Elasticsearch:FAQ about Alibaba Cloud Elasticsearch clusters

Overview

• FAQ about the purchase, unsubscription, or release of clusters

  • When I purchase an Elasticsearch cluster, I performed an incorrect configuration. How do I modify the configuration after the cluster is created?

  • What are the mappings between versions on the Elasticsearch buy page and specific Elasticsearch versions?

  • When I purchase an Elasticsearch cluster, no VPCs are available. What do I do?

  • When I purchase an Elasticsearch cluster, no vSwitches are available after I select a VPC, and the error message "vSwitch: may not be empty" is reported. What do I do?

  • After I unsubscribe from or release an Elasticsearch cluster, I purchase another cluster. Does the endpoint of the new cluster remain the same as that of the original cluster?

  • How do I unsubscribe from or release an Elasticsearch cluster?

  • Can I purchase an Elasticsearch cluster that has only one node?

  • When I purchase an Elasticsearch cluster, resources of a specific category are sold out. What do I do?

  • Why do I need to upgrade the data nodes with the specifications of 1 vCPU and 2 GiB of memory in Elasticsearch clusters at the earliest opportunity?

  • Why is an Elasticsearch cluster in the Initializing state for a long period of time after it is purchased?

  • Do I need to purchase a Kibana node after I purchase an Elasticsearch cluster?

  • What do I do if I am unable to find the Elasticsearch cluster that I created?

  • In which scenarios do I need to purchase dedicated master nodes and client nodes for an Elasticsearch cluster?

  • What is the default username of the password that I specify when I purchase an Elasticsearch cluster?

• FAQ about features

  • Can I upgrade or downgrade the version of an Elasticsearch cluster?

  • Can I log on to an Elasticsearch cluster over SSH and modify the configuration of the cluster?

  • Is Logstash V6.7 compatible with Elasticsearch V6.3?

  • Can Elasticsearch be used as a data source of Quick BI?

  • Does Elasticsearch support scoring plug-ins?

  • Does Elasticsearch support LDAP?

  • Does Alibaba Cloud provide Elasticsearch SDK for Java?

  • How do I view the kernel version of an Elasticsearch cluster?

  • When am I allowed to forcefully restart an Elasticsearch cluster? What is the impact of a forced restart?

  • How do I check whether the vulnerability in Apache Log4j 2 is fixed for my Elasticsearch cluster?

  • How do I enable communication between Elasticsearch clusters that reside in different regions over an internal network?

  • How do I migrate data to an Alibaba Cloud Elasticsearch cluster?

  • Can I enable HTTPS for an Elasticsearch cluster that does not contain client nodes?

  • What is the maximum number of shards that can be allocated for indexes on a single data node in an Elasticsearch cluster?

  • How are indexes whose names start with .monitoring-es generated? What can I do with such indexes?

  • What encryption algorithm is used to encrypt disks for an Elasticsearch cluster?

  • Is port 9300 supported by Elasticsearch clusters?

• FAQ about data migration and synchronization

  • How do I synchronize data from ApsaraDB for MongoDB to Alibaba Cloud Elasticsearch?

• FAQ about cluster restart

  • How long is required to restart an Elasticsearch cluster or node?

  • Does the system restart an Elasticsearch cluster after I enable or disable the Public Network Access feature for the cluster?

  • Does the system restart an Elasticsearch cluster after I reset the password used to access the cluster?

  • Is the restart of an Elasticsearch cluster affected if the indexes in the cluster have no replica shards?

  • How do I restart a specific type of node, such as Kibana node, or a single node?

  • What do I do if the restart progress of an Elasticsearch cluster is stuck?

  • Can nodes in an Elasticsearch cluster be periodically restarted?

• FAQ about abnormal cluster loads or status

  • The CPU utilization and loads of some nodes in an Elasticsearch cluster are normal, whereas other nodes are in the idle state. What do I do?

  • What do I do if an Elasticsearch cluster is in a state indicated by the color yellow?

  • What do I do if an Elasticsearch cluster is in a state indicated by the color red due to heavy loads?

  • Monitoring data or an alert shows that the CPU utilization of my Elasticsearch cluster is excessively high. What do I do?

  • What do I do if the disk usage of my Elasticsearch cluster is excessively high?

  • Monitoring data or an alert shows that the memory usage of my Elasticsearch cluster is excessively high. What do I do?

  • What do I do if shards are not evenly distributed on nodes in an Elasticsearch cluster?

  • My Elasticsearch cluster is heavily loaded, and the cluster logs contain the following error message: java.lang.StackOverflowError for the entire cluster. What do I do?

  • How do I query the size of the JVM heap memory that is allocated to an Elasticsearch cluster?

• FAQ about data read or write

  • What do I do if no result is returned for a query in an Elasticsearch cluster or a long period of time is required before results can be returned?

  • What do I do if the following error message is reported when data is being written to my Elasticsearch cluster: Data too large... which is larger than the limit of?

  • Can I delete multiple indexes in an Elasticsearch cluster at a time?

  • When I create an index in my Elasticsearch cluster, the error message "index uuid conflicted" is reported, which indicates that the UUID of the index is conflicted, and data cannot be written to documents in the index. What do I do?

  • How do I change the value of the index.max_result_window parameter?

  • What do I do if the following error message is reported when I update the data for an index in my Elasticsearch cluster: Rejecting mapping update to [] as the final mapping would have more than 1 type?

  • How do I query all documents in an index?

  • How do I adjust the size of the document write queue for an Elasticsearch cluster?

  • How do I query or export data of a specific period of time?

  • Is the amount of data that can be written to an Elasticsearch cluster at a time by using a bulk write request limited?

  • What do I do if a difference exists between the time of obtained data and the actual time?

• FAQ about cluster configurations and configuration modifications

  • How do I plan resources, such as cluster specifications, the number of shards, and the size of each shard, before I use Elasticsearch?

  • How do I view the configuration of an Elasticsearch cluster?

  • Are services affected when I modify the configuration of an Elasticsearch cluster?

  • Does the system reallocate shards for nodes in an Elasticsearch cluster after the number of nodes in the cluster is changed?

  • Can I change the cloud disk type of an Elasticsearch cluster?

  • Can I convert other types of nodes in an Elasticsearch cluster to warm nodes?

  • Can I downgrade the configuration of an Elasticsearch cluster? If yes, how do I do?

  • How do I modify the configuration of an Elasticsearch cluster to ensure that services run as expected when a temporary business surge occurs?

  • When I upgrade the configuration of an Elasticsearch cluster, the "UpgradeVersionMustFromConsole" error message is reported. What do I do?

  • How long is required to upgrade the version of an Elasticsearch cluster?

  • Are services affected when I upgrade the version of an Elasticsearch cluster?

  • What do I do if an error is reported when I upgrade the configuration of an Elasticsearch cluster or when a configuration upgrade for an Elasticsearch cluster times out?

  • What do I do if I fail to update the configuration of my Elasticsearch cluster?

  • Can I change the JVM parameter settings of an Elasticsearch cluster?

  • Can I use the YML configuration file of an Elasticsearch cluster to configure the http.max_content_length and discovery.zen.ping_timeout parameters?

  • Can I switch the VPC of an Elasticsearch cluster?

