CODEWITHSUNDEEP
elasticsearchelastic-stack
M.Karademir
M.Karademir

Reputation: 15

Elasticsearch Node Crashing

We receive these errors in a node in our cluster, and the node gives these errors hype cpu and load to the maximum level of elasticsearch can not respond. node resources 2 CPU 8 RAM

Elasticsearch version : 6.5.4

Errors : 1)

Found index level settings on node level configuration.

Since elasticsearch 5.x index level settings can NOT be set on the nodes
configuration like the elasticsearch.yaml, in system properties or command line
arguments.In order to upgrade all indices the settings must be updated via the
/${index}/_settings API. Unless all settings are dynamic all indices must be closed
in order to apply the upgradeIndices created in the future should use index templates
to set default values.

Please ensure all required values are updated on all indices by executing:

curl -XPUT 'http://localhost:9200/_all/_settings?preserve_existing=true' -d '{
"index.refresh_interval" : "2m"
}'

2)

[2019-06-10T13:17:31,996][WARN ][o.e.d.s.a.MultiBucketConsumerService] [elasticsearch6_data02] This aggregation creates too many buckets (10480) and will throw an error in future versions. You should update the [search.max_buckets] cluster setting or use the [composite] aggregation to paginate all buckets in multiple requests.
org.elasticsearch.index.mapper.MapperParsingException: failed to parse field [flashlogExtra.installedVersion] of type [text]

java version : openjdk version "1.8.0_212"

JVM configuration
-Xms3843m
-Xmx3843m
-XX:+UseParNewGC
-XX:+UseConcMarkSweepGC
-XX:CMSInitiatingOccupancyFraction=75
-XX:+UseCMSInitiatingOccupancyOnly
-XX:+HeapDumpOnOutOfMemoryError
-XX:+PrintGCDetails

Upvotes: 0

Views: 572

Answers (1)

Amit
Amit

Reputation: 32376

There are multiple issues.

Let's start with the simplest.

  1. org.elasticsearch.index.mapper.MapperParsingException: failed to parse field [flashlogExtra.installedVersion] of type [text]

    This exception clearly says that field flashlogExtra.installedVersion in your mapping, is defined as text field which ES is not able to parse, . in the field name is used to define the object type in ES and read more about it here. I am suspecting, you are using the mapping defined in an earlier version of ES in your current ES version as . in field name was supported in ES 1.x version.

  2. Second warning or ERROR which is not shown in your post is related to some settings which are no more applicable to ES version you are using, in logs you should have the information of this setting. But it's easy to solve as a hint to solve this is also shown in the message like below

curl -XPUT 'http://localhost:9200/_all/_settings?preserve_existing=true' -d '{ "index.refresh_interval" : "2m" }'

  1. Third warning, which is the cause of your slow performance of your cluster is [2019-06-10T13:17:31,996][WARN ][o.e.d.s.a.MultiBucketConsumerService] [elasticsearch6_data02] This aggregation creates too many buckets (10480) and will throw an error in future versions. You should update the [search.max_buckets] cluster setting or use the [composite] aggregation to paginate

    This warning gives you a hint that some of your aggregation search queries are creating a huge no of buckets in ES, no is given as 10480 which is huge and ES is advising you to use search.max_buckets to reduce this no or use composite aggregation to avoid these many buckets.

Hope you would be able to solve these issues one by one and let me know if its solves your issue.

Upvotes: 1

Related Questions