End-of-Life (EoL)

Troubleshoot Elasticsearch Memory Issues

Elasticsearch uses Elasticsearch Memory Management and Java Virtual Memory (JVM) to manage memory.
JVM memory
The default JVM memory is 1 GB. If this is insufficient, you might need to increase the JVM memory.
Batch size
You can modify the batch size in your Elasticsearch platform.
You should set the JVM memory to a maximum of 50% of the server RAM.
Term query size
The term query size is used by the bulk edit. The default term query size is 65536. If this is insufficient, you might need to increase the term query size.
Bulk size
The bulk size depends on the available JVM memory, and affects the amount of data that Cortex XSOAR can send and process in Elasticsearch.
Heap size
The recommended maximum heap size is 50% of the entire server, as long as the other 50% is free.
Disable swapping
It is recommended to disable swapping in Elasticsearch in order to improve performance.

Recommended For You