Search code examples
elasticsearchelasticsearch-6

Elasticsearch indice take more size on disk than they appear

I have several indices in elasticsearch, one of them has only around 100 documents in it, but it must be updated every other second.

Result of GET _cat/indices is as following:

green  open index1           8naYU5e-R-iHvfSKnrEiGw 1 0      2   9  25.5kb  25.5kb
yellow open index2           ZPQWzY7VRYGnBG0i6AL5ag 5 1   5658  89   1.2mb   1.2mb
yellow open index3           MTIDbt4uQbOv4K-0uuyOKA 5 1      0   0   1.1kb   1.1kb
yellow open index4           laF0UcIYTFKQQ6bB9dtQyw 5 1      0   0   1.1kb   1.1kb
yellow open index5           d5SYGXhYTPiVH_GKSA47lQ 5 1      0   0   1.1kb   1.1kb
yellow open index6           nIiNMwNWRZu-aISdLWa8ZA 5 1 110964  61  16.1mb  16.1mb
yellow open index7           g492XL4ZRKy4NOIBwF1yzA 5 1 111054 352  12.5mb  12.5mb
yellow open index8           C2g2RI_oQaOxUvpbzSnVIQ 5 1    123 400 484.8kb 484.8kb

As you can see, index7 has only 123 documents in it and it should not take more than 500kb on disk.

But result of du -sh ./* is like this:

128K    ./8naYU5e-R-iHvfSKnrEiGw
1.5G    ./C2g2RI_oQaOxUvpbzSnVIQ
172K    ./d5SYGXhYTPiVH_GKSA47lQ
1.1G    ./g492XL4ZRKy4NOIBwF1yzA
172K    ./laF0UcIYTFKQQ6bB9dtQyw
172K    ./MTIDbt4uQbOv4K-0uuyOKA
424M    ./nIiNMwNWRZu-aISdLWa8ZA
276M    ./ZPQWzY7VRYGnBG0i6AL5ag

It's taking more than 1GB on disk.

My question is why and how can I fix it?

I'm using elasticsearch 6.2.4 on Ubuntu 16.04

UPDATE

result of du -sh ./g492XL4ZRKy4NOIBwF1yzA/*

3.2M    ./indices/g492XL4ZRKy4NOIBwF1yzA/0/index
8.0K    ./indices/g492XL4ZRKy4NOIBwF1yzA/0/_state
241M    ./indices/g492XL4ZRKy4NOIBwF1yzA/0/translog
3.1M    ./indices/g492XL4ZRKy4NOIBwF1yzA/1/index
8.0K    ./indices/g492XL4ZRKy4NOIBwF1yzA/1/_state
238M    ./indices/g492XL4ZRKy4NOIBwF1yzA/1/translog
3.2M    ./indices/g492XL4ZRKy4NOIBwF1yzA/2/index
8.0K    ./indices/g492XL4ZRKy4NOIBwF1yzA/2/_state
241M    ./indices/g492XL4ZRKy4NOIBwF1yzA/2/translog
3.1M    ./indices/g492XL4ZRKy4NOIBwF1yzA/3/index
8.0K    ./indices/g492XL4ZRKy4NOIBwF1yzA/3/_state
241M    ./indices/g492XL4ZRKy4NOIBwF1yzA/3/translog
3.1M    ./indices/g492XL4ZRKy4NOIBwF1yzA/4/index
8.0K    ./indices/g492XL4ZRKy4NOIBwF1yzA/4/_state
241M    ./indices/g492XL4ZRKy4NOIBwF1yzA/4/translog
4.0K    ./indices/g492XL4ZRKy4NOIBwF1yzA/_state/state-4.st
Solution

  • The size you measured using du -h on the index folder doesn't only include the size taken by the documents stored in the index, but also contains the translog files, which by default can go up to 512mb.

    In your case, _cat/indices reveals that your index7 index is 12.5mb big and when running du -h on your index folder, you can see that each index sub-folder located within each shard folder is approximately 3.1mb, so about the same magnitude as reported by _cat/indices.