Skip to main content

OpenSearch

Plugin: go.d.plugin Module: elasticsearch

Overview

This collector monitors the performance and health of the Elasticsearch cluster.

It uses Cluster APIs to collect metrics.

Used endpoints:

EndpointDescriptionAPI
/Node info
/_nodes/statsNodes metricsNodes stats API
/_nodes/_local/statsLocal node metricsNodes stats API
/_cluster/healthCluster health statsCluster health API
/_cluster/statsCluster metricsCluster stats API

This collector is supported on all platforms.

This collector supports collecting metrics from multiple instances of this integration, including remote instances.

Default Behavior

Auto-Detection

By default, it detects instances running on localhost by attempting to connect to port 9200:

Limits

By default, this collector monitors only the node it is connected to. To monitor all cluster nodes, set the cluster_mode configuration option to yes.

Performance Impact

The default configuration for this integration is not expected to impose a significant performance impact on the system.

Metrics

Metrics grouped by scope.

The scope defines the instance that the metric belongs to. An instance is uniquely identified by a set of labels.

Per node

These metrics refer to the cluster node.

Labels:

LabelDescription
cluster_nameName of the cluster. Based on the Cluster name setting.
node_nameHuman-readable identifier for the node. Based on the Node name setting.
hostNetwork host for the node, based on the Network host setting.

Metrics:

MetricDimensionsUnit
elasticsearch.node_indices_indexingindexoperations/s
elasticsearch.node_indices_indexing_currentindexoperations
elasticsearch.node_indices_indexing_timeindexmilliseconds
elasticsearch.node_indices_searchqueries, fetchesoperations/s
elasticsearch.node_indices_search_currentqueries, fetchesoperations
elasticsearch.node_indices_search_timequeries, fetchesmilliseconds
elasticsearch.node_indices_refreshrefreshoperations/s
elasticsearch.node_indices_refresh_timerefreshmilliseconds
elasticsearch.node_indices_flushflushoperations/s
elasticsearch.node_indices_flush_timeflushmilliseconds
elasticsearch.node_indices_fielddata_memory_usageusedbytes
elasticsearch.node_indices_fielddata_evictionsevictionsoperations/s
elasticsearch.node_indices_segments_countsegmentssegments
elasticsearch.node_indices_segments_memory_usage_totalusedbytes
elasticsearch.node_indices_segments_memory_usageterms, stored_fields, term_vectors, norms, points, doc_values, index_writer, version_map, fixed_bit_setbytes
elasticsearch.node_indices_translog_operationstotal, uncommittedoperations
elasticsearch.node_indices_translog_sizetotal, uncommittedbytes
elasticsearch.node_file_descriptorsopenfd
elasticsearch.node_jvm_heapinusepercentage
elasticsearch.node_jvm_heap_bytescommitted, usedbytes
elasticsearch.node_jvm_buffer_pools_countdirect, mappedpools
elasticsearch.node_jvm_buffer_pool_direct_memorytotal, usedbytes
elasticsearch.node_jvm_buffer_pool_mapped_memorytotal, usedbytes
elasticsearch.node_jvm_gc_countyoung, oldgc/s
elasticsearch.node_jvm_gc_timeyoung, oldmilliseconds
elasticsearch.node_thread_pool_queuedgeneric, search, search_throttled, get, analyze, write, snapshot, warmer, refresh, listener, fetch_shard_started, fetch_shard_store, flush, force_merge, managementthreads
elasticsearch.node_thread_pool_rejectedgeneric, search, search_throttled, get, analyze, write, snapshot, warmer, refresh, listener, fetch_shard_started, fetch_shard_store, flush, force_merge, managementthreads
elasticsearch.node_cluster_communication_packetsreceived, sentpps
elasticsearch.node_cluster_communication_trafficreceived, sentbytes/s
elasticsearch.node_http_connectionsopenconnections
elasticsearch.node_breakers_tripsrequests, fielddata, in_flight_requests, model_inference, accounting, parenttrips/s

Per cluster

These metrics refer to the cluster.

Labels:

LabelDescription
cluster_nameName of the cluster. Based on the Cluster name setting.

Metrics:

MetricDimensionsUnit
elasticsearch.cluster_health_statusgreen, yellow, redstatus
elasticsearch.cluster_number_of_nodesnodes, data_nodesnodes
elasticsearch.cluster_shards_countactive_primary, active, relocating, initializing, unassigned, delayed_unaasignedshards
elasticsearch.cluster_pending_taskspendingtasks
elasticsearch.cluster_number_of_in_flight_fetchin_flight_fetchfetches
elasticsearch.cluster_indices_countindicesindices
elasticsearch.cluster_indices_shards_counttotal, primaries, replicationshards
elasticsearch.cluster_indices_docs_countdocsdocs
elasticsearch.cluster_indices_store_sizesizebytes
elasticsearch.cluster_indices_query_cachehit, missevents/s
elasticsearch.cluster_nodes_by_role_countcoordinating_only, data, data_cold, data_content, data_frozen, data_hot, data_warm, ingest, master, ml, remote_cluster_client, voting_onlynodes

Per index

These metrics refer to the index.

