ElastAlert no hits - elasticsearch

The following are my config.yaml and frequency.yaml
config.yaml
rules_folder: rules_folder
run_every:
seconds: 15
buffer_time:
minutes: 1
es_host: localhost
es_port: 9200
writeback_index: elastalert_status
alert_time_limit:
days: 2
frequency.yaml
es_host: localhost
es_port: 9200
name: Error rule
type: any
index: logstash-*
num_events: 5
timeframe:
hours: 4
timestamp_field: "#timestamp"
filter:
term:
log: "ERROR"
alert:
"email"
email:
- "my#email.com"
I am getting no hits
INFO:elastalert:Queried rule Error rule from 2016-09-02 09:33 MDT to 2016-09-02 09:34 MDT: 0 / 0 hits
INFO:elastalert:Ran Error rule from 2016-09-02 09:33 MDT to 2016-09-02 09:34 MDT: 0 query hits, 0 matches, 0 alerts sent
Output of elastalert-test-rule rules_folder/frequency.yaml
INFO:elastalert:Queried rule Error rule from 2016-09-02 09:47 MDT to 2016-09-02 10:32 MDT: 0 / 0 hits
Would have written the following documents to elastalert_status:
elastalert_status - {'hits': 0, 'matches': 0, '#timestamp':
datetime.datetime(2016, 9, 2, 16, 32, 32, 200330, tzinfo=tzutc()), 'rule_name':
'Error rule', 'starttime': datetime.datetime(2016, 9, 1, 16, 32, 32, 123856,
tzinfo=tzutc()), 'endtime': datetime.datetime(2016, 9, 2, 16, 32, 32, 123856,
tzinfo=tzutc()), 'time_taken': 0.07315492630004883}

Ok, I was able to resolve the issue by changing the index from index: logstash-* to index: filebeat-* since I was using it to index. Hope this helps someone.

In output log, you can find that 2016-09-02 09:33 MDT to 2016-09-02 09:34 MDT: 0 / 0 hits, only 1 minutes in query.
Try to setting your buffer_time more than 4 hours (buffer_time > timeframe)
your can reference https://github.com/Yelp/elastalert/issues/668, by Qmando reply

Related

How to get sum of field1 for unique values of field2 in Kibana

I have index pattern in kibana. I want to get SUM of one field based on UNIQUE values of second field. How can I get this in kibana visualization.
As example :
{ server: 1, size: 813, #timestamp: "2018-12-28 09:00"}
{ server: 2, size: 654, #timestamp: "2018-12-28 09:00"}
{ server: 3, size: 752, #timestamp: "2018-12-28 09:00"}
{ server: 1, size: 915, #timestamp: "2018-12-28 10:00"}
{ server: 2, size: 823, #timestamp: "2018-12-28 10:00"}
{ server: 3, size: 783, #timestamp: "2018-12-28 10:00"}
I want solution like below :
(915 + 823 + 783 = 2521)
Any Solution ??