  • Will the existing data in an Elasticsearch cluster be lost if I change the cloud disk type of the cluster?

  • When I upgrade the configuration of an Elasticsearch cluster, the system displays a prompt message indicating that the cluster is in an unhealthy state, but the cluster is in a state indicated by the color green. What do I do?

  • Can I upgrade the vCPU configurations of an Elasticsearch cluster without migrating data?

  • Why am I unable to downgrade the configuration of warm nodes in my Elasticsearch cluster?

  • When I remove data nodes from my Elasticsearch cluster, the following error message is reported: "This operation may cause a shard allocation error or insufficient storage, CPU, or memory resources." What do I do?

  • When I remove data nodes from my Elasticsearch cluster, the error message "The cluster is in an abnormal state or has ongoing tasks." is reported. What do I do?

  • When I remove data nodes from my Elasticsearch cluster, the error message "The number of nodes that you reserve must be more than two." is reported. What do I do?

  • When I remove data nodes from my Elasticsearch cluster, the error message "The operation is not supported." is reported. What do I do?

  • What do I do if data nodes fail to be removed or data fails to be migrated due to the auto_expand_replicas index setting?

  • How do I clear the cache for an Elasticsearch cluster?

  • How do I migrate nodes in an Elasticsearch cluster from one zone to another?

• FAQ about plug-ins, tokens, and synonyms

  • How do I update dictionaries when I use the IK analysis plug-in?

  • When I use the IK analysis plug-in, the "ik startOffset" error message is reported. What do I do?

  • The IK dictionary files on my on-premises machine are lost. Can I retrieve them on the cluster management page?

  • How do I apply updated IK dictionaries to existing data?

  • Is a threshold specified for full GC?

  • Can I remove plug-ins that are not used?

  • Are the dictionaries provided by the IK analysis plug-in of Alibaba Cloud Elasticsearch the same as the dictionaries provided by the IK analysis plug-in of open source Elasticsearch?

  • Can a custom plug-in access an external network, such as reading dictionary files on GitHub?

  • Does a custom plug-in support the rolling update method?

  • How do I configure the analysis-aliws plug-in? What is the format of the dictionary file for this plug-in?

  • What are the differences among Elasticsearch synonyms, IK tokens, and AliNLP tokens?

  • How do I install the analysis-ik plug-in?

  • Which built-in Chinese tokenizers are supported by Alibaba Cloud Elasticsearch?

  • If I use the rolling update method to update dictionaries that are dynamically loaded from OSS and the dictionaries stored in OSS are updated, will the dictionaries on all nodes in my Elasticsearch cluster be automatically updated?

  • Does the analysis-ik plug-in provided by Alibaba Cloud Elasticsearch support a remote dictionary?

  • How do I install the aliyun-knn plug-in for an Elasticsearch V7.10 cluster?

  • Are cluster services affected when an Elasticsearch cluster is restarted after a plug-in is installed for the cluster?

• FAQ about logs

  • Can I specify a retention period for the .security indexes of an Elasticsearch cluster?

  • How do I store the logs of an Elasticsearch cluster on my on-premises machine?

  • I am unable to view the search and update logs of an Elasticsearch cluster. What do I do?

  • How do I configure slow log collection for and view the slow logs of an Elasticsearch cluster?

  • How do I obtain the slow logs of an Elasticsearch cluster on a regular basis?

  • How do I query the clients that are used to access an Elasticsearch cluster?

• FAQ about data backup and restoration

  • Can I restore data from the snapshots of an Elasticsearch cluster to an Elasticsearch cluster of a different version?

  • When I back up data for an Elasticsearch cluster, the system displays a message indicating that the cluster is unhealthy. What do I do?

  • I enable the Auto Snapshot feature but do not specify shared OSS repositories for an Elasticsearch cluster. Are snapshots created?

  • When I restore data from snapshots, the destination Elasticsearch cluster displays a message indicating that shards are abnormal. After I run the POST /_cluster/reroute?retry_failed=true command to reroute the shards, the issue persists. What do I do?

  • Can I export data from an Elasticsearch cluster to my on-premises machine?

  • How do I restore data from snapshots of an Elasticsearch cluster to another Elasticsearch cluster?

  • What data backup features does Alibaba Cloud Elasticsearch provide?

• FAQ about cluster monitoring and alerting

  • How do I configure a DingTalk chatbot or WeCom chatbot to receive alert notifications from X-Pack Watcher?

  • What do I do if the system reports an alert indicating that memory cannot be allocated to the garbage collector?

  • What do the values of the ClusterStatus(value) metric mean?

  • How do I view the disk usage of each node in an Elasticsearch cluster?

  • The promotion failed error is reported when the CMS garbage collector performs GC. What do I do?

• FAQ about access to clusters

  • How do I use a client to access an Alibaba Cloud Elasticsearch cluster? What is the difference between access to an Alibaba Cloud Elasticsearch cluster and access to an open source Elasticsearch cluster?

  • Can I disable the basic authentication feature when I use a client to access an Elasticsearch cluster?

  • I purchased an ECS instance that resides in the same VPC as but a different zone from an Elasticsearch cluster. Can I use the ECS instance to access the Elasticsearch cluster over an internal network?

  • How do I configure a public or private IP address whitelist for an Elasticsearch cluster?

  • How do I access an Elasticsearch cluster over the Internet?

  • I fail to access an Elasticsearch cluster and the system reports the following error message: Failed to establish a new connection: [Errno 61] Connection refused. What do I do?

  • Is access to an Elasticsearch cluster affected if I reset the password of the elastic account for the cluster?

  • What do I do if I fail to use ElasticSearch Head 5.0.0 to access all versions of Alibaba Cloud Elasticsearch clusters?

When I purchase an Elasticsearch cluster, I performed an incorrect configuration. How do I modify the configuration after the cluster is created?

For the configuration items that are not provided in the preceding table, check whether you can modify the items on the configuration upgrade or downgrade page. For more information, see Upgrade the configuration of a cluster and Downgrade the configuration of a cluster.

What are the mappings between versions on the Elasticsearch buy page and specific Elasticsearch versions?

If you have a self-managed Elasticsearch cluster, we recommend that you select a version that is nearest to the version of the cluster when you purchase an Alibaba Cloud Elasticsearch cluster. For example, you can select a version whose minor version is nearest to that of your self-managed Elasticsearch cluster. If you do not have a self-managed Elasticsearch cluster, we recommend that you select the latest version.

When I purchase an Elasticsearch cluster, no VPCs are available. What do I do?

Check whether the RAM user that you use is granted the permissions to obtain the list of VPCs. For more information, see View the information about a RAM user. If the RAM user that you use is not granted the permissions, grant the permissions to the RAM user. For more information, see Create a custom policy.

When I purchase an Elasticsearch cluster, no vSwitches are available after I select a VPC, and the error message "vSwitch: may not be empty" is reported. What do I do?

The issue occurs because no vSwitches are available in the zone that you selected. To resolve this issue, go to the vSwitch page in the VPC console to check whether vSwitches are available in the selected zone. If no vSwitches are available in the selected zone, you must create a vSwitch. For more information, see Create a VPC with an IPv4 CIDR block.

