Rollup Jobs extremly high CPU USage

[michaelpietzsch]

Hi Guys and Gals,

i've got a rollup job running on my cluster. Once its active CPU Spikes extremely. The cluster consists of 6 Dedicated data nodes. How can this happen?

Regards Michael

[warkolm (Mark Walkom)]

I guess that depends on a bunch of things.
What does the rollup job look like?
How much data does it involve?
How many shards and indices do you have?
What are your node specs?

[michaelpietzsch]

Hi, @warkolm
We got 3nodes for Master purpuses only and 6 Worker nodes that have all other tasks
Each node has
8 Cores / 64 GB RAM / 6TB Fast storage

We are talking about 14 Days of data. Spread over multiple indices that are 50gb in size.
Each index has 1 shard and 1 replica. And contains about 111116130 docs. We got about 50 indexes in those 14 days

{
      "index_pattern": "pingdirectory*",
      "rollup_index": "rolled-daily.pingdirectory",
      "cron": "*/30 * * * * ?",
      "page_size": 10000,
      "groups": {
        "date_histogram": {
          "fixed_interval": "24h",
          "field": "@timestamp",
          "delay": "5m",
          "time_zone": "UTC"
        },
        "terms": {
          "fields": [
            "messageType",
            "disconnectReason",
            "hostname",
            "operationType",
            "directorytype",
            "environment",
            "connectionID",
            "fromAddress.keyword",
            "requesterDN.keyword",
            "requesterIP.keyword"
          ]
        }
      },
      "metrics": [
        {
          "field": "processingTimeMillis",
          "metrics": [
            "value_count",
            "avg",
            "max",
            "min"
          ]
        },
        {
          "field": "entriesReturned",
          "metrics": [
            "value_count",
            "avg"
          ]
        }
      ]
}