we have an ES cluster with hot-warm architecture.
- Hot nodes have local attached SSDs (indexing, current data)
- Warm nodes use a NFS storage (archived data)
The performance for NFS related queries are good and there are also no general problems with NFS.
But we monitor constant 1000 getattr iops per node (currently 3 nodes with NFS -> 3000, see graph). During the day the nodes are in idle (just a few queries). Between 03:00 and 08:00 you can see reallocation jobs from hot to warm.
The question is why there are so many getattrs at idle - and could it be reduced?