After I unsubscribe from or release an Elasticsearch cluster, I purchase another cluster. Does the endpoint of the new cluster remain the same as that of the original cluster?

No, the endpoint of the new cluster is different from that of the original cluster. After you purchase the new cluster, we recommend that you modify the client code and unsubscribe from or release the original cluster to avoid service interruptions.

How do I unsubscribe from or release an Elasticsearch cluster?

• For information about how to release a pay-as-you-go cluster or an expired subscription cluster, see Release a cluster.

• To unsubscribe from an unexpired subscription cluster, perform the following operations:

Log on to the Alibaba Cloud Management Console. In the top navigation bar, choose Expenses > Orders. In the left-side navigation pane of the Expenses and Costs console, click Unsubscribe. On the Unsubscribe page, perform cluster unsubscription or order cancellation. For more information, see Methods for unsubscribing resources.

Can I purchase an Elasticsearch cluster that has only one node?

No, you cannot purchase an Elasticsearch cluster that has only one node. An Elasticsearch cluster must have a minimum of two data nodes. For more information, see Parameters on the buy page.

When I purchase an Elasticsearch cluster, resources of a specific category are sold out. What do I do?

If the resources that you want to purchase are still unavailable after you take all of the preceding measures, try again later. Resources are dynamic. If resources are insufficient, Alibaba Cloud replenishes the resources at the earliest opportunity.

Why do I need to upgrade the data nodes with the specifications of 1 vCPU and 2 GiB of memory in Elasticsearch clusters at the earliest opportunity?

Data nodes with the specifications of 1 vCPU and 2 GiB of memory may affect the performance of Elasticsearch clusters. Alibaba Cloud Elasticsearch no longer provides data nodes with such specifications since May 2021. Existing data nodes with such specifications can still be used. Data nodes with the specifications of 1 vCPU and 2 GiB of memory are suitable only for online learning and are not suitable for production environments. The service level agreement (SLA) does not apply to clusters that contain such data nodes. Therefore, we recommend that you upgrade your data nodes with the specifications of 1 vCPU and 2 GiB of memory at the earliest opportunity. For more information, see Upgrade the configuration of a cluster.

Why is an Elasticsearch cluster in the Initializing state for a long period of time after it is purchased?

A period of time is required before an Elasticsearch cluster can provide services after it is purchased. The period of time varies based on the specifications, data structure, and data volume of the cluster. In most cases, a few hours are required.

Do I need to purchase a Kibana node after I purchase an Elasticsearch cluster?

What do I do if I am unable to find the Elasticsearch cluster that I created?

Check whether the region that you selected in the top navigation bar of the Elasticsearch console is the region where your cluster resides. If the region that you selected is correct but you still cannot find your cluster, we recommend that you clear the browser cache or use an on-premises network.

In which scenarios do I need to purchase dedicated master nodes and client nodes for an Elasticsearch cluster?

Client nodes are used to forward all query and write requests received by an Elasticsearch cluster to data nodes and merge the query results of data nodes. If you want to use your Elasticsearch cluster in scenarios in which aggregate queries are required, we recommend that you purchase client nodes for the cluster. We recommend that you purchase client nodes and data nodes with the same specifications for your Elasticsearch cluster based on a ratio of 1:5. For example, if you purchase two client nodes for your Elasticsearch cluster, we recommend that you purchase 10 data nodes. A minimum of two client nodes must be purchased. For information about how to evaluate specifications and storage capacity for an Elasticsearch cluster, see Evaluate specifications and storage capacity.

What is the default username of the password that I specify when I purchase an Elasticsearch cluster?

The default username is elastic. You can also create a custom user. For more information, see Use the RBAC mechanism provided by Elasticsearch X-Pack to implement access control.

Can I upgrade or downgrade the version of an Elasticsearch cluster?

You can upgrade the versions of clusters only from V5.5 to V5.6, from V5.6 to V6.3, or from V6.3 to V6.7.

If you want to perform upgrades between other versions or perform version downgrades, purchase an Elasticsearch cluster of the desired version. Then, migrate data from the original cluster to the new cluster and unsubscribe from or release the original cluster.

• For information about how to upgrade the version of an Elasticsearch cluster, see Upgrade the version of a cluster.

• For information about how to create an Elasticsearch cluster, see Create an Alibaba Cloud Elasticsearch cluster.

• For information about how to migrate data between Elasticsearch clusters, see Data migration between Alibaba Cloud Elasticsearch clusters.

• For information about how to unsubscribe from an unexpired subscription Elasticsearch cluster, see Unsubscription and refund policies. For information about how to release a pay-as-you-go Elasticsearch cluster, see Release a cluster.

Can I log on to an Elasticsearch cluster over SSH and modify the configuration of the cluster?

No, for security purposes, you are not allowed to log on to your Elasticsearch cluster over SSH. If you want to modify the configuration of your cluster, use the cluster configuration feature of Elasticsearch. For more information, see Overview of cluster configuration.

Is Logstash V6.7 compatible with Elasticsearch V6.3?

Yes, Logstash V6.7 is compatible with Elasticsearch V6.3. For more information, see Compatibility matrixes.

Can Elasticsearch be used as a data source of Quick BI?

No, Elasticsearch cannot be used as a data source of Quick BI. You can use Kibana to analyze data and present analysis results.

Does Elasticsearch support scoring plug-ins?

Yes, Elasticsearch supports scoring plug-ins. When you create an index, Elasticsearch allows you to create a tokenizer. This way, when you search for data, Elasticsearch uses a scoring plug-in to sort search results by score. For more information, see Step 5: Search for data.

Does Elasticsearch support LDAP?

Yes, Elasticsearch supports Lightweight Directory Access Protocol (LDAP). If you want to use LDAP to authenticate the requests that are sent to your Elasticsearch cluster, you must deploy an on-premises Elasticsearch cluster of the same version and use this cluster to conduct an authentication test. If LDAP runs as expected, configure your cluster to support LDAP based on the configurations of the on-premises Elasticsearch cluster. For more information, see Use X-Pack to configure LDAP authentication.

Does Alibaba Cloud provide Elasticsearch SDK for Java?

Yes, Alibaba Cloud provides Elasticsearch SDK for Java. Different Elasticsearch versions use different SDKs. For more information, see Java API.

How do I view the kernel version of an Elasticsearch cluster?

When am I allowed to forcefully restart an Elasticsearch cluster? What is the impact of a forced restart?

If your Elasticsearch cluster is in an abnormal state (indicated by the color red or yellow) and you want to restart the cluster, you can forcefully restart the cluster. During the forced restart, your Elasticsearch service may be unstable, data may be lost, or data read and write operations may fail. Proceed with caution.

How do I check whether the vulnerability in Apache Log4j 2 is fixed for my Elasticsearch cluster?

The vulnerability is fixed after your Elasticsearch cluster is restarted. For more information, see [Vulnerability notice] RCE vulnerability in Apache Log4j 2.

Do I need to upgrade the version of my Elasticsearch cluster to fix the vulnerability in Apache Log4j 2?

No, you do not need to upgrade the version of your Elasticsearch cluster. You need to only follow the instructions provided in Procedure to fix the vulnerability.

How do I enable communication between Elasticsearch clusters that reside in different regions over an internal network?

How do I migrate data to an Alibaba Cloud Elasticsearch cluster?

