# Increased memory requirements for geo search queries in Elasticsearch 8

**URL:** https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594
**Category:** Elasticsearch
**Created:** [May 29, 2023, 2:30pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594 "2023-05-29T14:30:14Z")
**Posts on this page:** 17
**Page:** 1

<div class="post-metadata">

### Author: ![Tomas\_Bartek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomas_bartek/32/45776_2.png) [@Tomas\_Bartek](https://discuss.elastic.co/u/Tomas_Bartek)
#### Post date: [May 29, 2023, 2:30pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/1 "2023-05-29T14:30:14Z")

</div>

After upgrading from Elasticsearch 7.17.10 to Elasticsearch 8.7.1, our geosearch workloads started  
to hit memory circuitbreaker leading to the unstable cluster (cluster rejecting requests  
which leads to degradation of our services). We had to stop problematic workloads until we found a solution.

We have run deterministic benchmarks on both ES7 and ES8 setups, collecting  
Elasticsearch server metrics with the following results.

# Workload:

- two consecutive geo queries from out workload (details in the appended file)
- run asynchronously in parallel (cca 20 virtual users)

# PSA setup (same for ES7 and ES8):

```auto
- primary r6g.large (16 GiB RAM, 2 vCPU, 8 GiB max JVM max heap size)
- secondary r6g.large (16 GiB RAM, 2 vCPU, 8 GiB max JVM max heap size)
- arbiter t4g.small (2 GiB RAM, 2 vCPU, 1 GiB max JVM max heap size)

```

# Results for Elasticsearch 7.17.10:

```auto
Search rate cca 47 ops/s
Search latency cca 100 ms
JVM memory used cca 3.6 GB
JVM GC collection run time cca 17 ms

```

# Results for Elasticsearch 8.7.1:

```auto
Search rate cca 80 ops/s
Search latency cca 220 ms
JVM memory used cca 7.6 GB
JVM GC collection run time cca 25.4 ms

```

From metrics it is clear, that Elasticsearch 8 is much faster but has significantly bigger memory requirements.

**We would like to know what is the reason for this memory increase and if there is a way to tune memory-speed trade-off directly on the Elasticsearch server.**

We can imagine that the increase is connected to new enhancements or upgrades (Java and Lucene) or even a bug in Elasticsearch 8.

---

<div class="post-metadata">

### Author: ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)
#### Post date: [May 29, 2023, 5:51pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/2 "2023-05-29T17:51:40Z")

</div>

Hello,

I am puzzle too about this memory increase as there were no changes as far as I know on the Lucene implementation that can explain it. Would it be possible to share more details on what kind of geo queries you are performing.

Comparisons of the [profile](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-profile.html) of the queries and [hot threads](https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-nodes-hot-threads.html) would be very useful too.

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 29, 2023, 6:19pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/3 "2023-05-29T18:19:38Z")

</div>

@Tomas_Bartek

Curious For your tests / benchmarks did you make sure both indices you did the searching against have the exact same mapping AND had been merged down to the exact same number of segments. Otherwise the test may not be as comparative as thought.

---

<div class="post-metadata">

### Author: ![Tomas\_Bartek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomas_bartek/32/45776_2.png) [@Tomas\_Bartek](https://discuss.elastic.co/u/Tomas_Bartek)
#### Post date: [June 6, 2023, 2:49pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/4 "2023-06-06T14:49:36Z")

</div>

@stephenb

Hi Stephen, Thank You for your suggestions. I have done same benchmarks once more, now with **both indices have same number of segments and against the exact same mapping** and the results are same as before (Elasticsearch 8 has significantly higher used JVM heap memory). I will send detailed metrics from these benchmarks.

---

<div class="post-metadata">

### Author: ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)
#### Post date: [June 6, 2023, 3:03pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/5 "2023-06-06T15:03:45Z")

</div>

The best thing would be to have heap dumps for both workloads so they can be compared.

