It's a bit wrong here, because it is more linux related than to elasticsearch, but I would like to give it a try.
Seems as if our ES instance is lacking in IO speed. If the linux machine has enough RAM, is there a possibility to:
- put the indizes of the last 5 days to a persistent ramdisk (loads and saves data to disk after start / during shutdown)
- Tell linux to priorize most recent indices for file system caching?
- To preload most recent indices into file system caching?
Running RHEL 7.3 and ELK 5.1.2