Elasticsearch Freeze Index

Frequently searched indexes are stored in memory because it takes time to rebuild indexes and help with efficient searches. On the other hand, there may be indexes that we rarely access. These indexes do not need to occupy memory and can be rebuilt as needed. Such indexes are called frozen indexes.

Each time a search shard is performed, Elasticsearch builds a transient data structure for each shard of the frozen index and immediately discards these data structures after the search is completed. Since Elasticsearch does not maintain these temporary data structures in memory, the frozen index consumes much less heap than a normal index. Compared with other methods, this allows a higher disk-to-heap ratio.

Example of freezing and unfreezing

The following examples show how to freeze and unfreeze indexes-

POST　/index_name/_freeze
POST　/index_name/_unfreeze

The search on frozen indexes is expected to be slow. Frozen indexes are not suitable for high search loads. Even if the search on unfrozen indexes is completed within a few milliseconds, the search on frozen indexes may take several seconds or even minutes to complete.

Search frozen indices

The number of frozen indices concurrently loaded by each node is limited by the number of threads in the search_throttled thread pool, which is set to1. To include frozen indices, it is necessary to use the query parameter - ignore_throttled = falseto execute search requests.

GET　/index_name/_search?q=user:tpoint&ignore_throttled=false

Monitor frozen indices

A frozen index is a normal index implemented with search throttling and effective memory shard allocation.

GET　/_cat/indices/index_name?v&h=i,sth