You can migrate data to an Alibaba Cloud Elasticsearch cluster from another Alibaba Cloud Elasticsearch cluster, a self-managed Elasticsearch cluster, or a third-party Elasticsearch source. The data migration solution and tool vary based on the data migration scenario. For more information, see Select a data migration solution.

Can I enable HTTPS for an Elasticsearch cluster that does not contain client nodes?

Before you enable HTTPS for an Elasticsearch cluster of a version other than the following versions, you must make sure that the cluster contains client nodes.

• V7.16 and later

If an Elasticsearch cluster is of one of the preceding versions and contains client nodes, you can disable the client nodes for the cluster. If an Elasticsearch cluster is of a version other than the preceding versions and contains client nodes, you cannot release, unsubscribe from, or disable the client nodes for the cluster.

For security purposes, after you enable HTTPS for an Elasticsearch cluster, the system regularly maintains and updates the certificates on which the cluster depends. You cannot perform a rolling update for certificates installed on data nodes in Elasticsearch clusters of V7.10 or earlier. To reduce the impact of a node restart on online services during a certificate update, the system deploys the certificates on client nodes, which are used to forward requests. When you enable HTTPS for an Elasticsearch cluster that does not contain client nodes, the system displays a message to prompt you to purchase client nodes for the cluster. You must purchase client nodes for the cluster before you can enable HTTPS for the cluster. For more information, see Enable HTTPS.

What is the maximum number of shards that can be allocated for indexes on a single data node in an Elasticsearch cluster?

Alibaba Cloud Elasticsearch allows you to allocate a maximum of 1,000 shards for indexes on a single data node in Elasticsearch V7.X clusters. The number of shards that can be allocated for indexes on a single data node is not limited for Elasticsearch clusters of other versions. You must configure shards for indexes on a single data node based on the specifications of the Elasticsearch cluster. For more information, see Evaluate specifications and storage capacity and Size your shards.

PUT /_cluster/settings
{
   "transient": {
      "cluster": {
        "max_shards_per_node":10000
      }
   }
}

How are indexes whose names start with .monitoring-es generated? What can I do with such indexes?

By default, the X-Pack monitoring component collects monitoring data from an Elasticsearch cluster at intervals of 10 seconds and stores the data to the indexes whose names start with .monitoring- in the cluster. In Elasticsearch V6.X clusters, the .monitoring-es-6-* and .monitoring-kibana-6-* indexes are used to store monitoring data. These indexes are rolled over every day. The name of a .monitoring-es-6-* index ends with the date when the monitoring data is stored.

A .monitoring-es-6-* index stores information such as the cluster status, cluster statistics, node statistics, and index statistics. Such indexes consume a large amount of disk space. For more information, see Configure monitoring indexes.

What encryption algorithm is used to encrypt disks for an Elasticsearch cluster?

Alibaba Cloud Elasticsearch uses the industry-standard AES-256 encryption algorithm and Key Management Service (KMS) to encrypt disks for Elasticsearch clusters. For more information, see Overview of disk encryption.

Is port 9300 supported by Elasticsearch clusters?

How do I synchronize data from ApsaraDB for MongoDB to Alibaba Cloud Elasticsearch?

You can use Monstache to synchronize data from ApsaraDB for MongoDB to Alibaba Cloud Elasticsearch in real time. For more information, see Use Monstache to synchronize data from MongoDB to Alibaba Cloud Elasticsearch in real time.

How long is required to restart an Elasticsearch cluster or node?

When you restart an Elasticsearch cluster or node, the system displays the required time. The time is estimated based on the specifications, data structure, and data volume of the cluster or node. In most cases, a few hours are required to restart a cluster. For more information, see Restart a cluster or node.

Does the system restart an Elasticsearch cluster after I enable or disable the Public Network Access feature for the cluster?

No, the system does not restart an Elasticsearch cluster after you enable or disable the Public Network Access feature for the cluster. Only the status of the Public Network Access feature changes. This does not affect your cluster.

Does the system restart an Elasticsearch cluster after I reset the password used to access the cluster?

No, the system does not restart an Elasticsearch cluster after you reset the password used to access the cluster. After you reset the password for a cluster, the system only reloads the data of the cluster but does not restart the cluster. For more information, see Reset the access password for an Elasticsearch cluster.

Is the restart of an Elasticsearch cluster affected if the indexes in the cluster have no replica shards?

Yes, the restart of the cluster is affected if the indexes in an Elasticsearch cluster have no replica shards. Services may be interrupted during the restart of the cluster. In most cases, if the load of a cluster is not high and the indexes in the cluster have replica shards, the cluster can still provide services during a restart. However, access timeouts may occur during a restart in some cases. For example, if a number of nodes in the cluster are forced to restart at the same time, the cluster is heavily loaded and is not accessible, the indexes in the cluster do not have replica shards, or large amounts of data are written or queried during a restart or forced restart, access timeouts may occur. In these cases, we recommend that you design a retry mechanism on your client first and restart the cluster during off-peak hours.

How do I restart a specific type of node, such as Kibana node, or a single node?

• Restart a specific type of node

  On the Basic Information page of your Elasticsearch cluster, click Restart in the upper-right corner. In the Restart dialog box, select Node Role for Object and select the type of node that you want to restart in the Node field. For more information, see Restart a cluster or node.

• Restart a single node

  You can use one of the following methods to restart a single node:

  • On the Basic Information page of your Elasticsearch cluster, click Restart in the upper-right corner. In the Restart dialog box, select Node for Object and select the node that you want to restart in the Node field. For more information, see Restart a cluster or node.

  • In the Node Visualization section of the Basic Information page of your Elasticsearch cluster, move the pointer over the node that you want to restart. In the popover that appears, click Restart. For more information, see View the cluster status and node information.

What do I do if the restart progress of an Elasticsearch cluster is stuck?

Can nodes in an Elasticsearch cluster be periodically restarted?

No, the nodes in an Elasticsearch cluster cannot be periodically restarted. If you want to enable periodical restart for the nodes in your Elasticsearch cluster, you can call the RestartInstance API operation. If you call this API operation, you must also configure a scheduled task and node information.

The CPU utilization and loads of some nodes in an Elasticsearch cluster are normal, whereas other nodes are in the idle state. What do I do?

What do I do if an Elasticsearch cluster is in a state indicated by the color yellow?

• Cause

  If the number of replica shards that you specify for an index is greater than the number of nodes minus 1, the cluster enters a state indicated by the color yellow.

• Solutions

  Run the GET _cat/indices?v command to query the distribution of shards for indexes and identify the index that is in a state indicated by the color yellow. Then, change the number of replica shards for the index to 0. After the cluster recovers to a normal state, change the number of replica shards for the index from 0 to the original setting.

  Warning

  After the number of replica shards is changed to 0, if nodes stop providing services due to errors, data stored on the nodes may be lost. Proceed with caution when you change the number of replica shards. After the cluster recovers to a normal state, change the number of replica shards from 0 to the original setting at the earliest opportunity. The recovery of the cluster requires approximately 1 minute.

  PUT test/_settings
  {
    "index" : {
      "number_of_replicas":"0"
    }
  }                                

What do I do if an Elasticsearch cluster is in a state indicated by the color red due to heavy loads?

