Get a DemoStart Free TrialSign In
backBack to Blog

ELK, Tips, Resources

9 min read

Elasticsearch is a powerful search and analytics engine that forms the core of many modern logging and monitoring solutions, including the ELK Stack. However, as your data grows and query complexity increases, performance can become a significant challenge. Whether you're running Elasticsearch for log analysis, application search, or business intelligence, optimizing its performance is crucial for maintaining responsive applications and efficient operations. This comprehensive guide covers the most effective Elasticsearch performance optimization techniques, from basic configuration tweaks to advanced cluster tuning strategies. We'll explore indexing optimizations, query performance improvements, hardware considerations, and monitoring best practices that will help you get the most out of your Elasticsearch deployment.

Contents

Understanding Elasticsearch Performance Factors

Before diving into specific optimization techniques, it's important to understand the key factors that influence Elasticsearch performance. These factors interact with each other and can have significant impacts on your cluster's overall performance.

Primary Performance Factors

Several factors directly affect Elasticsearch performance:

  • Hardware resources: CPU, memory, disk I/O, and network bandwidth
  • Index design: Mapping configuration, field types, and index settings
  • Query complexity: Search queries, aggregations, and filtering
  • Cluster configuration: Node roles, shard allocation, and cluster settings
  • Data volume and growth: Index size, document count, and growth patterns
  • Concurrent operations: Number of simultaneous queries and indexing operations

Performance Metrics to Monitor

Track these key metrics to understand your cluster's performance:

  • Query latency: Time taken to execute search queries
  • Indexing throughput: Documents indexed per second
  • CPU utilization: CPU usage across all nodes
  • Memory usage: Heap and off-heap memory consumption
  • Disk I/O: Read/write operations and disk space
  • Network I/O: Data transfer between nodes
  • GC metrics: Garbage collection frequency and duration

Index Design and Mapping Optimization

Proper index design is fundamental to Elasticsearch performance. The way you structure your indices and define field mappings can have a dramatic impact on query performance and storage efficiency.

Field Mapping Best Practices

Optimize your field mappings for better performance:

1. Choose Appropriate Field Types

Select the most appropriate field types for your data:

# Example mapping with optimized field types
PUT /logs
{
  "mappings": {
    "properties": {
      "timestamp": {
        "type": "date",
        "format": "strict_date_optional_time||epoch_millis"
      },
      "level": {
        "type": "keyword",
        "ignore_above": 256
      },
      "message": {
        "type": "text",
        "analyzer": "standard",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "user_id": {
        "type": "keyword"
      },
      "response_time": {
        "type": "float"
      },
      "status_code": {
        "type": "short"
      }
    }
  }
}

2. Use Keyword Fields for Exact Matches

Use keyword fields for exact matches, filtering, and aggregations:

# Good: Using keyword for exact matches
GET /logs/_search
{
  "query": {
    "term": {
      "level.keyword": "ERROR"
    }
  }
}


Avoid: Using text field for exact matches


GET /logs/_search
{
  "query": {
    "match": {
      "level": "ERROR"
    }
  }
}

3. Optimize Text Fields

Configure text fields for your specific use cases:

# Optimized text field configuration
"message": {
  "type": "text",
  "analyzer": "standard",
  "search_analyzer": "standard",
  "index_options": "positions",
  "norms": false,
  "fields": {
    "keyword": {
      "type": "keyword",
      "ignore_above": 256
    },
    "ngram": {
      "type": "text",
      "analyzer": "ngram_analyzer"
    }
  }
}

Index Settings Optimization

Configure index settings for optimal performance:

1. Shard Configuration

Optimize the number of shards for your use case:

# Create index with optimized shard settings
PUT /logs
{
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1,
    "refresh_interval": "30s",
    "index.max_result_window": 10000
  }
}

2. Index Lifecycle Management

Implement ILM policies for automatic index management:

# ILM policy for log indices
PUT _ilm/policy/logs-policy
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_size": "50GB",
            "max_age": "1d"
          }
        }
      },
      "warm": {
        "min_age": "1d",
        "actions": {
          "forcemerge": {
            "max_num_segments": 1
          },
          "shrink": {
            "number_of_shards": 1
          }
        }
      },
      "cold": {
        "min_age": "7d",
        "actions": {
          "freeze": {}
        }
      },
      "delete": {
        "min_age": "30d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

Query Performance Optimization

Query optimization is crucial for maintaining responsive applications. Understanding how to write efficient queries and use the right search techniques can dramatically improve performance.