connectTimeout in okhttp3 slows down responnse time

Ho All,
I have a odd issue with okhttp version 4.9.0. It seems to increase the response time ( client.newCall(request).execute() ). If I increase the connectTimeout to 5 seconds the response time increases to 6 if I increase it to 15 seconds the response time increases to 16 seconds. Below is how I am using the builder.
client = new OkHttpClient.Builder()
.connectionPool(new ConnectionPool(2, 2, TimeUnit.SECONDS))
.cache(null)
.connectTimeout(2, TimeUnit.SECONDS)
.readTimeout(25, TimeUnit.SECONDS).build();
Thanks for any hints!
It is likely getting two or more routes and failing to connect to the first before the second one works. Most likely you have anetwork problem or similar and should fix that.
To confirm add a debugging EventListener
https://square.github.io/okhttp/events/
Since you haven't provided a useful reproduction, we can simulate using an additional route to test against.
val client = OkHttpClient.Builder()
.dns(object: Dns {
override fun lookup(hostname: String): List<InetAddress> {
return listOf<InetAddress>(InetAddress.getByName("198.51.100.0")) + Dns.SYSTEM.lookup("httpbin.org")
}
})
.eventListenerFactory(LoggingEventListener.Factory())
.build()
val response = client.newCall(Request.Builder().url("https://httpbin.org/get").build()).execute()
println(response.body!!.string())
Output will be like the following, not that the first connect takes 10 seconds (the connect timeouts) as it's hitting a dummy IP and then subsequent connections will try the second of the total 5 available IP addresses successfully and the request will continue.
Nov 23, 2020 7:44:01 AM okhttp3.internal.platform.Platform log
INFO: [0 ms] callStart: Request{method=GET, url=https://httpbin.org/get}
Nov 23, 2020 7:44:01 AM okhttp3.internal.platform.Platform log
INFO: [34 ms] proxySelectStart: https://httpbin.org/
Nov 23, 2020 7:44:01 AM okhttp3.internal.platform.Platform log
INFO: [35 ms] proxySelectEnd: [DIRECT]
Nov 23, 2020 7:44:01 AM okhttp3.internal.platform.Platform log
INFO: [36 ms] dnsStart: httpbin.org
Nov 23, 2020 7:44:01 AM okhttp3.internal.platform.Platform log
INFO: [150 ms] dnsEnd: [/198.51.100.0, httpbin.org/3.211.1.78, httpbin.org/35.170.225.136, httpbin.org/34.198.212.59, httpbin.org/52.6.34.179]
Nov 23, 2020 7:44:01 AM okhttp3.internal.platform.Platform log
INFO: [153 ms] connectStart: /198.51.100.0:443 DIRECT
Nov 23, 2020 7:44:11 AM okhttp3.internal.platform.Platform log
INFO: [10164 ms] connectFailed: null java.net.SocketTimeoutException: Connect timed out
Nov 23, 2020 7:44:11 AM okhttp3.internal.platform.Platform log
INFO: [10165 ms] connectStart: httpbin.org/3.211.1.78:443 DIRECT
Nov 23, 2020 7:44:11 AM okhttp3.internal.platform.Platform log
INFO: [10263 ms] secureConnectStart
Nov 23, 2020 7:44:12 AM okhttp3.internal.platform.Platform log
INFO: [10663 ms] secureConnectEnd: Handshake{tlsVersion=TLS_1_2 cipherSuite=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 peerCertificates=[CN=httpbin.org, CN=Amazon, OU=Server CA 1B, O=Amazon, C=US, CN=Amazon Root CA 1, O=Amazon, C=US] localCertificates=[]}
Nov 23, 2020 7:44:12 AM okhttp3.internal.platform.Platform log
INFO: [10676 ms] connectEnd: h2
Nov 23, 2020 7:44:12 AM okhttp3.internal.platform.Platform log
INFO: [10678 ms] connectionAcquired: Connection{httpbin.org:443, proxy=DIRECT hostAddress=httpbin.org/3.211.1.78:443 cipherSuite=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 protocol=h2}
Nov 23, 2020 7:44:12 AM okhttp3.internal.platform.Platform log
INFO: [10679 ms] requestHeadersStart
Nov 23, 2020 7:44:12 AM okhttp3.internal.platform.Platform log
INFO: [10683 ms] requestHeadersEnd
Nov 23, 2020 7:44:12 AM okhttp3.internal.platform.Platform log
INFO: [10903 ms] responseHeadersStart
Nov 23, 2020 7:44:12 AM okhttp3.internal.platform.Platform log
INFO: [10904 ms] responseHeadersEnd: Response{protocol=h2, code=200, message=, url=https://httpbin.org/get}
Nov 23, 2020 7:44:12 AM okhttp3.internal.platform.Platform log
INFO: [10907 ms] responseBodyStart
Nov 23, 2020 7:44:12 AM okhttp3.internal.platform.Platform log
INFO: [10908 ms] responseBodyEnd: byteCount=272
Nov 23, 2020 7:44:12 AM okhttp3.internal.platform.Platform log
INFO: [10908 ms] connectionReleased
Nov 23, 2020 7:44:12 AM okhttp3.internal.platform.Platform log
INFO: [10908 ms] callEnd
{
"args": {},
"headers": {
"Accept-Encoding": "gzip",
"Host": "httpbin.org",
"User-Agent": "okhttp/4.10.0-RC1",
"X-Amzn-Trace-Id": "Root=1-5fbb684d-0b7fa68f2cce945f25b5f1bf"
},
"origin": "81.100.210.134",
"url": "https://httpbin.org/get"
}
I ended up using a solution for Android mobile (smart device) when compiling to be compatible with java 1.8. Just add the below to your gradle.build file under defaultConfig section for the module where you use okhttp.
android.compileOptions.sourceCompatibility 1.8
android.compileOptions.targetCompatibility 1.8

How should I format my dataset to avoid this? "Input is not valid. Should be a string, a list/tuple of strings or a list/tuple of integers"

