data (100GB) will come to RAM? **3.** How much memory can be used for that kind of situations? ---
**Author:** ![AshokBachchan](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@AshokBachchan](https://discuss.elastic.co/u/AshokBachchan)\ **Post date:** [March 18, 2020, 5:03am UTC](https://discuss.elastic.co/t/how-to-find-out-memory-usage-while-aggregating-some-fields/223895/2 "2020-03-18T05:03:50Z")
@DavidTurner, can you please help on this. Thanks ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 18, 2020, 5:15am UTC](https://discuss.elastic.co/t/how-to-find-out-memory-usage-while-aggregating-some-fields/223895/3 "2020-03-18T05:15:36Z")
Please do not ping people not already involved in the thread. This forum is manned by volunteers even though some naturally work for Elastic. It would help if you shared some additional information though as there currently is little to go on, e.g: - What is your use case? - Can you please provide the full output of the `_cluster/stats` API? - Which version of Elasticsearch are you using? - How many nodes do you have in the cluster? - What type and specification hardware is it running on? Are you using local disks or networked storage? SSDs or HDDs? - What type of indexing and query load is the cluster under? - What type of queries are you experiencing latency issues for? ---
**Author:** ![AshokBachchan](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@AshokBachchan](https://discuss.elastic.co/u/AshokBachchan)\ **Post date:** [March 18, 2020, 5:47am UTC](https://discuss.elastic.co/t/how-to-find-out-memory-usage-while-aggregating-some-fields/223895/4 "2020-03-18T05:47:19Z")
Hello Christian, **What is your use case?** We are aggregating on some fields, that time cluster reaches to heavy heap size. **Can you please provide the full output of the \_cluster/stats API?** { "\_nodes": { "total": 13, "successful": 13, "failed": 0 }, "cluster\_name": "IMIConnect-Prod-new-Cluster", "timestamp": 1584508821487, "status": "green", "indices": { "count": 1590, "shards": { "total": 3836, "primaries": 1918, "replication": 1, "index": { "shards": { "min": 2, "max": 16, "avg": 2.412578616352201 }, "primaries": { "min": 1, "max": 8, "avg": 1.2062893081761005 }, "replication": { "min": 1, "max": 1, "avg": 1 } } }, "docs": { "count": 6989638358, "deleted": 186400 }, "store": { "size\_in\_bytes": 10111682273006, "throttle\_time\_in\_millis": 0 }, "fielddata": { "memory\_size\_in\_bytes": 5395428088, "evictions": 0 }, "query\_cache": { "memory\_size\_in\_bytes": 3720906227, "total\_count": 626199871, "hit\_count": 46551285, "miss\_count": 579648586, "cache\_size": 805217, "cache\_count": 4873902, "evictions": 4068685 }, "completion": { "size\_in\_bytes": 0 }, "segments": { "count": 61713, "memory\_in\_bytes": 25661172525, "terms\_memory\_in\_bytes": 21678628843, "stored\_fields\_memory\_in\_bytes": 3091498736, "term\_vectors\_memory\_in\_bytes": 0, "norms\_memory\_in\_bytes": 7895680, "points\_memory\_in\_bytes": 568946834, "doc\_values\_memory\_in\_bytes": 314202432, "index\_writer\_memory\_in\_bytes": 413129724, "version\_map\_memory\_in\_bytes": 27899398, "fixed\_bit\_set\_memory\_in\_bytes": 0, "max\_unsafe\_auto\_id\_timestamp": 9223372036854776000, "file\_sizes": {} } }, "nodes": { "count": { "total": 13, "data": 8, "coordinating\_only": 2, "master": 3, "ingest": 11 }, "versions": [ "5.6.4" ], "os": { "available\_processors": 84, "allocated\_processors": 84, "names": [ { "name": "Linux", "count": 13 } ], "mem": { "total\_in\_bytes": 699968139264, "free\_in\_bytes": 47940886528, "used\_in\_bytes": 652027252736, "free\_percent": 7, "used\_percent": 93 } }, "process": { "cpu": { "percent": 85 }, "open\_file\_descriptors": { "min": 439, "max": 1545, "avg": 1120 } }, "jvm": { "max\_uptime\_in\_millis": 39984204745, "versions": [ { "version": "1.8.0\_191", "vm\_name": "OpenJDK 64-Bit Server VM", "vm\_version": "25.191-b12", "vm\_vendor": "Oracle Corporation", "count": 10 }, { "version": "1.8.0\_222", "vm\_name": "OpenJDK 64-Bit Server VM", "vm\_version": "25.222-b10", "vm\_vendor": "Oracle Corporation", "count": 2 }, { "version": "1.8.0\_201", "vm\_name": "OpenJDK 64-Bit Server VM", "vm\_version": "25.201-b09", "vm\_vendor": "Oracle Corporation", "count": 1 } ], "mem": { "heap\_used\_in\_bytes": 172083151128, "heap\_max\_in\_bytes": 337496506368 }, "threads": 1269 }, "fs": { "total\_in\_bytes": 19861279350784, "free\_in\_bytes": 9654299492352, "available\_in\_bytes": 9654299492352 }, "plugins": , "network\_types": { "transport\_types": { "netty4": 13 }, "http\_types": { "netty4": 13 } } } } **Which version of Elasticsearch are you using?