---

<div class="post-metadata">

### Author: ![Tomas\_Bartek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomas_bartek/32/45776_2.png) [@Tomas\_Bartek](https://discuss.elastic.co/u/Tomas_Bartek)
#### Post date: [June 6, 2023, 6:00pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/6 "2023-06-06T18:00:26Z")

</div>

Here are metrics from **Elasticsearch 7** :

 ![es7-jvm](https://us1.discourse-cdn.com/elastic/original/3X/6/9/6958e59952318e32d21a955f4aba68e7393b2e7e.png)

 ![es7-rate-latency](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a1802eb358110b383fd0b8209331f8b6b83f9ce8.png)

 ![es7-circuitbreakers](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2a1a26e9c8899d6884add0c800c677fc24fdb27a.png)

 ![es7-indices-overview_](https://us1.discourse-cdn.com/elastic/original/3X/9/8/982ad156d7b841cb4fd18d9eed2f14e72b361858.png)

 ![es7-index-stats](https://us1.discourse-cdn.com/elastic/original/3X/a/4/a457105a62de91f3fdaabcb37a6eb0c7acf63a76.png)

 ![es7-threadpool](https://us1.discourse-cdn.com/elastic/original/3X/c/1/c1e75f6f9c495c8473c81888348b1a6673d3a521.png)

 ![es7-filesystem](https://us1.discourse-cdn.com/elastic/original/3X/8/1/818b6ed9f90af0434f75c8d558989db0d9e7c9fb.png)

---

<div class="post-metadata">

### Author: ![Tomas\_Bartek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomas_bartek/32/45776_2.png) [@Tomas\_Bartek](https://discuss.elastic.co/u/Tomas_Bartek)
#### Post date: [June 6, 2023, 6:04pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/7 "2023-06-06T18:04:11Z")

</div>

Metrics from **Elasticsearch 8:**

 ![es8-jvm-2](https://us1.discourse-cdn.com/elastic/original/3X/4/7/479a3411b69baa885697d7b5771a0ae221c86e3d.png)

 ![es8-rate-latency_](https://us1.discourse-cdn.com/elastic/original/3X/9/1/911f9859dd77e6a4ba8617ec6b3ec19a10b20f50.png)

 ![es8-circuitbreakers](https://us1.discourse-cdn.com/elastic/original/3X/0/e/0e5d7cc6ef065608d169a30a39d0fbcf9238907f.png)

 ![es8-indices-overview_](https://us1.discourse-cdn.com/elastic/original/3X/b/f/bf09c48905b2b06919fd0fa6a52f3de7a40bb03a.png)

 ![es8-indices-stats](https://us1.discourse-cdn.com/elastic/original/3X/b/0/b07d7c8f148f42fde4559b4e78a5994e89377aec.png)

 ![es8-threadpool](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5d82f47d82999e24d587741e072923fbb9728b8f.png)

 ![es8-filesystem](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f8b4117d702d9497b0c752feeefdb7f5f68798b4.png)

---

<div class="post-metadata">

### Author: ![Tomas\_Bartek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomas_bartek/32/45776_2.png) [@Tomas\_Bartek](https://discuss.elastic.co/u/Tomas_Bartek)
#### Post date: [June 6, 2023, 6:05pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/8 "2023-06-06T18:05:35Z")

</div>

Sure, I will prepare it.

---

<div class="post-metadata">

### Author: ![Tomas\_Bartek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomas_bartek/32/45776_2.png) [@Tomas\_Bartek](https://discuss.elastic.co/u/Tomas_Bartek)
#### Post date: [June 7, 2023, 3:57pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/9 "2023-06-07T15:57:17Z")

</div>

@Ignacio_Vera

I have prepared heap dumps for both workloads, with the following command:  
`sudo /usr/share/elasticsearch/jdk/bin/jcmd 877 GC.heap_dump /tmp/heap_dump_es7_1.hprof`

**Elasticsearch7:**  
`heap_dump_es7_1` (dumped before workload)  
`heap_dump_es7_2` (dumped after start of the workload)  
`heap_dump_es7_3` (dumped in the middle of the workload)  
`heap_dump_es7_4` (dumped before the workload finishes)

**Elasticsearch8:**

`heap_dump_es8_2` (dumped after start of the workload)  
`heap_dump_es8_3` (dumped in the middle of the workload)  
`heap_dump_es8_4` (dumped before the workload finishes)

Here is a link to files: [heap\_dump\_files](https://drive.google.com/drive/folders/1FrfXAHixo1rn_QMXtGoB2tRnQD3ehiH-?usp=sharing)

Dump was always done on the **master node** (node with increased memory in ES8 cluster). I have checked some of the dumps with the MAT tool.

Please, tell me if you need any other (different) dumps or our indexed data.

---

<div class="post-metadata">

### Author: ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)
#### Post date: [June 7, 2023, 5:14pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/10 "2023-06-07T17:14:02Z")

</div>

Are you querying geo\_point or geo\_shape fields? in case of the later, are they big geometries? and how many documents are your query returning (you never share the workload you are using).

