October 26, 2026 · QueryCrunch
es_rejected_execution_exception is backpressure, not a hardware verdict. How to read write threadpool stats, size bulk requests by bytes, cut the per-document cost with refresh_interval and mapping changes, spot merge-bound storage — and how to tell when the cluster genuinely does need more nodes.
Read moreOctober 5, 2026 · QueryCrunch
When a second region or a second cluster appears, CCS and CCR solve different problems and cost very differently. Connection modes, round-trip behavior, soft-delete retention leases, follower lag, and a two-region layout that keeps storage single-copy.
Read moreSeptember 28, 2026 · QueryCrunch
Most Elastic Stack and OpenSearch alerting starts as a threshold on a dashboard and ends as a channel nobody reads. How to pick rule types, size look-back windows against your ingest lag, use SLO burn rates instead of static thresholds, and measure whether a rule earns its page.
Read moreSeptember 21, 2026 · QueryCrunch
Logs get the cost attention; metrics quietly grow. How TSDS index mode, synthetic _source, and ILM downsampling cut metrics storage by an order of magnitude — the constraints they impose, what resolution you give up, and the rollout order that keeps dashboards working.
Read moreSeptember 21, 2026 · QueryCrunch
Adding nodes does not fix an imbalanced cluster. How to confirm a hot spot, the four mechanisms that cause it — write-heavy shard placement, custom routing, oversized shards, and mixed roles — and the allocator settings that actually move load.
Read moreSeptember 16, 2026 · QueryCrunch
The cluster that falls over at 3am usually has 4,000 fields in one index template. How dynamic mapping gets out of hand, what it costs in heap and cluster state, and the four mechanisms that fix it: explicit dynamic templates, dynamic: false, flattened, and subobjects: false.
Read moreSeptember 14, 2026 · QueryCrunch
The piped query language is a real improvement for incident analysis and multi-stage stats, and the wrong tool for ranked search or a hot request path. Concrete examples, the row limits that bite, and a rollout order.
Read moreSeptember 11, 2026 · QueryCrunch
Elasticsearch's logsdb index mode applies index sorting and synthetic _source to log data streams and typically halves storage. Here is what it actually changes, what it costs you at read and ingest time, how to measure the saving on your own data, and what the OpenSearch equivalents are.
Read moreAugust 12, 2026 · QueryCrunch
Every observability estate has a collector story, usually by accident. How to choose between Elastic Agent, Logstash, and the OpenTelemetry Collector, where transforms belong, and when a buffer earns its keep.
Read moreJune 9, 2026 · QueryCrunch
Index lifecycle management is where retention policy becomes storage cost. Working recipes for hot/warm/cold/frozen phases, the min_age semantics that trip everyone, and the checks that keep policies actually running.
Read more