Elasticsearch Exchange meeting harvest

After lunch on December 25, 2018, the three of our team went to China Mobile South Base to participate in an Elastic Technical Exchange Conference. Here, we had to complain about the strict security check in of the South Base.

Experience of three meetings

Experiences are:

The key points of the first session of Elastic Stack Technical Explanation and Demonstration and Introduction to New Features of Version 6.5 are as follows:

1. The relationship between logstash and beans is that between the server and the client. Logstash takes up a lot of resources, while beans are lightweight; The official advice is that logstash should be deployed independently rather than mixed with business applications;
2. The 6.5 version of Elastic search improves memory utilization and recycling even more, and supports java 11; The official said that after their users upgraded the version, the resources occupied by various parameters were much less.

The key points of the second "Elastic Stack User Case of China Mobile Internet Corporation" are:

1. China Mobile's ELK scale, business status, and methods to improve the utilization of machines, such as: deploying multiple nodes and multiple storage disks on a machine can improve the IO capability;
2. The scenario is to collect logs to the ELK stack and connect 14 business lines. The log standard is their busy point at this stage, and standardization is important for any company;
3. It also briefly talked about the use scenario of the K8S, encapsulating the configuration of logstash and business logs to the docker, and running on the K8S;
4. Some simple optimization methods, briefly talking about the tool chain in the community;
5. The different roles of the cluster are split. What's more amazing is that their client nodes are configured with 128G of memory.

Session 3 Introduction and Demonstration of ECE Automatic Operation and Maintenance Management Platform

1. Didn't listen. I went out to talk about technical details with the official staff;
2. After a brief look at ECE, this sharing should be an official one-stop solution for operation and maintenance to promote enterprises.

Communicate with the official architect

We mainly talked about the current situation of our cluster, and then gave him some monitoring information to ask our existing questions. Here are some records:

• At present, some indicators of our cluster are normal. For example, 22 nodes, 4257 partitions, 12.6BIL documents, 17.58T storage usage;
• The importance of timing and the constraints of search scope are also important;
• The maximum warm data processing capacity of a node is 1T data;

• Aggregation is a heavy operation. It will take out the index files recorded in all segments within the search range, read them from the storage disk to the memory, and then calculate;

  • As for the cluster role, the master has very low requirements for resources, and some users will also put the master node on the K8S to play the advantages of hybrid cloud;
• The division of focal group roles will improve the performance. He said that it may be 10%~20%, and some special business scenarios will even double the performance;
• In terms of fielddata, he said that generally only text search is used when keywords are highlighted, that is, we can reduce the proportion of fielddata, or even turn it off;
• I don't think he is very clear about the problem of _id. He gave a statement that it may be a problem of mapping, but _id is keyword by default, and there is no mapping;
• The real-time processing capacity is linear with the number of machines.

The architect's WeChat has been added, and communication can continue in the future.

Improvement points of cluster

After listening to this meeting, we can make improvements as follows:

1. Cluster roles need to be split, and master nodes have low requirements for configuration;
2. One machine can deploy multiple nodes, which can fully improve the utilization of the machine;
3. The fielddata configuration can be minimized or even disabled;
4. It is better for a machine with multiple disk slots. It would rather have less capacity of each disk than more disks. Usually, the business bottleneck is mainly on IO. Multiple disks can share the pressure of reading and writing files to IO.

This article is written by Chakhsu Lau Creation, adoption Knowledge Sharing Attribution 4.0 International License Agreement.
All articles on this website are original or translated by this website, except for the reprint/source. Please sign your name before reprinting.