---

<div class="post-metadata">

### Author: ![Tomas\_Bartek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomas_bartek/32/45776_2.png) [@Tomas\_Bartek](https://discuss.elastic.co/u/Tomas_Bartek)
#### Post date: [June 7, 2023, 6:23pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/11 "2023-06-07T18:23:19Z")

</div>

@Ignacio_Vera

Sorry, these two queries are called from the workload for various coordinates:

First query:

```auto
POST ruian-scratch,geodata-sk-scratch/_search
{
    "query": {
       "constant_score": {
            "filter": {
                "geo_shape": {
                    "geometry": {
                        "shape": {
                            "type": "point",
                            "coordinates": [49.455864, 15.146864]
                        },
                        "relation": "contains"
                    }
                }
            }
        }
    },
    "_source": ["level", "name"],
    "size": 100
}

```

Result from the first query is used to fill terms in the second query:

```auto
POST ruian-scratch,geodata-sk-scratch/_search
 {

    "query": {"bool": {
    	"filter": [
    		{"term": {"address.neighborhood.keyword": "Lipice"}},
    		{"term": {"address.region.keyword": "Kraj Vysočina"}},
    		{"term": {"address.district.keyword": "Pelhřimov"}},
    		{"term": {"address.country.keyword": "Česká republika"}},
    		{"term": {"address.city.keyword": "Pelhřimov"}},
    		{"term": {"address.cadastral_area.keyword": "Lipice"}},
    		{"term": {"level": "address_point"}}, 
    		{
    			"geo_shape": {
    				"geometry": {
    					"shape": {
    						"type": "circle",
    						"coordinates": [15.146864,49.455864],
    						"radius": "5000m"
    					},
    					"relation": "within"
    				}
    			}
    		}
    		]
    }},
    "_source": ["address"],
    "sort": [{
    	"_geo_distance": {
    		"representative_point": [15.146864,49.455864],
    		"order": "asc",
    		"unit": "m",
    		"mode": "min",
    		"distance_type": "plane"
    	}
    }],
    "size": 1
}

```

I will send you `k6` script for the whole workload.

---

<div class="post-metadata">

### Author: ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)
#### Post date: [June 8, 2023, 7:43am UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/12 "2023-06-08T07:43:09Z")

</div>

Thank you @Tomas_Bartek .

The heap dumps you have provided do not show the JVM under heap pressure, they are pretty small so I am confused why you are getting those circuit breaker exceptions. Would you be able to share those exceptions, I am interested to know which circuit breaker is actually triggering.

Just to make sure, data in both clusters is being indexed in the same version, e.g data in the 7.17 does not come from un upgraded index from an earlier version. Could you confirm?

---

<div class="post-metadata">

### Author: ![Tomas\_Bartek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomas_bartek/32/45776_2.png) [@Tomas\_Bartek](https://discuss.elastic.co/u/Tomas_Bartek)
#### Post date: [June 8, 2023, 9:55am UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/13 "2023-06-08T09:55:43Z")

</div>

Sure @Ignacio_Vera

Under workload, Elasticsearch logs start to contain these two log events, quite often:

```auto
{
   "@timestamp":"2023-06-06T16:29:03.294Z",
   "log.level":"INFO",
   "message":"attempting to trigger G1GC due to high heap usage [7859992840]",
   "ecs.version":"1.2.0",
   "service.name":"ES_ECS",
   "event.dataset":"elasticsearch.server",
   "process.thread.name":"elasticsearch[x-elastic2-es8.xx][transport_worker][T#2]",
   "log.logger":"org.elasticsearch.indices.breaker.HierarchyCircuitBreakerService",
   "elasticsearch.cluster.uuid":"B5_WKX7-R8OvOAZwTy3DEg",
   "elasticsearch.node.id":"BAqS8hb9RaqifRMuKYVoKw",
   "elasticsearch.node.name":"x-elastic2-es8.xx",
   "elasticsearch.cluster.name":"x-cluster0-es8"
}