I'm training dialoGPT on my own dataset, following this tutorial.
When I follow exactly the tutorial with the provided dataset I have no issues. I changed the example dataset. The only difference between the example and my code is that my dataset is 256397 lines long compared to the tutorial’s 1906 lines.
I am not sure if the error is pertaining to my column labels in my dataset or if its an issue in one of the text values on a particular row, or the size of my data.
06/12/2020 09:23:08 - WARNING - __main__ - Process rank: -1, device: cuda, n_gpu: 1, distributed training: False, 16-bits training: False
06/12/2020 09:23:10 - INFO - transformers.configuration_utils - loading configuration file https://s3.amazonaws.com/models.huggingface.co/bert/microsoft/DialoGPT-small/config.json from cache at cached/c3a09526c725b854c685b72cf60c50f1fea9b0e4d6227fa41573425ef4bd4bc6.4c1d7fc2ac6ddabeaf0c8bec2ffc7dc112f668f5871a06efcff113d2797ec7d5
06/12/2020 09:23:10 - INFO - transformers.configuration_utils - Model config GPT2Config {
"activation_function": "gelu_new",
"architectures": [
"GPT2LMHeadModel"
],
"attn_pdrop": 0.1,
"bos_token_id": 50256,
"embd_pdrop": 0.1,
"eos_token_id": 50256,
"initializer_range": 0.02,
"layer_norm_epsilon": 1e-05,
"model_type": "gpt2",
"n_ctx": 1024,
"n_embd": 768,
"n_head": 12,
"n_layer": 12,
"n_positions": 1024,
"resid_pdrop": 0.1,
"summary_activation": null,
"summary_first_dropout": 0.1,
"summary_proj_to_labels": true,
"summary_type": "cls_index",
"summary_use_proj": true,
"vocab_size": 50257
}
06/12/2020 09:23:11 - INFO - transformers.configuration_utils - loading configuration file https://s3.amazonaws.com/models.huggingface.co/bert/microsoft/DialoGPT-small/config.json from cache at cached/c3a09526c725b854c685b72cf60c50f1fea9b0e4d6227fa41573425ef4bd4bc6.4c1d7fc2ac6ddabeaf0c8bec2ffc7dc112f668f5871a06efcff113d2797ec7d5
06/12/2020 09:23:11 - INFO - transformers.configuration_utils - Model config GPT2Config {
"activation_function": "gelu_new",
"architectures": [
"GPT2LMHeadModel"
],
"attn_pdrop": 0.1,
"bos_token_id": 50256,
"embd_pdrop": 0.1,
"eos_token_id": 50256,
"initializer_range": 0.02,
"layer_norm_epsilon": 1e-05,
"model_type": "gpt2",
"n_ctx": 1024,
"n_embd": 768,
"n_head": 12,
"n_layer": 12,
"n_positions": 1024,
"resid_pdrop": 0.1,
"summary_activation": null,
"summary_first_dropout": 0.1,
"summary_proj_to_labels": true,
"summary_type": "cls_index",
"summary_use_proj": true,
"vocab_size": 50257
}
06/12/2020 09:23:11 - INFO - transformers.tokenization_utils - Model name 'microsoft/DialoGPT-small' not found in model shortcut name list (gpt2, gpt2-medium, gpt2-large, gpt2-xl, distilgpt2). Assuming 'microsoft/DialoGPT-small' is a path, a model identifier, or url to a directory containing tokenizer files.
06/12/2020 09:23:15 - INFO - transformers.tokenization_utils - loading file https://s3.amazonaws.com/models.huggingface.co/bert/microsoft/DialoGPT-small/vocab.json from cache at cached/78725a31b87003f46d5bffc3157ebd6993290e4cfb7002b5f0e52bb0f0d9c2dd.1512018be4ba4e8726e41b9145129dc30651ea4fec86aa61f4b9f40bf94eac71
06/12/2020 09:23:15 - INFO - transformers.tokenization_utils - loading file https://s3.amazonaws.com/models.huggingface.co/bert/microsoft/DialoGPT-small/merges.txt from cache at cached/570e31eddfc57062e4d0c5b078d44f97c0e5ac48f83a2958142849b59df6bbe6.70bec105b4158ed9a1747fea67a43f5dee97855c64d62b6ec3742f4cfdb5feda
06/12/2020 09:23:15 - INFO - transformers.tokenization_utils - loading file https://s3.amazonaws.com/models.huggingface.co/bert/microsoft/DialoGPT-small/added_tokens.json from cache at None
06/12/2020 09:23:15 - INFO - transformers.tokenization_utils - loading file https://s3.amazonaws.com/models.huggingface.co/bert/microsoft/DialoGPT-small/special_tokens_map.json from cache at None
06/12/2020 09:23:15 - INFO - transformers.tokenization_utils - loading file https://s3.amazonaws.com/models.huggingface.co/bert/microsoft/DialoGPT-small/tokenizer_config.json from cache at None
06/12/2020 09:23:19 - INFO - filelock - Lock 140392381680496 acquired on cached/9eab12d0b721ee394e9fe577f35d9b8b22de89e1d4f6a89b8a76d6e1a82bceae.906a78bee3add2ff536ac7ef16753bb3afb3a1cf8c26470f335b7c0e46a21483.lock
06/12/2020 09:23:19 - INFO - transformers.file_utils - https://cdn.huggingface.co/microsoft/DialoGPT-small/pytorch_model.bin not found in cache or force_download set to True, downloading to /content/drive/My Drive/Colab Notebooks/cached/tmpj1dveq14
Downloading: 100%
351M/351M [00:34<00:00, 10.2MB/s]
