Inaccurate Cluster total Data in app Monitoring

Elastic Stack Kibana
1

Hello,

I noticed that the total Data managed by a cluster (version 7.2) is slighty different than the sum of the store.size of all indexes (including system ones).

I see something like this in the Kibana app Monitoring

image
image476×125 4.75 KB

but if I get all the indexes sizes with

GET _cat/indices/*?v=true&s=index&bytes=b

and sum over all indexes I get a different number, something like 51.5TiB (or 56.6TB in SI).

How come?

Thanks,
Nicoletta

2

Does that cover all indices?

See below

% curl -u $EUSER:$EPASS -skX GET "https://localhost:9200" --request-target "_cat/indices/*?v=true&bytes=b&h=store.size&s=store.size" | awk 'NR>1{sum+=$1}END {printf "%10.2fGB\n",sum/1000000000.0}'
      6.11GB

% curl -u $EUSER:$EPASS -skX GET "https://localhost:9200" --request-target "_cat/indices/*,.*?v=true&bytes=b&h=store.size&s=store.size" | awk 'NR>1{sum+=$1}END {printf "%10.2fGB\n",sum/1000000000.0}'
      6.18GB
3

It seems that they are included.

nicoletta@XXX:~$ curl -u $ES_PRD_US:$ES_PRD_PW -skX GET "http://localhost:9200" --request-target "_cat/indices/*?v=true&bytes=b&h=store.size&s=store.size" | awk 'NR>1{sum+=$1}END {printf "%10.2fGB\n",sum/100000000.0}' && curl -u $ES_PRD_US:$ES_PRD_PW -skX GET "http://localhost:9200" --request-target "_cat/indices/*,.*?v=true&bytes=b&h=store.size&s=store.size" | awk 'NR>1{sum+=$1}END {printf "%10.2fGB\n",sum/100000000.0}'
 568025.64GB
 568032.80GB

(I think there's a zero missing somewhere because the total size should be 56TB, but still the two values are pretty the same.)

4

Ok I found why. My bad.

There are closed indices that are counted in the total data managed by the cluster, but since their metadata are not available their size is 0 in the _cat/indices .

Thanks for you time and support.

Nicoletta

1 Like
5

there was, and I edited and fixed it in the reply, case someone cuts and pastes same months from now and is completely misled.

1 Like