Optimizing setup which contains a single cold-node

Elastic Stack Elasticsearch
1

Hey there,

We currently have the following setup:

Two hot-nodes ingesting live data. After x amount of days ILM will rollover the indices and then move the indices to a cold-node where we close the indices after 7 days. This works great but i wonder if my setup is working correctly.

For instance, closed indices are still being counted as "active" by looking at the monitoring page and at how many indices our cold-node is having (notice 2392 shards active for the archive-node):

elk-stack
elk-stack1971×701 75.6 KB

Is this correct? Should we be freezing the indices instead?
Also, the archive-node (cold-node) have 16k segments.

2

Which version of Elasticsearch are you using?

3

We're using Elasticsearch 7.6.0

4

Recent versions of Elasticsearch keep track of closed and frozen indices to make sure they get replicated on node failures. With only one cold node you do not benefit from that but it is still there and as they therefore need to be tracked they count against the limit. Elasticsearch 7.7 introduced improvements that reduce heap usage significantly so if you upgrade you may be able to simply keep the indices open instead of freezing or closing them.