Elasticsearch Workload Metrics
Performance Analyzer can monitor an ElasticSearch data source. It records two groups of metrics, so you can chart them on a dashboard and alert on them.
Metric groups
| Group | How often | One row per | What it records |
|---|---|---|---|
| Elasticsearch Health | Every 5 minutes | Node | Cluster status, unassigned shards, disk used %, disk free GB, JVM heap used % |
| Elasticsearch Index Usage | Daily | Index | Document count and size in MB |
Cluster status is stored as a number so a chart or an alert threshold can read it: 0 is green, 1 is yellow and 2 is red. Cluster status and unassigned shards describe the whole cluster, so every node row of a run carries the same value.
If a node does not report its disk figures, Disk used % and Disk free GB are left empty for that row rather than shown as zero. A disk that really is full reports 0 GB free and 100% used.
What is left out
- Indices whose name starts with
.(Elasticsearch system and hidden indices) are skipped in Elasticsearch Index Usage. - A closed index is listed with empty document count and size.
- If the cluster reports a status other than green, yellow or red, the Elasticsearch Health run fails and records no row. Use the job-failed alert to be told.
Required permissions
The user (or API key) in the data source connection needs the cluster monitor privilege. The collector calls _cluster/health, _nodes/stats and _cat/indices. A user that only has rights to the vector indices gets a failed run and no rows.
Turn it on
- Open the data source in Data Explorer and use Edit, or create a new ElasticSearch data source.
- On the Workload tab, switch on workload analysis and keep Elasticsearch Health and Elasticsearch Index Usage ticked.
- Save. The first rows appear after the next 5-minute run for health, and the next daily run for index usage.
See Enabling Workload Analysis for the full dialog.
Alerting on these metrics
The charts are available to alert rules. Useful starting points: cluster status above 1 (red), disk used above the flood-stage watermark for your cluster, JVM heap used, and unassigned shards above 0. An alert rule on a workload chart must be saved with its date window, or it never fires.