# org.elasticsearch.action.get.MultiGetShardResponse extremly high "\[took\]" value

**URL:** <https://discuss.elastic.co/t/org-elasticsearch-action-get-multigetshardresponse-extremly-high-took-value/294434>\
**Category:** Elasticsearch\
**Created:** [January 14, 2022, 4:14pm UTC](https://discuss.elastic.co/t/org-elasticsearch-action-get-multigetshardresponse-extremly-high-took-value/294434 "2022-01-14T16:14:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![trocade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trocade/32/100338_2.png) [@trocade](https://discuss.elastic.co/u/trocade)\
**Post date:** [January 14, 2022, 4:14pm UTC](https://discuss.elastic.co/t/org-elasticsearch-action-get-multigetshardresponse-extremly-high-took-value/294434/1 "2022-01-14T16:14:09Z")

</div>

So we have some problems that something in our environment is causing our nodes to run out of HEAP memory (30GB per node)

While looking at this I found these messages:  
`server es_server[1635]: {"type": "server", "timestamp": "2022-01-14T14:09:25,148Z", "level": "WARN", "component": "o.e.t.OutboundHandler", "cluster.name": "cluster", "node.name": "cluster_nodes", "message": "sending transport message [MessageSerializer{Response{137295044}{false}{false}{false}{class org.elasticsearch.action.get.MultiGetShardResponse}}] of size [-1] on [Netty4TcpChannel{localAddress=/x.x.x.x:9300, remoteAddress=/x.x.x.x:45408, profile=default}] took [3965304145ms] which is above the warn threshold of [5000ms]", "cluster.uuid": "CLUSTERUUID", "node.id": "NODEUUID" }`

So this value equals roughly 45 days, the cluster has a uptime of 23 days.  
This is running on basic license ES 7.13.1

I know it is not a lot to go on, but has anyone seen this behaviour?

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [January 14, 2022, 5:40pm UTC](https://discuss.elastic.co/t/org-elasticsearch-action-get-multigetshardresponse-extremly-high-took-value/294434/2 "2022-01-14T17:40:25Z")

</div>

This seems to mean that the message was released due to a failure before it was sent, so the `startTime` and `size` fields contained junk, which looks possible in this version if the node was shutting down at about the same time. In newer versions [#72442](https://github.com/elastic/elasticsearch/pull/72442) should prevent this I think.

---

<div class="post-metadata">

**Author:** ![trocade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trocade/32/100338_2.png) [@trocade](https://discuss.elastic.co/u/trocade)\
**Post date:** [January 15, 2022, 3:15pm UTC](https://discuss.elastic.co/t/org-elasticsearch-action-get-multigetshardresponse-extremly-high-took-value/294434/3 "2022-01-15T15:15:48Z")

</div>

Thank you David!

I will look into if we can upgrade, from my understanding this is mainly a cosmetic issue in our case.

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [January 15, 2022, 4:45pm UTC](https://discuss.elastic.co/t/org-elasticsearch-action-get-multigetshardresponse-extremly-high-took-value/294434/4 "2022-01-15T16:45:44Z")

</div>

> [@trocade](#):
>
> from my understanding this is mainly a cosmetic issue in our case.

That's my understanding too, yes.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 12, 2022, 4:46pm UTC](https://discuss.elastic.co/t/org-elasticsearch-action-get-multigetshardresponse-extremly-high-took-value/294434/5 "2022-02-12T16:46:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.