Query Optimization Techniques

Implement these techniques to improve query performance:

1. Use Filter Context When Possible

Filters are cached and don't affect relevance scores:

# Good: Using filter context
GET /logs/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "message": "error"
          }
        }
      ],
      "filter": [
        {
          "range": {
            "timestamp": {
              "gte": "now-1d"
            }
          }
        },
        {
          "term": {
            "level.keyword": "ERROR"
          }
        }
      ]
    }
  }
}

2. Optimize Aggregations

Use efficient aggregation techniques:

# Optimized aggregation query
GET /logs/_search
{
  "size": 0,
  "aggs": {
    "error_count": {
      "filter": {
        "term": {
          "level.keyword": "ERROR"
        }
      }
    },
    "errors_by_hour": {
      "date_histogram": {
        "field": "timestamp",
        "calendar_interval": "hour",
        "format": "yyyy-MM-dd HH:mm:ss"
      }
    },
    "top_errors": {
      "terms": {
        "field": "message.keyword",
        "size": 10
      }
    }
  }
}

3. Use Search After for Deep Pagination

Avoid using from/size for deep pagination:

# First query
GET /logs/_search
{
  "size": 1000,
  "sort": [
    {"timestamp": "desc"},
    {"_id": "desc"}
  ]
}


Subsequent queries using search_after


GET /logs/_search
{
  "size": 1000,
  "search_after": ["2024-01-01T12:00:00", "doc_id_123"],
  "sort": [
    {"timestamp": "desc"},
    {"_id": "desc"}
  ]
}

Index and Query Optimization

Optimize your indices and queries for better performance:

1. Use Index Aliases

Implement index aliases for better management:

# Create alias for current index
PUT /_aliases
{
  "actions": [
    {
      "add": {
        "index": "logs-2024-01",
        "alias": "logs-current"
      }
    }
  ]
}


Use alias in queries


GET /logs-current/_search
{
  "query": {
    "match_all": {}
  }
}

2. Implement Search Templates

Use search templates for complex, frequently-used queries:

# Create search template
POST _scripts/error-search
{
  "script": {
    "lang": "mustache",
    "source": {
      "query": {
        "bool": {
          "must": [
            {
              "match": {
                "message": "{{query_string}}"
              }
            }
          ],
          "filter": [
            {
              "range": {
                "timestamp": {
                  "gte": "{{start_date}}",
                  "lte": "{{end_date}}"
                }
              }
            }
          ]
        }
      }
    }
  }
}


Use search template


GET /logs/_search/template
{
  "id": "error-search",
  "params": {
    "query_string": "error",
    "start_date": "2024-01-01T00:00:00",
    "end_date": "2024-01-02T00:00:00"
  }
}

Cluster Configuration and Hardware Optimization

Proper cluster configuration and hardware selection are essential for optimal Elasticsearch performance. Understanding how to configure your cluster and choose appropriate hardware can significantly impact performance.

Node Configuration

Configure your nodes for optimal performance:

1. Memory Configuration

Optimize JVM heap settings:

# elasticsearch.yml configuration
cluster.name: my-cluster
node.name: node-1


Memory settings


bootstrap.memory_lock: true
indices.memory.index_buffer_size: 30%


JVM settings (in jvm.options)


-Xms4g
-Xmx4g
-XX:+UseG1GC
-XX:G1HeapRegionSize=32m
-XX:InitiatingHeapOccupancyPercent=75

2. Disk Configuration

Optimize disk settings for better I/O performance:

# Disk optimization settings
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch


Disable swapping


bootstrap.memory_lock: true


Optimize disk I/O


indices.fielddata.cache.size: 40%
indices.queries.cache.size: 10%
indices.requests.cache.size: 5%

3. Network Configuration

Configure network settings for optimal performance:

# Network settings
network.host: 0.0.0.0
http.port: 9200
transport.port: 9300


Discovery settings


cluster.initial_master_nodes: ["node-1", "node-2", "node-3"]
discovery.seed_hosts: ["node-1", "node-2", "node-3"]


Transport settings


transport.tcp.port: 9300
transport.tcp.compress: true

Hardware Recommendations

Choose appropriate hardware for your workload:

1. CPU Requirements

Select CPUs based on your workload:

  • Light workloads: 4-8 cores per node
  • Medium workloads: 8-16 cores per node
  • Heavy workloads: 16+ cores per node
  • Search-heavy workloads: Higher CPU frequency
  • Indexing-heavy workloads: More CPU cores

2. Memory Requirements

Configure memory appropriately:

  • JVM heap: 50% of available RAM, max 32GB
  • Off-heap memory: Available for Lucene segments
  • Operating system: At least 1GB for OS and other processes
  • File system cache: Remaining memory for file system cache

3. Storage Requirements

Choose appropriate storage solutions:

  • SSD storage: Recommended for all workloads
  • NVMe SSDs: Best performance for high-throughput workloads
  • RAID configuration: RAID 0 for performance, RAID 1 for reliability
  • Storage capacity: Plan for 3-5x data size for optimal performance

Monitoring and Performance Tuning

Continuous monitoring and performance tuning are essential for maintaining optimal Elasticsearch performance. Understanding how to monitor your cluster and make adjustments based on performance data is crucial.