06/12/2020 09:23:32 - INFO - transformers.file_utils - storing https://cdn.huggingface.co/microsoft/DialoGPT-small/pytorch_model.bin in cache at cached/9eab12d0b721ee394e9fe577f35d9b8b22de89e1d4f6a89b8a76d6e1a82bceae.906a78bee3add2ff536ac7ef16753bb3afb3a1cf8c26470f335b7c0e46a21483
06/12/2020 09:23:32 - INFO - transformers.file_utils - creating metadata file for cached/9eab12d0b721ee394e9fe577f35d9b8b22de89e1d4f6a89b8a76d6e1a82bceae.906a78bee3add2ff536ac7ef16753bb3afb3a1cf8c26470f335b7c0e46a21483
06/12/2020 09:23:33 - INFO - filelock - Lock 140392381680496 released on cached/9eab12d0b721ee394e9fe577f35d9b8b22de89e1d4f6a89b8a76d6e1a82bceae.906a78bee3add2ff536ac7ef16753bb3afb3a1cf8c26470f335b7c0e46a21483.lock
06/12/2020 09:23:33 - INFO - transformers.modeling_utils - loading weights file https://cdn.huggingface.co/microsoft/DialoGPT-small/pytorch_model.bin from cache at cached/9eab12d0b721ee394e9fe577f35d9b8b22de89e1d4f6a89b8a76d6e1a82bceae.906a78bee3add2ff536ac7ef16753bb3afb3a1cf8c26470f335b7c0e46a21483
06/12/2020 09:23:39 - INFO - transformers.modeling_utils - Weights of GPT2LMHeadModel not initialized from pretrained model: ['transformer.h.0.attn.masked_bias', 'transformer.h.1.attn.masked_bias', 'transformer.h.2.attn.masked_bias', 'transformer.h.3.attn.masked_bias', 'transformer.h.4.attn.masked_bias', 'transformer.h.5.attn.masked_bias', 'transformer.h.6.attn.masked_bias', 'transformer.h.7.attn.masked_bias', 'transformer.h.8.attn.masked_bias', 'transformer.h.9.attn.masked_bias', 'transformer.h.10.attn.masked_bias', 'transformer.h.11.attn.masked_bias']
06/12/2020 09:23:54 - INFO - __main__ - Training/evaluation parameters <__main__.Args object at 0x7fafa60a00f0>
06/12/2020 09:23:54 - INFO - __main__ - Creating features from dataset file at cached
---------------------------------------------------------------------------
ValueError Traceback (most recent call last)
<ipython-input-12-523c0d2a27d3> in <module>()
----> 1 main(trn_df, val_df)
7 frames
<ipython-input-11-d6dfa312b1f5> in main(df_trn, df_val)
59 # Training
60 if args.do_train:
---> 61 train_dataset = load_and_cache_examples(args, tokenizer, df_trn, df_val, evaluate=False)
62
63 global_step, tr_loss = train(args, train_dataset, model, tokenizer)
<ipython-input-9-3c4f1599e14e> in load_and_cache_examples(args, tokenizer, df_trn, df_val, evaluate)
40
41 def load_and_cache_examples(args, tokenizer, df_trn, df_val, evaluate=False):
---> 42 return ConversationDataset(tokenizer, args, df_val if evaluate else df_trn)
43
44 def set_seed(args):
<ipython-input-9-3c4f1599e14e> in __init__(self, tokenizer, args, df, block_size)
24 self.examples = []
25 for _, row in df.iterrows():
---> 26 conv = construct_conv(row, tokenizer)
27 self.examples.append(conv)
28
<ipython-input-9-3c4f1599e14e> in construct_conv(row, tokenizer, eos)
1 def construct_conv(row, tokenizer, eos = True):
2 flatten = lambda l: [item for sublist in l for item in sublist]
----> 3 conv = list(reversed([tokenizer.encode(x) + [tokenizer.eos_token_id] for x in row]))
4 conv = flatten(conv)
5 return conv
<ipython-input-9-3c4f1599e14e> in <listcomp>(.0)
1 def construct_conv(row, tokenizer, eos = True):
2 flatten = lambda l: [item for sublist in l for item in sublist]
----> 3 conv = list(reversed([tokenizer.encode(x) + [tokenizer.eos_token_id] for x in row]))
4 conv = flatten(conv)
5 return conv
/usr/local/lib/python3.6/dist-packages/transformers/tokenization_utils.py in encode(self, text, text_pair, add_special_tokens, max_length, stride, truncation_strategy, pad_to_max_length, return_tensors, **kwargs)
1432 pad_to_max_length=pad_to_max_length,
1433 return_tensors=return_tensors,
-> 1434 **kwargs,
1435 )
1436
/usr/local/lib/python3.6/dist-packages/transformers/tokenization_utils.py in encode_plus(self, text, text_pair, add_special_tokens, max_length, stride, truncation_strategy, pad_to_max_length, is_pretokenized, return_tensors, return_token_type_ids, return_attention_mask, return_overflowing_tokens, return_special_tokens_mask, return_offsets_mapping, **kwargs)
1574 )
1575
-> 1576 first_ids = get_input_ids(text)
1577 second_ids = get_input_ids(text_pair) if text_pair is not None else None
1578
/usr/local/lib/python3.6/dist-packages/transformers/tokenization_utils.py in get_input_ids(text)
1554 else:
1555 raise ValueError(
-> 1556 "Input is not valid. Should be a string, a list/tuple of strings or a list/tuple of integers."
1557 )
1558
ValueError: Input is not valid. Should be a string, a list/tuple of strings or a list/tuple of integers.

