Strange behavior of ElasticSearch

Elastic Stack Elasticsearch
1

Hello everyone,

for 2 days, I have a strange behavior with ElasticSearch. This is the
context:

  • 1 clsuter with 3 node
  • os : debian
  • version 1.4.0 (official package)
  • OS mem : 12 Go
  • JMX : 8 Go
  • CPU : Intel(R) Xeon(R) CPU E5-2650 0 @ 2.00GHz
  • Nb CPU : 9

From 7 am Monday, I was an increase in the use of RAM. Recycling the
JMX is from once per day to once every 2 hours. I have no explanation.
The CPU is overused. The response time is 10 ms instead of 3,5mns.
Restarting each node has not changed anything.

Do you have a method or tools to diagnose ElasticSearch behavior ?
Should I upgrade to version 1.4.3 ?

Thank you.

Alex

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/54E34D69.6070800%40opendoc.net.
For more options, visit https://groups.google.com/d/optout.

2

Hello everyone,

I activated the index_search_slowlog.log. Is it possible to log the IP
of the machine in the slowlog ?

Thank you.

Alex.

On 17/02/15 15:17, Alexandre wrote:

Hello everyone,

for 2 days, I have a strange behavior with Elasticsearch. This is the
context:

  • 1 clsuter with 3 node
  • os : debian
  • version 1.4.0 (official package)
  • OS mem : 12 Go
  • JMX : 8 Go
  • CPU : Intel(R) Xeon(R) CPU E5-2650 0 @ 2.00GHz
  • Nb CPU : 9

From 7 am Monday, I was an increase in the use of RAM. Recycling the
JMX is from once per day to once every 2 hours. I have no explanation.
The CPU is overused. The response time is 10 ms instead of 3,5mns.
Restarting each node has not changed anything.

Do you have a method or tools to diagnose Elasticsearch behavior ?
Should I upgrade to version 1.4.3 ?

Thank you.

Alex

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/54E3A224.4020908%40opendoc.net.
For more options, visit https://groups.google.com/d/optout.

3

How many indices in the cluster, how many shards, how much data is that in
GB?

On 18 February 2015 at 01:17, Alexandre infos@opendoc.net wrote:

Hello everyone,

for 2 days, I have a strange behavior with Elasticsearch. This is the
context:

  • 1 clsuter with 3 node
  • os : debian
  • version 1.4.0 (official package)
  • OS mem : 12 Go
  • JMX : 8 Go
  • CPU : Intel(R) Xeon(R) CPU E5-2650 0 @ 2.00GHz
  • Nb CPU : 9

From 7 am Monday, I was an increase in the use of RAM. Recycling the JMX
is from once per day to once every 2 hours. I have no explanation. The CPU
is overused. The response time is 10 ms instead of 3,5mns. Restarting each
node has not changed anything.

Do you have a method or tools to diagnose Elasticsearch behavior ? Should
I upgrade to version 1.4.3 ?

Thank you.

Alex

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/
msgid/elasticsearch/54E34D69.6070800%40opendoc.net.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAEYi1X959_QgNPKb_wqG8M7Hbb-N8T%2BYJYfNyTp8ofGAmOhcYA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

4

Hi Mark,

I currently have five indexes with 5 shards by index :

1 : 7.24MB
2 : 257MB
3 : 623kB
4 : 30.2MB
5 : 629MB

I think it's nothing for Elasticsearch.

I activated the slow log and found that the http bing robots are
researching for 50 hours !

The problem is fixed now. Stats search is now 3.5ms.

Thank you Mark.

Good day.

Alex.

On 17/02/15 23:15, Mark Walkom wrote:

How many indices in the cluster, how many shards, how much data is that
in GB?

On 18 February 2015 at 01:17, Alexandre <infos@opendoc.net
mailto:infos@opendoc.net> wrote:

Hello everyone,

for 2 days, I have a strange behavior with ElasticSearch. This is
the context:

- 1 clsuter with 3 node
- os : debian
- version 1.4.0 (official package)
- OS mem : 12 Go
- JMX : 8 Go
- CPU : Intel(R) Xeon(R) CPU E5-2650 0 @ 2.00GHz
- Nb CPU : 9

 From 7 am Monday, I was an increase in the use of RAM. Recycling
the JMX is from once per day to once every 2 hours. I have no
explanation. The CPU is overused. The response time is 10 ms instead
of 3,5mns. Restarting each node has not changed anything.

Do you have a method or tools to diagnose ElasticSearch behavior ?
Should I upgrade to version 1.4.3 ?

Thank you.

Alex

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it,
send an email to elasticsearch+unsubscribe@__googlegroups.com
<mailto:elasticsearch%2Bunsubscribe@googlegroups.com>.
To view this discussion on the web visit
https://groups.google.com/d/__msgid/elasticsearch/54E34D69.__6070800%40opendoc.net
<https://groups.google.com/d/msgid/elasticsearch/54E34D69.6070800%40opendoc.net>.
For more options, visit https://groups.google.com/d/__optout
<https://groups.google.com/d/optout>.

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com
mailto:elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAEYi1X959_QgNPKb_wqG8M7Hbb-N8T%2BYJYfNyTp8ofGAmOhcYA%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAEYi1X959_QgNPKb_wqG8M7Hbb-N8T%2BYJYfNyTp8ofGAmOhcYA%40mail.gmail.com?utm_medium=email&utm_source=footer.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/54E474BD.7040404%40opendoc.net.
For more options, visit https://groups.google.com/d/optout.