If an error occurs on the node on which primary shards are distributed, the cluster enters a state indicated by the color red. You can run the GET /_cat/indices?v command to query the distribution of shards for indexes and identify the index that is in a state indicated by the color red. Then, troubleshoot the issue based on the causes and solutions described in the following table.

Monitoring data or an alert shows that the CPU utilization of my Elasticsearch cluster is excessively high. What do I do?

What do I do if the disk usage of my Elasticsearch cluster is excessively high?

Monitoring data or an alert shows that the memory usage of my Elasticsearch cluster is excessively high. What do I do?

What do I do if shards are not evenly distributed on nodes in an Elasticsearch cluster?

My Elasticsearch cluster is heavily loaded, and the cluster logs contain the following error message: java.lang.StackOverflowError for the entire cluster. What do I do?

The error message indicates that a stack overflow error occurs because the amount of data written to the stack by using Lucene exceeds the upper limit. This issue is related to regular expression-based queries and fuzzy match. This issue is fixed in Elasticsearch V6.0 and later. We recommend that you upgrade the configuration of the cluster at the earliest opportunity or optimize the query statement that you use. For more information, see java.lang.StackOverflowError for the entire cluster.

How do I query the size of the JVM heap memory that is allocated to an Elasticsearch cluster?

Run the GET _nodes/stats/jvm?pretty command. By default, the Java Virtual Machine (JVM) heap memory of an Elasticsearch cluster is half of the memory of the cluster. You cannot change the size of the JVM heap memory of an Elasticsearch cluster.

How do I adjust the size of the document write queue for an Elasticsearch cluster?

How do I query or export data of a specific period of time?

You can use a range query of Elasticsearch to query the data of a specific period of time. For more information, see Range query.

If you want to export data of a specific period of time, you can use Logstash to filter data and obtain the data that you want to export. For more information, see Logstash configuration files.

Is the amount of data that can be written to an Elasticsearch cluster at a time by using a bulk write request limited?

Yes, the amount of data that can be written to an Elasticsearch cluster at a time by using a bulk write request is limited to 100 MB. If this limit is exceeded, you must adjust the amount of data that you write to the cluster at a time. The amount of data that is written to an Elasticsearch cluster at a time by using a bulk write request is calculated by using the following formula: Amount of data that is written to an Elasticsearch cluster at a time by using a bulk write request = Number of documents × Size of each document. You may not be able to precisely estimate the amount of data that is written at a time based only on the number of documents because the amount is also related to the size and complexity of each document. If each document stores a large amount of data, you can reduce the number of documents to write at a time. We recommend that you debug the amount of data to write at a time from 5 MB to 15 MB. By default, the amount of data that is written to an Elasticsearch cluster at a time by using a bulk write request cannot exceed 100 MB. For more information, see HTTP settings. For information about how to debug the amount of data, see Using and Sizing Bulk Requests in the documentation for open source Elasticsearch.

What do I do if a difference exists between the time of obtained data and the actual time?

What do I do if no result is returned for a query in an Elasticsearch cluster or a long period of time is required before results can be returned?

What do I do if the following error message is reported when data is being written to my Elasticsearch cluster: Data too large... which is larger than the limit of?

• Cause

  The write throughput of the cluster is excessively high and circuit breaking is triggered for the cluster due to insufficient resources of the cluster.

• Solution

  Important

  If the operations in the following solutions cannot be performed, you must stop all query and write operations and forcefully restart the cluster. After the cluster recovers to a normal state, use one of the following solutions to resolve the issue.

  1. Run the POST /Index name/_cache/clear?fielddata=true command to clear the cache for indexes. If the issue persists, go to the next step.

  2. Run the GET /_cat/indices?v command to check whether shards are not evenly distributed on nodes in the cluster. For more information, see What do I do if shards are not evenly distributed on nodes in an Elasticsearch cluster? If the issue persists, go to the next step.

  3. Reduce the concurrency for the write operations, delete invalid indexes to release resources, and reduce the use of the Kibana monitoring feature.

     To disable the Kibana monitoring feature, run the following command:

     PUT _cluster / settings {
     	"persistent": {
     		"xpack.monitoring.collection.enabled": false
     	}
     }

     If the issue persists, go to the next step.

  4. Upgrade the configuration of the cluster.

Can I delete multiple indexes in an Elasticsearch cluster at a time?

When I create an index in my Elasticsearch cluster, the error message "index uuid conflicted" is reported, which indicates that the UUID of the index is conflicted, and data cannot be written to documents in the index. What do I do?

This is a known issue. To troubleshoot the issue, upgrade the kernel version of the cluster to V1.5.0 or later. For more information, see Upgrade the version of a cluster.

How do I change the value of the index.max_result_window parameter?

The index.max_result_window parameter is provided by Elasticsearch for paged queries that are performed by using the from and size parameters and specifies the maximum number of documents that can be returned for a paged query. The default value of the index.max_result_window parameter is 10000. If the maximum number of queried documents exceeds this value, the following error message is reported: Result window is too large, from + size must be less than or equal to: [10000].

PUT /my_index/_settings  
{  
  "index": {  
    "max_result_window": 50000  
  }
}

What do I do if the following error message is reported when I update the data for an index in my Elasticsearch cluster: Rejecting mapping update to [] as the final mapping would have more than 1 type?

How do I query all documents in an index?

GET _search
{
   "query": {
   "match_all": {}
  }
}

You can also query all documents in an index on the Discover page of the Kibana console. Before you perform the query on the Discover page, you must create an index pattern. For information about how to use the Kibana console, see Kibana Guide.

How do I plan resources, such as cluster specifications, the number of shards, and the size of each shard, before I use Elasticsearch?

You can evaluate the total amount of the resources that you need to purchase based on your business requirements. For more information, see Evaluate specifications and storage capacity.

How do I view the configuration of an Elasticsearch cluster?

You can view the configuration of the Elasticsearch cluster on the Basic Information page of the cluster. For more information, see View the basic information of a cluster.

When you use Transport Client to access an Elasticsearch cluster, set the cluster.name parameter to the ID of your cluster. For more information, see Transport Client (5.x).

Are services affected when I modify the configuration of an Elasticsearch cluster?

The system restarts the cluster after you modify the configuration of the cluster. The system uses the rolling restart method to restart a cluster. Before the restart, make sure that the cluster is in the Active state (indicated by the color green), each index has at least one replica shard for each primary shard, and resource usage is not high. For example, the value of NodeCPUUtilization(%) is about 80%, that of NodeHeapMemoryUtilization is about 50%, and that of NodeLoad_1m is less than the number of vCPUs of the current node. If all the conditions are met, the cluster can still provide services during the restart. You can view the resource usage on the Cluster Monitoring page. However, we recommend that you modify the configuration of your cluster during off-peak hours.

Does the system reallocate shards for nodes in an Elasticsearch cluster after the number of nodes in the cluster is changed?

Yes, the system reallocates shards for nodes in an Elasticsearch cluster after the number of nodes in the cluster is changed. However, the system cannot ensure even shard allocation. Due to factors such as the index size, number of shards, and number of nodes, data may still be unevenly distributed among shards after the reallocation. For information about how to troubleshoot and resolve uneven shard allocation, see Unbalanced loads on a cluster.

