Open File Descriptors
Open file descriptors on the node are approaching the process or system limit. Elasticsearch needs descriptors for open segments and connections; exhausting them can crash the node and risk data loss.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | High |
| Scope | Cluster |
| Domains | resource-utilization, stability |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| High open file descriptors threshold percent | Percentage | 80 |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
The maximum file descriptors count is set to 65536 and the open file descriptors count is 61200. The node process should be permitted up to 65,536 or more. In linux systems this can be done by editing /and so on/security/limits.conf and adding the line:
elasticsearch - nofile 65535.
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Increase max file descriptors
Condition: Always shown for this insight.
Set the open file descriptor limit for the Elasticsearch process user to 65,536 or later on the host OS. Use the action below to check max_file_descriptors on each node.
GET _nodes/stats/process?filter_path=**.max_file_descriptors&pretty
Requires the manage cluster privilege. Requires Elasticsearch 8.0.0 or later. This action is read-only.
Impact: File descriptors are required so that the cluster nodes can keep track of all the files it has open at any given time. Running out of file descriptors would result in the node process not being able to keep track of the files it has open or not being able to open new files when it needs to, and will most probably lead to data loss.