```

```auto
{
   "@timestamp":"2023-06-06T16:29:03.425Z",
   "log.level":"INFO",
   "message":"GC did bring memory usage down, before [7859992840], after [4110292480], allocations [87], duration [131]",
   "ecs.version":"1.2.0",
   "service.name":"ES_ECS",
   "event.dataset":"elasticsearch.server",
   "process.thread.name":"elasticsearch[x-elastic2-es8.xx][transport_worker][T#2]",
   "log.logger":"org.elasticsearch.indices.breaker.HierarchyCircuitBreakerService",
   "elasticsearch.cluster.uuid":"B5_WKX7-R8OvOAZwTy3DEg",
   "elasticsearch.node.id":"BAqS8hb9RaqifRMuKYVoKw",
   "elasticsearch.node.name":"x-elastic2-es8.xx",
   "elasticsearch.cluster.name":"x-cluster0-es8"
}

```

And sometimes also this log event (cca once per 10min workload):

```auto
{
   "@timestamp":"2023-06-06T16:29:09.324Z",
   "log.level":"WARN",
   "message":"failed to retrieve stats for node [zMZlF4RNT9eFWD0x7fQgaA]",
   "ecs.version":"1.2.0",
   "service.name":"ES_ECS",
   "event.dataset":"elasticsearch.server",
   "process.thread.name":"elasticsearch[x-elastic2-es8.xx][generic][T#3]",
   "log.logger":"org.elasticsearch.cluster.InternalClusterInfoService",
   "elasticsearch.cluster.uuid":"B5_WKX7-R8OvOAZwTy3DEg",
   "elasticsearch.node.id":"BAqS8hb9RaqifRMuKYVoKw",
   "elasticsearch.node.name":"x-elastic2-es8.xx",
   "elasticsearch.cluster.name":"x-cluster0-es8",
   "error.type":"org.elasticsearch.transport.RemoteTransportException",
   "error.message":"[x-elastic1-es8.xxx][10.0.57.14:9300][cluster:monitor/nodes/stats[n]]",
   "error.stack_trace":"org.elasticsearch.transport.RemoteTransportException: [x-elastic1-es8.xxx][10.0.57.14:9300][cluster:monitor/nodes/stats[n]]\nCaused by: org.elasticsearch.common.breaker.CircuitBreakingException: [parent] Data too large, data for [cluster:monitor/nodes/stats[n]] would be [7859247260/7.3gb], which is larger than the limit of [7857609113/7.3gb], real usage: [7859246184/7.3gb], new bytes reserved: [1076/1kb], usages [eql_sequence=0/0b, model_inference=0/0b, inflight_requests=1076/1kb, request=0/0b, fielddata=0/0b]\n\tat org.elasticsearch.indices.breaker.HierarchyCircuitBreakerService.checkParentLimit(HierarchyCircuitBreakerService.java:414)\n\tat org.elasticsearch.common.breaker.ChildMemoryCircuitBreaker.addEstimateBytesAndMaybeBreak(ChildMemoryCircuitBreaker.java:109)\n\tat org.elasticsearch.transport.InboundAggregator.checkBreaker(InboundAggregator.java:215)\n\tat org.elasticsearch.transport.InboundAggregator.finishAggregation(InboundAggregator.java:119)\n\tat org.elasticsearch.transport.InboundPipeline.forwardFragments(InboundPipeline.java:147)\n\tat org.elasticsearch.transport.InboundPipeline.doHandleBytes(InboundPipeline.java:121)\n\tat org.elasticsearch.transport.InboundPipeline.handleBytes(InboundPipeline.java:86)\n\tat org.elasticsearch.transport.netty4.Netty4MessageInboundHandler.channelRead(Netty4MessageInboundHandler.java:63)\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)\n\tat io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)\n\tat io.netty.handler.logging.LoggingHandler.channelRead(LoggingHandler.java:280)\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442)\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)\n\tat io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)\n\tat io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:103)\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)\n\tat io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)\n\tat io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1373)\n\tat io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1236)\n\tat io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1285)\n\tat io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529)\n\tat io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468)\n\tat io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290)\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)\n\tat io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)\n\tat io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)\n\tat io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)\n\tat io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)\n\tat io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788)\n\tat io.netty.channel.nio.NioEventLoop.processSelectedKeysPlan(NioEventLoop.java:689)\n\tat io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:652)\n\tat io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562)\n\tat io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997)\n\tat io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)\n\tat java.lang.Thread.run(Thread.java:1623)\n"
}

```

This correlates with these circuitbreaker Prometheus metrics:

 ![ciruitbreakes](https://us1.discourse-cdn.com/elastic/original/3X/6/9/6991bb353bc29ae76abd0de6c7a13eb6333d0515.png)

---

<div class="post-metadata">

### Author: ![Tomas\_Bartek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomas_bartek/32/45776_2.png) [@Tomas\_Bartek](https://discuss.elastic.co/u/Tomas_Bartek)
#### Post date: [June 8, 2023, 10:16am UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/14 "2023-06-08T10:16:09Z")

</div>

@Ignacio_Vera

Regarding data:

**Elasticsearch8**

- Data in testing/benchmark Elasticsearch v8.71 cluster were reindexed from the remote production Elasticsearch v8.71 cluster.