Labels:

LabelDescription
cluster_nameName of the cluster. Based on the Cluster name setting.
indexName of the index.

Metrics:

MetricDimensionsUnit
elasticsearch.node_index_healthgreen, yellow, redstatus
elasticsearch.node_index_shards_countshardsshards
elasticsearch.node_index_docs_countdocsdocs
elasticsearch.node_index_store_sizestore_sizebytes

Alerts

The following alerts are available:

Alert nameOn metricDescription
elasticsearch_node_indices_search_time_query elasticsearch.node_indices_search_timesearch performance is degraded, queries run slowly.
elasticsearch_node_indices_search_time_fetch elasticsearch.node_indices_search_timesearch performance is degraded, fetches run slowly.
elasticsearch_cluster_health_status_red elasticsearch.cluster_health_statuscluster health status is red.
elasticsearch_cluster_health_status_yellow elasticsearch.cluster_health_statuscluster health status is yellow.
elasticsearch_node_index_health_red elasticsearch.node_index_healthnode index $label:index health status is red.

Setup

Prerequisites

No action required.

Configuration

File

The configuration file name for this integration is go.d/elasticsearch.conf.

You can edit the configuration file using the edit-config script from the Netdata config directory.

cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config go.d/elasticsearch.conf

Options

The following options can be defined globally: update_every, autodetection_retry.

Config options
NameDescriptionDefaultRequired
update_everyData collection frequency.5no
autodetection_retryRecheck interval in seconds. Zero means no recheck will be scheduled.0no
urlServer URL.http://127.0.0.1:9200yes
cluster_modeControls whether to collect metrics for all nodes in the cluster or only for the local node.falseno
collect_node_statsControls whether to collect nodes metrics.trueno
collect_cluster_healthControls whether to collect cluster health metrics.trueno
collect_cluster_statsControls whether to collect cluster stats metrics.trueno
collect_indices_statsControls whether to collect indices metrics.falseno
timeoutHTTP request timeout.2no
usernameUsername for basic HTTP authentication.no
passwordPassword for basic HTTP authentication.no
proxy_urlProxy URL.no
proxy_usernameUsername for proxy basic HTTP authentication.no
proxy_passwordPassword for proxy basic HTTP authentication.no
methodHTTP request method.GETno
bodyHTTP request body.no
headersHTTP request headers.no
not_follow_redirectsRedirect handling policy. Controls whether the client follows redirects.nono
tls_skip_verifyServer certificate chain and hostname validation policy. Controls whether the client performs this check.nono
tls_caCertification authority that the client uses when verifying the server's certificates.no
tls_certClient TLS certificate.no
tls_keyClient TLS key.no

Examples

Basic single node mode

A basic example configuration.

jobs:
- name: local
url: http://127.0.0.1:9200

Cluster mode

Cluster mode example configuration.

Config
jobs:
- name: local
url: http://127.0.0.1:9200
cluster_mode: yes

HTTP authentication

Basic HTTP authentication.

Config
jobs:
- name: local
url: http://127.0.0.1:9200
username: username
password: password

HTTPS with self-signed certificate

Elasticsearch with enabled HTTPS and self-signed certificate.

Config
jobs:
- name: local
url: https://127.0.0.1:9200
tls_skip_verify: yes

Multi-instance

Note: When you define multiple jobs, their names must be unique.

Collecting metrics from local and remote instances.

Config
jobs:
- name: local
url: http://127.0.0.1:9200

- name: remote
url: http://192.0.2.1:9200

Troubleshooting

Debug Mode

Important: Debug mode is not supported for data collection jobs created via the UI using the Dyncfg feature.

To troubleshoot issues with the elasticsearch collector, run the go.d.plugin with the debug option enabled. The output should give you clues as to why the collector isn't working.

  • Navigate to the plugins.d directory, usually at /usr/libexec/netdata/plugins.d/. If that's not the case on your system, open netdata.conf and look for the plugins setting under [directories].

    cd /usr/libexec/netdata/plugins.d/
  • Switch to the netdata user.

    sudo -u netdata -s
  • Run the go.d.plugin to debug the collector:

    ./go.d.plugin -d -m elasticsearch

Getting Logs

If you're encountering problems with the elasticsearch collector, follow these steps to retrieve logs and identify potential issues:

  • Run the command specific to your system (systemd, non-systemd, or Docker container).
  • Examine the output for any warnings or error messages that might indicate issues. These messages should provide clues about the root cause of the problem.

System with systemd

Use the following command to view logs generated since the last Netdata service restart:

journalctl _SYSTEMD_INVOCATION_ID="$(systemctl show --value --property=InvocationID netdata)" --namespace=netdata --grep elasticsearch

System without systemd

Locate the collector log file, typically at /var/log/netdata/collector.log, and use grep to filter for collector's name:

grep elasticsearch /var/log/netdata/collector.log

Note: This method shows logs from all restarts. Focus on the latest entries for troubleshooting current issues.

Docker Container

If your Netdata runs in a Docker container named "netdata" (replace if different), use this command:

docker logs netdata 2>&1 | grep elasticsearch

Do you have any feedback for this page? If so, you can open a new issue on our netdata/learn repository.