Synchronize system clocks
Elasticsearch relies on the system clock of each node for many time-dependent operations. This includes:
- Timestamps recorded during ingest
- Searches that use
now(see date math) - Scheduled activities
- Security features such as API key and token expiry, JWT and SAML time validation, and TLS certificate validity
- Timestamped log messages
- Certain cache invalidation events
Keep the clocks on all nodes in the cluster synchronized with real time, and avoid discontinuities in these clocks in which the clock time jumps forwards or backwards by a large amount. Run a time synchronization service such as NTP or Chrony on every host.
A properly-configured time synchronization service typically keeps clocks synchronized to within at most a few milliseconds. A few seconds of clock skew between nodes can cause some confusing effects, but Elasticsearch otherwise operates normally under these conditions. A skew or discontinuity of over ten seconds can cause unexpected or inefficient behavior.
Elasticsearch does not rely on clock synchronization for any safety guarantees. For instance, if Elasticsearch acknowledges a write operation, then this operation is guaranteed to be durable regardless of any clock skew or discontinuity.
- Schedule trigger: How Watcher uses the system clock for schedules
- Kibana task management: Clock synchronization for Kibana scheduled tasks