Two hot-nodes ingesting live data. After x amount of days ILM will rollover the indices and then move the indices to a cold-node where we close the indices after 7 days. This works great but i wonder if my setup is working correctly.
For instance, closed indices are still being counted as "active" by looking at the monitoring page and at how many indices our cold-node is having (notice 2392 shards active for the archive-node):
Recent versions of Elasticsearch keep track of closed and frozen indices to make sure they get replicated on node failures. With only one cold node you do not benefit from that but it is still there and as they therefore need to be tracked they count against the limit. Elasticsearch 7.7 introduced improvements that reduce heap usage significantly so if you upgrade you may be able to simply keep the indices open instead of freezing or closing them.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