- Data in production Elasticsearch v8.71 cluster were reindexed from the remote Elasticsearch v7.17 (former production) during the upgrade process (ES 7.17 -\> ES 8.71).

- Initially we run tests in testing/benchmark Elasticsearch v8.71 also on data simply recovered from the production v8.71 snapshot without reindexing (with the same results).

**Elasticsearch7**

- Indexes in testing/benchmark Elasticsearch v7.17 were recovered from the snapshots of former production Elasticsearch v7.17 backups and locally reindexed to newly created indexes on the same cluster (to have the exact same mappings)

---

<div class="post-metadata">

### Author: ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)
#### Post date: [June 8, 2023, 11:34am UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/15 "2023-06-08T11:34:55Z")

</div>

I think it is the real\_memory circuit breaker that is actually tripping. You might want to check your JVM settings to see if there is something unusual / different between both deployments but I guess you will be using the default ones.

What I think is happening is that your documents are pretty big, in particular your shapes are big polygons. When you fetch those documents, you are filtering source, for example via ` "_source": ["level", "name"]`. Internally Elasticsearch still needs to read the whole document, uncompressed it and convert it to. a Map in order to fetch the attributes. This is pretty expensive, more over when the document contains massive geojson. You can see that from the hot threads on the 7 deplyment:

```auto
	com.fasterxml.jackson.core.util.TextBuffer.contentsAsDouble(TextBuffer.java:533)
	com.fasterxml.jackson.core.base.ParserBase._parseSlowFloat(ParserBase.java:911)
	com.fasterxml.jackson.core.base.ParserBase._parseNumericValue(ParserBase.java:860)
	com.fasterxml.jackson.core.base.ParserBase.getNumberValue(ParserBase.java:609)
	org.elasticsearch.xcontent.json.JsonXContentParser.numberValue(JsonXContentParser.java:172)
	org.elasticsearch.xcontent.support.AbstractXContentParser.readValueUnsafe(AbstractXContentParser.java:389)
	org.elasticsearch.xcontent.support.AbstractXContentParser.readListUnsafe(AbstractXContentParser.java:365)
	org.elasticsearch.xcontent.support.AbstractXContentParser.readValueUnsafe(AbstractXContentParser.java:397)
	org.elasticsearch.xcontent.support.AbstractXContentParser.readListUnsafe(AbstractXContentParser.java:365)
	org.elasticsearch.xcontent.support.AbstractXContentParser.readValueUnsafe(AbstractXContentParser.java:397)
	org.elasticsearch.xcontent.support.AbstractXContentParser.readListUnsafe(AbstractXContentParser.java:365)
	org.elasticsearch.xcontent.support.AbstractXContentParser.readValueUnsafe(AbstractXContentParser.java:397)
	org.elasticsearch.xcontent.support.AbstractXContentParser.readMapEntries(AbstractXContentParser.java:318)
	org.elasticsearch.xcontent.support.AbstractXContentParser.readValueUnsafe(AbstractXContentParser.java:394)
	org.elasticsearch.xcontent.support.AbstractXContentParser.readMapEntries(AbstractXContentParser.java:318)
	org.elasticsearch.xcontent.support.AbstractXContentParser.readMapSafe(AbstractXContentParser.java:304)
	org.elasticsearch.xcontent.support.AbstractXContentParser.map(AbstractXContentParser.java:254)
	org.elasticsearch.common.xcontent.XContentHelper.convertToMap(XContentHelper.java:210)
	org.elasticsearch.common.xcontent.XContentHelper.convertToMap(XContentHelper.java:138)
	org.elasticsearch.common.xcontent.XContentHelper.convertToMap(XContentHelper.java:106)
	org.elasticsearch.search.lookup.SourceLookup.sourceAsMapAndType(SourceLookup.java:93)
	org.elasticsearch.search.lookup.SourceLookup.source(SourceLookup.java:69)
	org.elasticsearch.search.lookup.SourceLookup.filter(SourceLookup.java:188)
	org.elasticsearch.search.fetch.subphase.FetchSourcePhase$1.hitExecute(FetchSourcePhase.java:70)
	org.elasticsearch.search.fetch.subphase.FetchSourcePhase$1.process(FetchSourcePhase.java:54)
	org.elasticsearch.search.fetch.FetchPhase.buildSearchHits(FetchPhase.java:172)
	org.elasticsearch.search.fetch.FetchPhase.execute(FetchPhase.java:93)
	org.elasticsearch.search.SearchService.lambda$executeFetchPhase$7(SearchService.java:793)