Can I change the cloud disk type of an Elasticsearch cluster?

Yes, you can change the cloud disk type of an Elasticsearch cluster. The following types of cloud disks are supported: ultra disks, standard SSDs, and enhanced SSDs (ESSDs). These types of cloud disks are listed in ascending order of their storage performance.

Can I convert other types of nodes in an Elasticsearch cluster to warm nodes?

No, you cannot convert other types of nodes in an Elasticsearch cluster to warm nodes. The conversion can cause your cluster to be unstable. For more information, see "Hot-Warm" Architecture in Elasticsearch 5.x.

Can I downgrade the configuration of an Elasticsearch cluster? If yes, how do I do?

Yes, you can downgrade the configuration of an Elasticsearch cluster. For more information, see Scale in a cluster or Downgrade the configuration of a cluster.

How do I modify the configuration of an Elasticsearch cluster to ensure that services run as expected when a temporary business surge occurs?

When I upgrade the configuration of an Elasticsearch cluster, the "UpgradeVersionMustFromConsole" error message is reported. What do I do?

The error message is reported because the version change does not meet requirements. You can upgrade the versions of clusters only from V5.5.3 to V5.6.16, from V5.6.16 to V6.3.2, or from V6.3.2 to V6.7.0.

How long is required to upgrade the version of an Elasticsearch cluster?

The required time is determined by the data volume, data structure, and specifications of your cluster. The version upgrade requires about 1 hour.

Are services affected when I upgrade the version of an Elasticsearch cluster?

When you upgrade the version of an Elasticsearch cluster, you can still read data from or write data to the cluster but cannot make other changes. We recommend that you perform a version upgrade during off-peak hours. For more information about the precautions and procedure for a version upgrade, see Upgrade the version of a cluster.

What do I do if an error is reported when I upgrade the configuration of an Elasticsearch cluster or when a configuration upgrade for an Elasticsearch cluster times out?

In most cases, this issue occurs because the cluster is in an abnormal state. In this case, we recommend that you stop the query and write operations, and troubleshoot the issue by following the instructions described in What do I do if an Elasticsearch cluster is in a state indicated by the color red due to heavy loads? After the cluster recovers to a normal state, upgrade the configuration of the cluster again. You can also ignore the health status of the cluster and perform a forced update when you upgrade the configuration of the cluster. However, the forced update may affect the services provided by the cluster. Proceed with caution.

If this issue occurs due to other causes, resolve the issue based on the error message that is reported.

What do I do if I fail to update the configuration of my Elasticsearch cluster?

Can I use the YML configuration file of an Elasticsearch cluster to configure the http.max_content_length and discovery.zen.ping_timeout parameters?

Can I switch the VPC of an Elasticsearch cluster?

No, you cannot switch the VPC of an Elasticsearch cluster. You can purchase an Elasticsearch cluster in the desired VPC and migrate data from the original cluster to the new cluster. Then, cancel the subscription of or release the original cluster.

Will the existing data in an Elasticsearch cluster be lost if I change the cloud disk type of the cluster?

No, the existing data in an Elasticsearch cluster will not be lost if you change the cloud disk type of the cluster. However, new data that is continuously written to the cluster may be lost. We recommend that you change the cloud disk type during off-peak hours or after you stop the data write operations. For more information about how to change the cloud disk type of an Elasticsearch cluster, see Upgrade the configuration of a cluster.

When I upgrade the configuration of an Elasticsearch cluster, the system displays a prompt message indicating that the cluster is in an unhealthy state, but the cluster is in a state indicated by the color green. What do I do?

Some indexes in the cluster may be in the close state. You can run the POST /<index_name>/_open command to temporarily open the indexes. For more information, see Upgrade the configuration of a cluster.

Can I upgrade the vCPU configurations of an Elasticsearch cluster without migrating data?

No, you cannot upgrade the vCPU configurations of an Elasticsearch cluster without migrating data. If you upgrade or downgrade the vCPU configurations of an Elasticsearch cluster, the system performs a blue-green update for the cluster. After the blue-green update, the IP addresses of nodes in the cluster are changed, and data is migrated from the original nodes to the new nodes.

Why am I unable to downgrade the configuration of warm nodes in my Elasticsearch cluster?

Specific conditions must be met before you can downgrade the configuration of a cluster. For example, the selected vCPU and memory specifications must be greater than or equal to half of the current specifications and cannot be the following specifications: 1 vCPU and 2 GiB of memory, 2 vCPUs and 2 GiB of memory, 2 vCPUs and 4 GiB of memory, and 4 vCPUs and 4 GiB of memory. For more information, see Limits.

If your Elasticsearch cluster does not meet the conditions required for configuration downgrade, you can create another cluster that meets your business requirements, migrate data from the original cluster to the new cluster, and then cancel the subscription of or release the original cluster. For information about data migration, see Select a data migration solution.

When I remove data nodes from my Elasticsearch cluster, the following error message is reported: "This operation may cause a shard allocation error or insufficient storage, CPU, or memory resources." What do I do?

PUT _template/template_1
{
  "template": "*",
  "settings": {
    "number_of_replicas": 2
  }
}  

When I remove data nodes from my Elasticsearch cluster, the error message "The cluster is in an abnormal state or has ongoing tasks." is reported. What do I do?

Use the Cluster Diagnosis feature to diagnose the cluster and troubleshoot the issue based on the diagnostic results and suggestions. For more information, see Perform a diagnostic on an Elasticsearch cluster.

When I remove data nodes from my Elasticsearch cluster, the error message "The number of nodes that you reserve must be more than two." is reported. What do I do?

To ensure cluster reliability and stability, at least two data nodes must be reserved after data node removal. For a multi-zone cluster, the number of data nodes in each zone must be greater than or equal to two, and the numbers of remaining data nodes in all zones must be the same. If the requirements are not met, adjust the data nodes to remove, or upgrade the configuration of the cluster. For more information about how to upgrade the configuration of an Elasticsearch cluster, see Upgrade the configuration of a cluster.

When I remove data nodes from my Elasticsearch cluster, the error message "The operation is not supported." is reported. What do I do?

Run the GET _cluster/settings command to query the configurations of the cluster and check whether the cluster contains the configuration "cluster.routing.allocation.enable" : "none". This configuration does not allow data distribution. If the cluster contains the configuration, you can temporarily change the configuration to "cluster.routing.allocation.enable" : "all". If the configuration affects your other operations, you can change the configuration to the original setting after data node removal.

What do I do if data nodes fail to be removed or data fails to be migrated due to the auto_expand_replicas index setting?

• Cause

  You may use the access control feature provided by the X-Pack plug-in. In earlier Elasticsearch versions, this feature applies the "index.auto_expand_replicas" : "0-all" setting to .security indexes by default. This causes errors when you migrate data or remove data nodes.

