Loaded coordinating nodes
Some coordinating nodes show materially higher CPU utilization than their peers. Uneven coordinating load can bottleneck search and bulk requests and lead to timeouts on the busiest nodes.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Node |
| Domains | performance, search, resource-utilization |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| CPU percent above peer baseline | Integer | 180 |
| Consecutive samples meeting the imbalance conditions | Integer | 3 |
| Minimum CPU utilization to consider a node loaded | Integer | 1 |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
CPU utilization on es-data-01 and es-data-02 is sustained above the peer baseline for coordinating nodes.
Indices with high search activity:
logs-prod-000045Indices with high indexing activity:
logs-prod-000045
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Restart coordinating node
Condition: Shown when coordinating node CPU load is unbalanced.
Restart the coordinating node (es-data-01) to clear stuck work, free memory, and reshuffle client connections.
Coordinating nodes fan out search and indexing requests and gather responses. When a few absorb most client traffic, those nodes become bottlenecks while other coordinating nodes sit underused. A common cause is clients that pin requests to a subset of endpoints instead of spreading across the coordinating pool.
If the imbalance persists, queries and bulks on the overloaded nodes are more likely to time out.