# My ELK Cluster is slow indexing Why? Please Help

**URL:** <https://discuss.elastic.co/t/my-elk-cluster-is-slow-indexing-why-please-help/260542>\
**Category:** Elasticsearch\
**Created:** [January 8, 2021, 12:30pm UTC](https://discuss.elastic.co/t/my-elk-cluster-is-slow-indexing-why-please-help/260542 "2021-01-08T12:30:36Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![HKN\_MZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hkn_mz/32/75678_2.png) [@HKN\_MZ](https://discuss.elastic.co/u/HKN_MZ)\
**Post date:** [January 8, 2021, 12:30pm UTC](https://discuss.elastic.co/t/my-elk-cluster-is-slow-indexing-why-please-help/260542/1 "2021-01-08T12:30:36Z")

</div>

I am trying to send data to Elasticsearch, but elasticsearch indexing is soo slow. Some usefull outputs on below.

`GET _/nodes/hot_threads?pretty` is the output;

> <https://gist.github.com/HAKANMAZI/fee969b958e51591c1437be07ff13129>

`GET _cluster/stats` is the output;

> <https://gist.github.com/HAKANMAZI/81f82ae3e3491a3241242469822f11aa>

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 8, 2021, 12:52pm UTC](https://discuss.elastic.co/t/my-elk-cluster-is-slow-indexing-why-please-help/260542/2 "2021-01-08T12:52:05Z")

</div>

It seems to be busy with some heavy searches based on the hot threads data. What kind of search load is the cluster under?

What type of hardware and storage are you using?

---

<div class="post-metadata">

**Author:** ![myspacebarisbroken](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@myspacebarisbroken](https://discuss.elastic.co/u/myspacebarisbroken)\
**Post date:** [January 9, 2021, 7:00am UTC](https://discuss.elastic.co/t/my-elk-cluster-is-slow-indexing-why-please-help/260542/3 "2021-01-09T07:00:53Z")

</div>

As Christian mentioned, there's an insane load on your server right now, 102% CPU on that live thread?

If you're doing heavy index operations, either pause all ongoing operations to tune for indexing speed, or simply scale your cluster up (get better hardware).

---

<div class="post-metadata">

**Author:** ![HKN\_MZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hkn_mz/32/75678_2.png) [@HKN\_MZ](https://discuss.elastic.co/u/HKN_MZ)\
**Post date:** [January 11, 2021, 11:42am UTC](https://discuss.elastic.co/t/my-elk-cluster-is-slow-indexing-why-please-help/260542/4 "2021-01-11T11:42:47Z")

</div>

Thanks for everyone fastly reply, I am sorry with lately answer because of weekend.  
As you all guys said my cluster under heavy searched because it under the live application.

> What type of hardware and storage are you using?

Raid0 mixture of Ssd and Sata disks,

---

<div class="post-metadata">

**Author:** ![HKN\_MZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hkn_mz/32/75678_2.png) [@HKN\_MZ](https://discuss.elastic.co/u/HKN_MZ)\
**Post date:** [January 11, 2021, 12:17pm UTC](https://discuss.elastic.co/t/my-elk-cluster-is-slow-indexing-why-please-help/260542/5 "2021-01-11T12:17:30Z")

</div>

I have a 11 data nodes and 3 master nodes. Maybe I can convert some data nodes to master node, you think is it okey?

Also I have 30gb java heap but I have 956 shards (primary and replica). Is this normal?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 11, 2021, 1:39pm UTC](https://discuss.elastic.co/t/my-elk-cluster-is-slow-indexing-why-please-help/260542/6 "2021-01-11T13:39:34Z")

</div>

3 dedicated master nodes is great and there is no need to add more. Can you elaborate on the structure if your cluster and which nodes use what storage? Are you using a hot/warm deployment? What is the use case?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2021, 1:39pm UTC](https://discuss.elastic.co/t/my-elk-cluster-is-slow-indexing-why-please-help/260542/7 "2021-02-08T13:39:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