• Solution

  1. Run the following command to query index settings:

     GET .security/_settings

     The following result is returned:

     {
       ".security-6" : {
         "settings" : {
           "index" : {
             "number_of_shards" : "1",
             "auto_expand_replicas" : "0-all",
             "provided_name" : ".security-6",
             "format" : "6",
             "creation_date" : "1555142250367",
             "priority" : "1000",
             "number_of_replicas" : "9",
             "uuid" : "9t2hotc7S5OpPuKEIJ****",
             "version" : {
               "created" : "6070099"
             }
           }
         }
       }
     }

  2. Use one of the following methods to modify the auto_expand_replicas index setting:

     • Method 1

       PUT .security/_settings
       {
         "index" : {
           "auto_expand_replicas" : "0-1"
         }
       }

     • Method 2

       PUT .security/_settings
       {
         "index" : {
           "auto_expand_replicas" : "false",
           "number_of_replicas" : "1"
         }
       }

       Important

       The number_of_replicas parameter specifies the number of replica shards for each primary shard in an index. You can configure this parameter based on your business requirements. Make sure that the value of this parameter is greater than or equal to 1 but no more than the number of available data nodes.

How do I clear the cache for an Elasticsearch cluster?

How do I migrate nodes in an Elasticsearch cluster from one zone to another?

Perform the steps described in Migrate nodes in a zone to migrate nodes from one zone to another.

Can I update only the disk configuration of an Elasticsearch cluster during a configuration upgrade of the cluster?

Can I change the JVM parameter settings of an Elasticsearch cluster?

Alibaba Cloud Elasticsearch clusters use the JVM parameter settings that are recommended by open source Elasticsearch. The settings cannot be changed. By default, the JVM heap memory of an Elasticsearch cluster is half of the memory of the cluster. A maximum of 32 GB of JVM heap memory can be allocated to an Elasticsearch cluster. For more information, see Heap size settings.

How do I update dictionaries when I use the IK analysis plug-in?

You can use the standard update or rolling update feature of the IK analysis plug-in to update dictionaries. For more information, see Use the analysis-ik plug-in.

When I use the IK analysis plug-in, the "ik startOffset" error message is reported. What do I do?

The error message is returned because of an Elasticsearch V6.7 bug. You must restart your cluster. For more information, see Restart a cluster or node.

The IK dictionary files on my on-premises machine are lost. Can I retrieve them on the cluster management page?

No, you cannot retrieve them on the cluster management page. You can only delete or update dictionary files on the cluster management page. We recommend that you download the official main and stopword dictionary files. Then, change the tokens in the files to those in your system dictionary file and upload the files to your cluster.

How do I apply updated IK dictionaries to existing data?

You must perform a reindex operation. If indexes are configured with IK tokens, the updated dictionaries apply only to new data in these indexes. If you want to apply the updated dictionaries to all the data in these indexes, you must perform a reindex operation. For more information, see Configure a remote reindex whitelist.

Is a threshold specified for full GC?

Full garbage collection (GC) is used to clean the entire heap memory. Whether full GC is correctly performed needs to be analyzed based on the service latency, heap memory size before full GC, and heap memory size after full GC. The CMS collector starts to collect garbage when the memory usage reaches 75%. This is because some space is reserved for burst traffic.

Can I remove built-in plug-ins that are not used?

You can remove only some plug-ins. On the Built-in Plug-ins tab of the Plug-ins page for your Elasticsearch cluster, you can view the plug-ins that can be removed. If Remove is displayed in the Actions column of a plug-in, the plug-in can be removed. For more information about how to remove a plug-in, see Install and remove a built-in plug-in.

Are the dictionaries provided by the IK analysis plug-in of Alibaba Cloud Elasticsearch the same as the dictionaries provided by the IK analysis plug-in of open source Elasticsearch?

Yes, the dictionaries provided by the IK analysis plug-in of Alibaba Cloud Elasticsearch are the same as the dictionaries provided by the IK analysis plug-in of open source Elasticsearch. For more information, see IK Analysis for Elasticsearch.

Can a custom plug-in access an external network, such as reading dictionary files on GitHub?

No, custom plug-ins cannot access external networks. If you want your Elasticsearch cluster to access external files, upload the files to Object Storage Service (OSS) and connect your Elasticsearch cluster to OSS.

Does a custom plug-in support the rolling update method?

No, custom plug-ins do not support the rolling update method. If you want a custom plug-in to support this method, configure the plug-in based on the rolling update method of the IK analysis plug-in. For more information, see IK Analysis for Elasticsearch.

How do I configure the analysis-aliws plug-in? What is the format of the dictionary file for this plug-in?

For more information about how to configure the plug-in, see Use the analysis-aliws plug-in.

What are the differences among Elasticsearch synonyms, IK tokens, and AliNLP tokens?

How do I install the analysis-ik plug-in?

analysis-ik is an IK analysis plug-in provided by Alibaba Cloud Elasticsearch. This plug-in is a built-in plug-in and cannot be removed. You can use the standard or rolling update method to update the built-in IK main dictionary and stopword list of the analysis-ik plug-in. Then, you can use the updated dictionary and stopword list when you configure mappings for an index. For more information about how to use the analysis-ik plug-in, see Use the analysis-ik plug-in.

Which built-in Chinese tokenizers are supported by Alibaba Cloud Elasticsearch?

Alibaba Cloud Elasticsearch supports the following built-in Chinese tokenizers: analysis-ik and analysis-aliws. You can use these plug-ins after you configure the related dictionaries.

If I use the rolling update method to update dictionaries that are dynamically loaded from OSS and the dictionaries stored in OSS are updated, will the dictionaries on all nodes in my Elasticsearch cluster be automatically updated?

No, the dictionaries on all nodes in your Elasticsearch cluster will not be automatically updated. Alibaba Cloud Elasticsearch does not support the automatic update of dictionaries on nodes in an Elasticsearch cluster after a rolling update of the dictionaries stored in OSS. After the dictionaries stored in OSS are changed, you must manually upload the dictionary file for the updated dictionary file to take effect. For indexes that are configured with IK tokens, synonyms, or AliNLP tokens, new dictionaries take effect only for data that is inserted after a standard or rolling update. If you also want the new dictionaries to take effect for existing data, you must reindex the existing data.

Does the analysis-ik plug-in provided by Alibaba Cloud Elasticsearch support a remote dictionary?

No, the analysis-ik plug-in provided by Alibaba Cloud Elasticsearch does not support a remote dictionary. The analysis-ik plug-in allows you to upload or update dictionaries. For more information about this plug-in, see Use the analysis-ik plug-in. The analysis-ik plug-in does not support a remote dictionary or configurations related to a remote dictionary. For example, the IKAnalyzer.cfg.xml file cannot contain configurations related to a remote dictionary.

How do I install the aliyun-knn plug-in for an Elasticsearch V7.10 cluster?

Are cluster services affected when an Elasticsearch cluster is restarted after a plug-in is installed for the cluster?

In most cases, if the load of a cluster is not high and the indexes in the cluster have replica shards, the cluster can still provide services during a restart. However, access timeouts may occur during a restart in the following cases: Some nodes in the cluster are forced to restart at the same time, the cluster is heavily loaded and is not accessible, the indexes in the cluster do not have replica shards, and large amounts of data are written or queried during a restart or forced restart. In these cases, we recommend that you design a retry mechanism on your client and restart the cluster during off-peak hours.

Can I specify a retention period for the .security indexes of an Elasticsearch cluster?

How do I store the logs of an Elasticsearch cluster on my on-premises machine?