Multiline logstash "next" not grouping

Short:
I am having troubles with multiline. I get the tag "multiline" on the log but it doesn't put them together.
Explanation:
Logs I receive
September 22nd 2016, 13:43:52.738 [0m[[31merror[0m] [0mTotal time: 368 s, completed 2016-09-22 13:43:52[0m
September 22nd 2016, 13:43:51.738 [0m[[0minfo[0m] [0m[36mSuites: completed 29, aborted 0[0m[0m
September 22nd 2016, 13:43:51.738 [0m[[31merror[0m] [0mFailed: Total 100,
Failed 4, Errors 0, Passed 96[0m
September 22nd 2016, 13:43:51.737 [0m[[0minfo[0m] [0m[36mRun completed in 1 minute, 24 seconds.[0m[0m
September 22nd 2016, 13:43:51.737 [0m[[0minfo[0m] [0mScalaTest[0m
The line with "Total time: %{NUMBER} s" is repeated multiple time and I'm only interested in these Total time coming after a "Total, Failed, Error" line.
Between the first and the second line could be none or several logs.
My configuration is:
grok {
#1
match => {"message" => "\[.m\[\u001b\[3.m%{NOTSPACE:level}\u001b\[0m\] \u001b\[0m%{NOTSPACE:Status}: Total %{NUMBER}, Failed %{NUMBER}, Errors %{NUMBER}$
add_tag => [ "test.continue" ]
tag_on_failure => []
}
#2
if "test.continue" in [tags]{
multiline {
pattern => "%{TIMESTAMP_ISO8601}\u001b\[0m$"
what => "next"
negate => true
}
}
#3
#OverallTime
grok {
match => {"message" => "\[.m\[\u001b\[3.m%{NOTSPACE:level}\u001b\[0m\] \u001b\[0mTotal time: %{NUMBER:Seconds:int} s, completed"}
add_tag => [ "test.overalltime" ]
tag_on_failure => []
}
What I get is:
beats_input_codec_plain_applied, test.continue, multiline [0m[[31merror[0m] [0mFailed: Total 100, Failed 4, Errors 0, Passed 96[0m
The first log gets the multiline tag and the test.continue but doesn't behave as I expect.
The logic as I understand it is:
If you find [0m[[31merror[0m] [0mFailed: Total 100, Failed 4, Errors 0, Passed 96[0m then put a tag "test.continue",
Multiline every log with the tag "test.continue" and send it to the next line you find until you find a log with the end %{TIMESTAMP_ISO8601}\u001b\[0m$
Extract the time from that log
More explanation:
I'm believing the behaviour will be, but is not happening.
1 finding the trigger
[0m[[31merror[0m] [0mFailed: Total 100,
Failed 4, Errors 0, Passed 96[0m
2 Once it finds it, it will take it and added at the beginning of the next line. Since the first part of the log will still match, it will add again the tag and then sends it to the multiline again
[0m[[31merror[0m] [0mFailed: Total 100,
Failed 4, Errors 0, Passed 96[0m [0m[[0minfo[0m] [0m[36mSuites: completed 29, aborted 0[0m[0m
3 It will have the first, second, ... , until it finds the log which finishes with a timestamp and breaks the multiline. The next log will be not added with the tag.
[0m[[31merror[0m] [0mFailed: Total 100, Failed 4, Errors 0, Passed 96[0m [0m[[0minfo[0m] [0m[36mSuites: completed 29, aborted 0[0m[0m [0m[[31merror[0m] [0mTotal time: 368 s, completed 2016-09-22 13:43:52[0m