Performance Monitoring

Monitor these key metrics to understand your cluster's performance:

1. Cluster Health Monitoring

Regularly check cluster health and status:

# Check cluster health
GET _cluster/health


Check node stats


GET _nodes/stats


Check index stats


GET _stats


Check cluster settings


GET _cluster/settings

2. Performance Metrics

Monitor specific performance metrics:

# Check indexing performance
GET _nodes/stats/indices/indexing


Check search performance


GET _nodes/stats/indices/search


Check JVM metrics


GET _nodes/stats/jvm


Check disk I/O


GET _nodes/stats/fs

Performance Tuning Strategies

Implement these tuning strategies based on your monitoring data:

1. Index Optimization

Optimize indices for better performance:

# Force merge to reduce segments
POST /logs/_forcemerge?max_num_segments=1


Refresh indices


POST /logs/_refresh


Clear cache if needed


POST /logs/_cache/clear


Optimize index settings


PUT /logs/_settings
{
  "index": {
    "refresh_interval": "30s",
    "number_of_replicas": 1,
    "max_result_window": 10000
  }
}

2. Query Optimization

Optimize queries based on performance data:

# Profile queries to understand performance
GET /logs/_search
{
  "profile": true,
  "query": {
    "match": {
      "message": "error"
    }
  }
}


Use explain to understand query execution


GET /logs/_explain/1
{
  "query": {
    "match": {
      "message": "error"
    }
  }
}

Integration with Logit.io

Logit.io provides managed Elasticsearch clusters that are optimized for performance and reliability. Using Logit.io's managed Elasticsearch service can significantly reduce the complexity of performance optimization while providing enterprise-grade performance.

Logit.io Elasticsearch Benefits

Logit.io's managed Elasticsearch service offers several advantages:

  • Pre-optimized configuration: Clusters are configured with best practices for performance
  • Automatic scaling: Infrastructure scales automatically with your data volume
  • Performance monitoring: Built-in monitoring and alerting for performance issues
  • Expert support: Access to Elasticsearch experts for optimization advice
  • Managed backups: Automatic backup and recovery capabilities
  • Security features: Built-in security and compliance features

Getting Started with Logit.io

To get started with Logit.io's optimized Elasticsearch service:

  1. Sign up for Logit.io: Visit dashboard.logit.io/sign-up
  2. Choose your plan: Select a plan that matches your data volume and performance requirements
  3. Configure your cluster: Set up your Elasticsearch cluster with optimized settings
  4. Migrate your data: Import your existing data or start fresh
  5. Monitor performance: Use Logit.io's monitoring tools to track performance

Common Performance Issues and Solutions

Understanding common performance issues and their solutions can help you quickly resolve problems and maintain optimal performance.

High CPU Usage

Common causes and solutions for high CPU usage:

  • Complex queries: Optimize query complexity and use filters
  • Insufficient indexing: Increase refresh interval and optimize bulk operations
  • Too many shards: Reduce the number of shards per index
  • Garbage collection: Optimize JVM settings and monitor GC

High Memory Usage

Solutions for memory-related performance issues:

  • Field data cache: Limit field data cache size and use doc values
  • Query cache: Optimize query cache settings
  • Request cache: Configure request cache appropriately
  • JVM heap: Optimize heap size and garbage collection

Slow Query Performance

Improve query performance with these techniques:

  • Use filters: Replace queries with filters where possible
  • Optimize aggregations: Use efficient aggregation techniques
  • Index optimization: Reduce the number of segments
  • Query optimization: Profile and optimize complex queries

Conclusion

Elasticsearch performance optimization is a continuous process that requires understanding of your specific use case, careful monitoring, and regular tuning. By implementing the techniques outlined in this guide, you can significantly improve your Elasticsearch cluster's performance and maintain responsive applications.

Remember that optimization is not a one-time task—it's an ongoing process that requires regular monitoring and adjustment as your data and usage patterns change. Start with the basics, monitor your performance metrics, and gradually implement more advanced optimization techniques as needed.

Whether you choose to manage your own Elasticsearch cluster or use a managed service like Logit.io, the key is to understand your performance requirements and implement the appropriate optimization strategies. The investment in proper optimization will pay dividends in improved performance, reduced costs, and better user experience.

To get started with Logit.io's optimized Elasticsearch service, sign up for a free trial and experience the benefits of a pre-optimized, managed Elasticsearch cluster.

Get the latest elastic Stack & logging resources when you subscribe

backBack to Blog