** Elasticsearch version : 5.6.4 **How many nodes do you have in the cluster?** 13 Nodes, in which 2 -Coord, 3 -Master, 8 -Datanodes, **What type and specification hardware is it running on? Are you using local disks or networked storage? SSDs or HDDs?** All nodes are deployed on AWS, disk type is **SSD** **What type of indexing and query load is the cluster under?** **Index Name:** imiconnect\_sfe\_custom\_node\_logs **One Sample record:** { "\_index": "imiconnect\_sfe\_custom\_node\_logs-2020-03-18", "\_type": "IMICONNECT\_SFE\_CUSTOM\_NODE\_LOGS", "\_id": "123a3d7e457-ce32-40fd-938f-9a73f6919a9c", "\_version": 1, "\_score": null, "\_source": { "request": "7657HJFa2k/7VgLW0MmboVj0O+oPuuwvdedOi1Uv/I0U230jV4Ks7Su1StWzhZa27sR9nPsL8s0S\nlJvr5BPxSPYg3ISpjPC9Sn4IOekgW3lm7zs199xLn4JvqnReQ/F7eKjSigqfwllGZxJZ+G+Md4nB\niWUUqtEZBQH4EkPM6E2sc63jlZxSJ4yz4EE0QSawY9NQsNOhE2XFUUHJQ+A26YN3UB1GLHaRi0Ln\nGmxQrQYRSG3/IDW7D0T+EDmSeRym/229M0X", "response\_code": "200 OK", "integration\_id": "7077", "nodetid": "232fa288-9421-412d-808c-be3af45847ac", "service\_name": "PPB", "flow\_name": "BulkOptin", "trans\_id": "03a47810-8674-45a9-9b4e-5f90e84b776a\_12856\_26120", "request\_method": "POST", "response\_datetime": "2020-03-18T04:38:55.821Z", "client\_id": 1018, "@timestamp": "2020-03-18T04:40:58.450Z", "method\_name": "BulkOptIn\_PPB", "method\_id": "579", "flow\_id": "10864", "response": "Q6yelRzPeSmaZlg4/JaNgp2IiZDhFharuZNJAi2JF1cPU63t5L5ymzlXj68CG27/Eho+6QVGq5bY\ns9KPMU8/RjvHCAYIjxYXVHVZkQda/cU=/229M0X", "requesturl": "bQ7NZavNFGBLXNJGNl0ziJa7S9q25jjWrWvJhkbcyw/gYya5uNYcX4jgvmfb0xi/zCpBp7LUkDPF\nmmEpCTQpBS4cljBee1aUgLwpfQtH3ss=/229M0X", "service\_id": "17218", "request\_datetime": "2020-03-18T04:38:55.523Z" }, "fields": { "@timestamp": [ 1584506458450 ], "request\_datetime": [ 1584506335523 ], "response\_datetime": [ 1584506335821 ] }, "sort": [ 1584506458450 ] } **What type of queries are you experiencing latency issues for?** **Aggrate Query:** { "size": 0, "query" : { "bool" : { "filter" : [ { "bool" : { "must" : [ { "range" : { "@timestamp" : { "from" : "2020-03-17T04:38:55.821Z", "to" : "2020-03-18T04:38:55.821Z" } } } ] } } ] } }, "aggregations": { "client\_id": { "terms": { "field": "client\_id", "size" : 10000 }, "aggregations": { "integration\_id": { "terms": { "field": "integration\_id", "size" : 10000 },"aggregations": { "method\_id": { "terms": { "field": "method\_id", "size" : 10000 }, "aggregations": { "flow\_id": { "terms": { "field": "flow\_id", "size" : 10000 }, "aggregations": { "datehour": { "date\_histogram": { "field": "datetime", "interval": "1h" } } } } } } } } } } } } ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 18, 2020, 6:10am UTC](https://discuss.elastic.co/t/how-to-find-out-memory-usage-while-aggregating-some-fields/223895/5 "2020-03-18T06:10:10Z")
I think the problem is with the aggregation query as you have several nesting levels with large size parameters whch will make Elasticsearch create a lot of buckets that will take up a lot of heap space. I would recommend setting the size parameters as low and close to the cardinality of the field as possible. You should be able to see if this is what is causing the heap usage by running the query with reduced size parameters and see if there is any difference. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 15, 2020, 6:10am UTC](https://discuss.elastic.co/t/how-to-find-out-memory-usage-while-aggregating-some-fields/223895/6 "2020-04-15T06:10:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.