```

This code path is very different in Elasticsearch 8, mainly because the [API changed](https://github.com/apache/lucene/pull/12116) in lucene. Maybe this change has made handling big documents less efficient, I would need to try to reproduce it:

```auto
	org.apache.lucene.util.compress.LZ4.decompress(LZ4.java:140)
	org.apache.lucene.codecs.lucene90.LZ4WithPresetDictCompressionMode$LZ4WithPresetDictDecompressor.decompress(LZ4WithPresetDictCompressionMode.java:133)
	org.apache.lucene.codecs.lucene90.compressing.Lucene90CompressingStoredFieldsReader$BlockState$1.fillBuffer(Lucene90CompressingStoredFieldsReader.java:556)
	org.apache.lucene.codecs.lucene90.compressing.Lucene90CompressingStoredFieldsReader$BlockState$1.readBytes(Lucene90CompressingStoredFieldsReader.java:575)
	org.apache.lucene.codecs.lucene90.compressing.Lucene90CompressingStoredFieldsReader.readField(Lucene90CompressingStoredFieldsReader.java:244)
	org.apache.lucene.codecs.lucene90.compressing.Lucene90CompressingStoredFieldsReader.document(Lucene90CompressingStoredFieldsReader.java:642)
	org.apache.lucene.index.SegmentReader.document(SegmentReader.java:253)
	org.apache.lucene.index.FilterLeafReader.document(FilterLeafReader.java:404)
	org.apache.lucene.index.FilterLeafReader.document(FilterLeafReader.java:404)
	org.elasticsearch.search.internal.FieldUsageTrackingDirectoryReader$FieldUsageTrackingLeafReader.document(FieldUsageTrackingDirectoryReader.java:141)
	org.apache.lucene.index.FilterLeafReader.document(FilterLeafReader.java:404)
	org.elasticsearch.index.fieldvisitor.StoredFieldLoader$$Lambda$8282+0x000000080250fb70.accept(Native method)
	org.elasticsearch.index.fieldvisitor.StoredFieldLoader$ReaderStoredFieldLoader.advanceTo(StoredFieldLoader.java:172)
	org.elasticsearch.search.fetch.FetchPhase.prepareNonNestedHitContext(FetchPhase.java:235)
	org.elasticsearch.search.fetch.FetchPhase.prepareHitContext(FetchPhase.java:204)
	org.elasticsearch.search.fetch.FetchPhase$1.nextDoc(FetchPhase.java:143)
	org.elasticsearch.search.fetch.FetchPhaseDocsIterator.iterate(FetchPhaseDocsIterator.java:70)
	org.elasticsearch.search.fetch.FetchPhase.buildSearchHits(FetchPhase.java:161)
	org.elasticsearch.search.fetch.FetchPhase.execute(FetchPhase.java:76)
	org.elasticsearch.search.SearchService.lambda$executeFetchPhase$7(SearchService.java:811)

```

If my suspicion is right and you have huge documents due to the geometry and you only want to retrieve small part of the documents, you might want to consider storing those fields and get them directly without having to read all \_source. More in. the [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/8.8/mapping-store.html#mapping-store), you just need to replace `"A very long content field..."` by `"A very large geometry..."`

---

<div class="post-metadata">

### Author: ![Tomas\_Bartek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomas_bartek/32/45776_2.png) [@Tomas\_Bartek](https://discuss.elastic.co/u/Tomas_Bartek)
#### Post date: [June 8, 2023, 2:33pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/16 "2023-06-08T14:33:30Z")

</div>

@Ignacio_Vera Thank you, I will try a cool idea with the `store` mapping parameter.

**JVM settings:**  
Yes, we use defaults on both ES7/ES8 setups. I have checked parameters with `GET _nodes/jvm` and everything looks OK.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2023, 2:34pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594/17 "2023-07-06T14:34:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
