We have noticed on our system that our search_throttled thread pool has an extremely high number of rejected request. Each node has about ~4k-6k.
To my understanding, the search_throttled thread pool is reserved specifically for searching frozen indices. The index pattern we are using for searches contains: hot, warm, and frozen indices.
For example- the index pattern is: ids-*
The system has been up for some time so the ids index is currently at: ids-500
Since ids-001, ids-002, etc are so old we decided to freeze those indices.
However since the index pattern is ids-* Elastic technically has to reach out to each index to verify that it does not contain data that matches the parameters of the query.
Could the fact that frozen indices are apart of the index pattern cause the search_throttled thread pool to increase? Is it bad practice to include frozen indices in index patterns? If enough searches (whether from dashboards, visualizations, or discovery) are run; could these search_throttled threads turn into hot threads? Are there any other general negative ramifications that occur if thread pools keep having to reject a large number of requests?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.