ELK stack performance tuning

Question

I am new to ELK stack, i just installed it to give it a test drive for our production systems logs management and started pushing logs(IIS & Event) from 10 Windows VMs using nxlog.

After the installation, I am receiving around 25K hits/15 minutes as per my Kibana dashboard. The size of /var/lib/elasticsearch/ has been increased to around 15GBs in just 4 days.

I am facing serious performance issues, Elasticsearch process is eating up all my CPU and around 90% of memory.

Elasticsearch service was stuck previously and /etc/init.d/elasticsearch stop/start/restart wasn't even working. The process was running even after trying to kill it with kill command. A system reboot also took the machine to same condition. I just deleted all the indices with curl command and now i am able to restart Elasticsearch.

I am using a standard A3 Azure instance(7GB RAM 4 cores) for this ELK setup.

Please guide me to tune my ELK stack to achieve good performance. Thanks.

Answer 1

your are using 7GB RAM your jvm heap size for elasticsearch should be less than 3.5GB

for more information you can read elasticsearch heap sizing