Determining the optimum size of a field data cache

It is important to keep an eye on the cache used by the Elasticsearch application. When a cache becomes full, the least recently used data is evicted to make way for new data. 

You can use the following metric to check if there are evictions from a field data cache.

Field data cache evictions

Field data cache evictions is important for search performance if aggregation queries are used. Field data is also also used for sorting and for scripted fields. If there are a high amount of evictions, you cannot increase the memory at that point of time. For more information about this attribute, see Field data cache evictions attribute page.

Set threshold on this attribute to get notified about the number of field data cache evictions. Consider setting up an alert to trigger if the number of field data cache evictions is high. The KM generates an alarm and triggers an event when the threshold values are met. 

Suggested action

The KM event indicates that you might want to identify nodes that need correction in query cache size. If cache size is more, the node can accommodate more results, thus reducing evictions. 

Where to go from here

Using the TrueSight console, you can adjust the thresholds ranges for these monitoring attributes with the Agent Threshold tab in the Infrastructure Policies page. For more information see, Defining a monitoring policy.