Timestamp and _timestamp


(Николай Колев) #1

Hi all,
I have a ES cluster with four nodes and 157 indexes. There are about 140
mln. entries that occupy around 50 GB size (1 primary index with one
replica). There are 2 data nodes, one pure master and one client node that
serve as gate for web requests.
Last days I started to observe that the cluster becomes very unstable and
every few hours one of the data server stop unexpectedly. The only solution
was to reboot all data nodes to be able to process future logging.
My mapping contains this definitions:
"Timestamp": {
"type": "date",
"format": "date_time"
}
and
"_timestamp" : { "enabled" : true, "path" : "Timestamp" },

After some tests I discovered that if I do request with filtering on
Timestamp the CPU load becomes very high and the cluster gets unstable. All
incoming events are rejected.
While when I make requests filtering on _timestamp everything works well as
expected.

My question is: why this is happening and what is the source of this
behavior?
Any ideas how to fix it?

Thanks in advance,
Nickolay Kolev

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/2a4cfa7b-fdfe-45a4-8bd2-906d8587a4f4%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(system) #2