Frozen cache unhealthy
Frozen tier node has sustained poor shared cache health for minutes. Searches against searchable snapshot data on this node might be slower, and the snapshot repository might see extra load.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Node |
| Domains | domain:node-lifecycle, domain:resource-utilization |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| Cache hit efficiency threshold percent | Percentage | 80 |
| Repository fetch throughput threshold (MB/s) | Integer | 5 |
| Cache eviction rate threshold (per minute) | Integer | 30 |
| Cache time-to-fill threshold (seconds) | Integer | 3600 |
| Minimum sustained duration (minutes) | Integer | 30 |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
Shared cache health on frozen node es-data-01 failed at least two checks for 48 minutes. Cache hit efficiency 85% is below the threshold 85%. Repository fetch throughput 85 MB/s is above the threshold 12 MB/s. Cache eviction rate 42 /min is above the threshold 12 /min. Estimated cache time-to-fill 180s is below the threshold 48s.
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Increase frozen tier cache capacity
Condition: Shown when evictions are high and cache time-to-fill is short, indicating the working set exceeds shared cache size.
Increase frozen tier cache capacity because the shared cache is filling faster than it can be replenished. On self-managed deployments, add disk to the frozen tier or adjust xpack.searchable.snapshot.shared_cache.size in elasticsearch.yml. On Elastic Cloud Hosted, increase frozen tier storage in the deployment configuration.
Add frozen data node
Condition: Shown when cache pressure is broad across multiple frozen nodes.
Add a frozen-tier data node to host searchable snapshot indices and scale frozen storage separately.
Searchable snapshots on the frozen tier use a shared cache so nodes can serve searches without repeatedly fetching data from the snapshot repository. When cache hit efficiency stays low, repository fetch throughput stays high, or evictions are frequent, searches against frozen data can slow down and repository load can rise. Brief cache warming after a mount or a one-off historical query is expected. Sustained poor cache health typically means the working set exceeds shared cache capacity, traffic is concentrated on a few frozen nodes, or both.