memory management for elasticsearch

Question

I am trying to calculate good balance of total memory in three node es cluster.

If I have three node e.s cluster each with 32G memory, 8 vcpu. Which combination would be more suitable for balancing memory between all the components? I know there will be no fixed answers but just trying to get as accurate as I can.

different elasticsearch components will be used are beats (filebeat, metricbeat,heartbeat), logstash, elasticsearch, kibana.

most use case for this cluster will be, application logs getting indexed and running query on them like fetch average response time for 7 days,30 days, how many are different status codes for last 24 hrs, 7 days etc through curl calls, so aggregation will be used and other use case is monitoring, seeing logs through kibana but no ML jobs or dashboard creation etc..

After going through below official docs, its recommended to set heap size as below,

logstash -

https://www.elastic.co/guide/en/logstash/current/jvm-settings.html#heap-size

The recommended heap size for typical ingestion scenarios should be no less than 4GB and no more than 8GB.

elasticsearch -

https://www.elastic.co/guide/en/elasticsearch/reference/current/advanced-configuration.html#set-jvm-heap-size

Set Xms and Xmx to no more than 50% of your total memory. Elasticsearch requires memory for purposes other than the JVM heap

Kibana -

I have't found default or recommended memory for kibana but in our test cluster of single node of 8G memory it is taking 1.4G as total (256 MB/1.4 GB)

beats -

not found what is the default or recommended memory for beats but they will also consume more or less.

What should the ideal combination from below?

32G = 16G for OS + 16G for Elasticsearch heap.
for logstash 4G from 16G of OS, say three beats will consume 4G, kibana 2G
this leaves OS with 6G and if any new component has to be install in future like say APM or any other OS related then they all will have only 6G with OS.

Above is, per offical recommendation for all components. (i.e 50% for OS and 50% for es)

32G = 8G for elasticsearch heap. (25% for elasticsearch)
4G for logstash + beats 4G + kibana 2G
this leaves 14G for OS and for any future component.

I am missing to cover something that can change this memory combination?

Any suggestion by changing in above combination or any new combination is appreciated.

Thanks,

ok I just noticed, I have mentioned all components on all three nodes which might not required. I think we can have `elasticsearch` on all three nodes, `logstash` and `kibana` on 2 nodes, so there will be less memory consumption on the third node which will not have `logstash` and `kibana` but question still remains for the node first two nodes which will have all the components. — prat, Aug 07 '21 at 10:28
First off, it is always recommended to leave Elasticsearch alone on each node and not mix with Logstash and Kibana. The only thing to be installed on the same nodes as ES are Filebeat/Metricbeat for log/metric monitoring purposes, nothing else. The last thing you want concerning ES is to create imbalances and resource competition because of other processes running on the same nodes. — Val, Aug 07 '21 at 13:31
@Val, Thanks for reply. Can you please share document link putting more light on this so that it can be share within team. But what would be your advise on above if using only 3 servers with above config is the only option. — prat, Aug 07 '21 at 13:36
Hi @Val, Can you please reply. I know you have already given your answer but from your experience can you suggest with above scenario please? — prat, Aug 08 '21 at 11:31
Anyone else has any suggestion ? can be helpful for others also looking for similar in future. — prat, Aug 11 '21 at 12:03
to echo @Val's comments, you really don't want to put everything on the one host if you can. if you need to, then consider dropping Elasticsearch to 6GB and then leave the defaults for the rest of the stack — warkolm, Sep 22 '21 at 02:32

memory management for elasticsearch

0 Answers0