embedded elasticsearch - second start up takes long time

I am working on a solution that uses embedded elasticsearch server - on one local machine. The scenario is:
1)create cluster with one node. Import data - 3 million records in ~180 indexes and 911 shards. Data is available, search works and returns expected data, the health seems good:
{
"cluster_name" : "cn1441023806894",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 911,
"active_shards" : 911,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0
}
2) Now, I shutdown the server - this is my console output:
sie 31, 2015 2:51:36 PM org.elasticsearch.node.internal.InternalNode stop
INFO: [testbg] stopping ...
sie 31, 2015 2:51:50 PM org.elasticsearch.node.internal.InternalNode stop
INFO: [testbg] stopped
sie 31, 2015 2:51:50 PM org.elasticsearch.node.internal.InternalNode close
INFO: [testbg] closing ...
sie 31, 2015 2:51:50 PM org.elasticsearch.node.internal.InternalNode close
INFO: [testbg] closed
The database folder is around 2.4 GB.
3) Now i start the server again.... and it takes around 10 minutes to reach status green, example health:
{
"cluster_name" : "cn1441023806894",
"status" : "red",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 68,
"active_shards" : 68,
"relocating_shards" : 0,
"initializing_shards" : 25,
"unassigned_shards" : 818
}
After that process, the database folder is ~0.8 GB.
Then I shutdown the database, and open it again, and now it gets green in 10 seconds. All next close/start operations are quite fast.
My configuration:
settings.put(SET_NODE_NAME, projectNameLC);
settings.put(SET_PATH_DATA, projectLocation + "\\" + CommonConstants.ANALYZER_DB_FOLDER);
settings.put(SET_CLUSTER_NAME, clusterName);
settings.put(SET_NODE_DATA, true);
settings.put(SET_NODE_LOCAL, true);
settings.put(SET_INDEX_REFRESH_INTERVAL, "-1");
settings.put(SET_INDEX_MERGE_ASYNC, true);
//the following settings are my attempt to speed up loading on the 2nd startup
settings.put("cluster.routing.allocation.disk.threshold_enabled", false);
settings.put("index.number_of_replicas", 0);
settings.put("cluster.routing.allocation.disk.include_relocations", false);
settings.put("cluster.routing.allocation.node_initial_primaries_recoveries", 25);
settings.put("cluster.routing.allocation.node_concurrent_recoveries", 8);
settings.put("indices.recovery.concurrent_streams", 6);
settings.put("indices.recovery.concurrent_streams", 6);
settings.put("indices.recovery.concurrent_small_file_streams", 4);
The questions:
1) What happens during the second start up? The db folder size reduces from 2.4gb into 800 megabytes.
2)If this process is necessary, can it be trigerred manually, so I can show nice "please wait" dialog?
The user experience on teh second database opening is very bad and I need to change it.
Cheers
Marcin
on another forum - https://discuss.elastic.co/t/initializing-shards-second-db-start-up-takes-long-time/28357 - I got answer from Mike Simos. The solution is to call synced flush on an index after I finished adding data to it:
client.admin().indices().flush(new FlushRequest(idxName));
And it did the trick: now my database starts in 30 seconds not 10 minutes, the time to flush the data is moved to the import part of my business logic, and that is acceptable. I also noticed that the time impact on import is not very big.

Resources