You can call the ListSearchLog API operation to obtain the logs of your cluster. Then, store the obtained logs on your on-premises machine. For more information, see ListSearchLog.

I am unable to view the search and update logs of an Elasticsearch cluster. What do I do?

You can configure slow logs and reduce the timestamp precision of log entries. For more information, see References.

How do I configure slow log collection for and view the slow logs of an Elasticsearch cluster?

How do I obtain the slow logs of an Elasticsearch cluster on a regular basis?

You can call the ListSearchLog API operation to obtain the slow logs of your cluster on a regular basis. For more information, see ListSearchLog.

How do I query the clients that are used to access an Elasticsearch cluster?

For information about the limits and precautions for access logs and audit logs and how to enable audit log collection for an Elasticsearch cluster, see Query logs.

Can I restore data from the snapshots of an Elasticsearch cluster to an Elasticsearch cluster of a different version?

For automatic snapshots, you can restore data from the snapshots to the original cluster or use a shared OSS repository to restore data from the snapshots of an Elasticsearch cluster to other Elasticsearch clusters. For more information, see Create automatic snapshots and restore data from automatic snapshots and Configure a shared OSS repository.

For manual snapshots, you can directly restore data from the snapshots to other clusters. We recommend that you use a destination cluster whose version is the same as the version of the original cluster. If the versions are different, compatibility issues may occur. For more information, see Create manual snapshots and restore data from manual snapshots.

What do I do if a message indicating that the Elasticsearch cluster is unhealthy appears when I back up data for the cluster?

When an Elasticsearch cluster is unhealthy, snapshots for data backup cannot be created for the cluster. We recommend that you recover the cluster to a normal state indicated by the color green before data backup.

I enable the Auto Snapshot feature but do not specify shared OSS repositories for an Elasticsearch cluster. Are snapshots created?

Elasticsearch provides an OSS bucket for your cluster by default. You can log on to the Kibana console of your cluster and run the GET _snapshot/aliyun_auto_snapshot/_all command to obtain automatic snapshots. For more information about how to log on to the Kibana console, see Log on to the Kibana console.

When I restore data from snapshots, the destination Elasticsearch cluster displays a message indicating that shards are abnormal. After I run the POST /_cluster/reroute?retry_failed=true command to reroute the shards, the issue persists. What do I do?

The following figure shows the issue.

POST /_snapshot/aliyun_snapshot_from_instanceId/es-cn-instanceId_datetime/_restore
{
    "indices": "myIndex",
    "settings": {
    "max_restore_bytes_per_sec" : "150mb" 
    }
}

Can I export data from an Elasticsearch cluster to my on-premises machine?

Yes, you can export data from an Elasticsearch cluster to your on-premises machine. You can use the data backup feature provided by Elasticsearch to export data. For more information, see Data backup overview. You can create snapshots, store them in OSS, and then download objects from OSS. For more information, see Download objects.

How do I restore data from snapshots of an Elasticsearch cluster to another Elasticsearch cluster?

Use a shared OSS repository to restore the data. For information about the detailed operations, limits, and precautions, see Configure a shared OSS repository. If you want to migrate data between two Elasticsearch clusters that belong to the same Alibaba Cloud account but reside in different regions, you can run the commands that are used to create manual snapshots for index data and restore data from the snapshots. For information about available data migration solutions, see Select a data migration solution.

What data backup features does Alibaba Cloud Elasticsearch provide?

For information about the data backup features that are provided by Alibaba Cloud Elasticsearch and the use scenarios and limits of the features, see Data backup overview.

How do I configure a DingTalk chatbot or WeCom chatbot to receive alert notifications from X-Pack Watcher?

What do I do if the system reports an alert indicating that memory cannot be allocated to the garbage collector?

What do the values of the ClusterStatus(value) metric mean?

How do I view the disk usage of each node in an Elasticsearch cluster?

You can use one of the following methods to view the disk usage of each node in an Elasticsearch cluster: View the monitoring data of the Elasticsearch cluster on the Cluster Monitoring page of the Elasticsearch console, or view the monitoring log data that is generated after you configure monitoring indexes for the Elasticsearch cluster in the Kibana console of the cluster. For more information, see Metrics and exception handling suggestions and Configure monitoring indexes.

The promotion failed error is reported when the CMS garbage collector performs GC. What do I do?

This error is reported because the space in the old generation is insufficient and objects fail to be promoted to the old generation. You can resolve the issue based on the following instructions:

• Analysis of monitoring data and logs

  • View GC logs to obtain detailed GC information, check whether frequent CMS GC operations or full GC operations are performed, and check whether the promotion failure is caused by insufficient space in the old generation.

  • Log on to the Elasticsearch console and go to the Logs page of your Elasticsearch cluster. On the Logs page, search for logs that contain the promotion failed keyword. Then, analyze the logs to obtain the failure cause.

• Adjustment of the heap memory size and garbage collector configuration

  • If your Elasticsearch cluster is of V6.7.0 or later and the memory size of each data node in the cluster is greater than or equal to 32 GiB, we recommend that you use the G1 garbage collector instead to optimize GC performance.

  • Check whether you need to increase the memory size of data nodes based on your business requirements and cluster resource usage.

• Optimization suggestion

  If your cluster frequently encounters memory-related issues, you may need to evaluate the data volume of the cluster and check cluster loads and resource configurations. If necessary, contact Alibaba Cloud technical support for professional optimization guidance.

How do I use a client to access an Alibaba Cloud Elasticsearch cluster? What is the difference between access to an Alibaba Cloud Elasticsearch cluster and access to an open source Elasticsearch cluster?

You can access an Alibaba Cloud Elasticsearch cluster by using its internal or public endpoint. You can access an open source Elasticsearch cluster by using its address. For more information, see Use a client to access an Alibaba Cloud Elasticsearch cluster.

Can I disable the basic authentication feature when I use a client to access an Elasticsearch cluster?

No, you cannot disable the basic authentication feature. The basic authentication feature is a Kibana authentication mechanism provided by the built-in X-Pack plug-in of Elasticsearch. You cannot disable the feature.

I purchased an ECS instance that resides in the same VPC as but a different zone from an Elasticsearch cluster. Can I use the ECS instance to access the Elasticsearch cluster over an internal network?

Yes, you can use the ECS instance to access the Elasticsearch cluster over an internal network. You can use an ECS instance to access an Elasticsearch cluster over an internal network if they reside in the same VPC.

How do I configure a public or private IP address whitelist for an Elasticsearch cluster?

How do I access an Elasticsearch cluster over the Internet?

You can access an Elasticsearch cluster over the Internet by using its public endpoint. However, you must configure a public IP address whitelist before you access the cluster. For more information, see Configure a public or private IP address whitelist for an Elasticsearch cluster. When you access the cluster, you must configure parameters such as the domain name, username, and password. For more information, see Use a client to access an Alibaba Cloud Elasticsearch cluster.

I fail to access an Elasticsearch cluster and the system reports the following error message: Failed to establish a new connection: [Errno 61] Connection refused. What do I do?

Is access to an Elasticsearch cluster affected if I reset the password of the elastic account for the cluster?

What do I do if I fail to use ElasticSearch Head 5.0.0 to access all versions of Alibaba Cloud Elasticsearch clusters?