Frozen cache unhealthy
Elastic Cloud Hosted lets you manage and configure one or more deployments of the versioned Elastic Stack, hosted on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Elastic Cloud on Kubernetes extends Kubernetes orchestration capabilities to allow you to deploy and manage components of the Elastic Stack. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Enterprise is a self-managed orchestration platform for deploying and managing the Elastic Stack at scale. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Self-managed deployments are Elastic Stack deployments managed without the assistance of an orchestrator. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
ECH
Generally available
ECK
Generally available
ECE
Generally available
Self-managed
Generally available
Frozen tier node has sustained poor shared cache health for minutes. Searches against searchable snapshot data on this node might be slower, and the snapshot repository might see extra load.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Node |
| Domains | domain:node-lifecycle, domain:resource-utilization |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| Cache hit efficiency threshold percent | Percentage | 80 |
| Repository fetch throughput threshold (MB/s) | Integer | 5 |
| Cache eviction rate threshold (per minute) | Integer | 30 |
| Cache time-to-fill threshold (seconds) | Integer | 3600 |
| Minimum sustained duration (minutes) | Integer | 30 |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
Shared cache health on frozen node es-data-01 failed at least two checks for 30 minutes.
Cache hit efficiency 85% is below the threshold 80%.
Repository fetch throughput 85 MB/s is above the threshold 5 MB/s.
Cache eviction rate 42 /min is above the threshold 30 /min.
Estimated cache time-to-fill 180s is below the threshold 3600s.
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Increase frozen tier cache capacity
Condition: Shown when evictions are high and cache time-to-fill is short, indicating the working set exceeds shared cache size.
Increase frozen tier cache capacity because the shared cache is filling faster than it can be replenished. On self-managed deployments, add disk to the frozen tier or adjust xpack.searchable.snapshot.shared_cache.size in elasticsearch.yml. On Elastic Cloud Hosted, increase frozen tier storage in the deployment configuration.
Add frozen data node
Condition: Shown when cache pressure is broad across multiple frozen nodes.
Add a frozen-tier data node to host searchable snapshot indices and scale frozen storage separately.
Searchable snapshots on the frozen tier use a shared cache so nodes can serve searches without repeatedly fetching data from the snapshot repository. When cache hit efficiency stays low, repository fetch throughput stays high, or evictions are frequent, searches against frozen data can slow down and repository load can rise.
Brief cache warming after a mount or a one-off historical query is expected. Sustained poor cache health typically means the working set exceeds shared cache capacity, traffic is concentrated on a few frozen nodes, or both.