Determining the optimum size of a node query cache

It is important to monitor the cache used by the Elasticsearch application. When a cache becomes full, the least recently used data is evicted to make way for new data. 

You can use the following metrics to check if there are evictions from a node query cache.

Query cache evictions

The query cache is responsible for caching the results of queries. When the cache is full, the least recently used data is evicted to make way for new data. A high number of evictions indicates that the query cache is full or the cache size is insufficient for the specific node. For more information about this attribute, see Query cache evictions attribute page.

Set threshold on this attribute to get notified about number of query cache evictions. Consider setting up an alert to trigger if the number of query cache evictions is high. The KM generates an alarm and triggers an event when the threshold values are met. 

Suggested action

The KM event indicates that you might want to identify nodes that need correction in query cache size. If cache size is more, the node can accommodate more results, thus reducing evictions. 

Query cache evictions ratio

This query cache evictions ratio displays the ratio of query cache evictions and total number of items in node’s query cache. Evictions ratio shows ratio of eviction count to total items in cache. 

 A high number of query cache evictions ratio indicates that cache size is insufficient on multiple nodes on the cluster. For more information about this attribute, see Query cache evictions ratio attribute page.

Set threshold on this attribute to get notified about number of query cache evictions ration. Consider setting up an alert to trigger if the ration of query cache evictions is more than 70 percent. The KM generates an alarm and triggers an event when the threshold values are met. 

Suggested action

The KM event indicates that you might want to identify nodes that need correction in query cache size. If cache size is more across multiple nodes, it can accommodate more results, thus reducing evictions. The KM generates an alarm and triggers an event when the threshold values are met.

Where to go from here

Using the TrueSight console, you can adjust the thresholds ranges for these monitoring attributes with the Agent Threshold tab in the Infrastructure Policies page. For more information see, Defining a monitoring policy.