Hi !
Having an elastic cluster with 3 nodes under docker. 2 data nodes (indices with replica 1 and only 1 shard) and one node for the master eligibilty. ES 7.17.x
8 GB RAM / data node, 6 GB for docker, 3 GB XMX for ES. A little swap but no IO in swap.
One indice has grown too much. It is about at 64 Go for now. No ILM policy to rollover it.
We have too much IO on the data nodes. About 500 MBytes/s read per node.
An application is requesting the indice, but apparently not so much in term of request. Perhaps 1000 requests / minute. I do not have information about the requests done.
Firstly, I plan to rollover the indice (20 Go / shard). But it is bad named, no number in its name (tran_index_file). So I have thought to reindex it to tran_index_file-000001 with an ILM policy attached to this new index. But according to my first tests, ILM policy does not apply during the reindex phase. So tran_index_file-000001 could be rollover then, but its size won't change.
Secondly, I think about split-index into 3 or 4 shards to lower the size of shard.
So what would be your recommandations about my problem ?
Thanks !