Elasticsearch - Frozen Indices

The indices that are searched frequently are held in memory because it takes time to rebuild them and help in an efficient search. On the other hand, there may be indices which we rarely access. Those indices need not occupy the memory and can be re-build when they are needed. Such indices are known as frozen indices.

Elasticsearch builds the transient data structures of each shard of a frozen index each time that shard is searched and discards these data structures as soon as the search is complete. Because Elasticsearch does not maintain these transient data structures in memory, frozen indices consume much less heap than the normal indices. This allows for a much higher disk-to-heap ratio than would otherwise be possible.

Example for Freezing and Unfreezing

The following example freezes and unfreezes an index −

POST /index_name/_freeze
POST /index_name/_unfreeze

Searches on frozen indices are expected to execute slowly. Frozen indices are not intended for high search load. It is possible that a search of a frozen index may take seconds or minutes to complete, even if the same searches completed in milpseconds when the indices were not frozen.

Searching a Frozen Index

The number of concurrently loaded frozen indices per node is pmited by the number of threads in the search_throttled threadpool, which is 1 by default. To include frozen indices, a search request must be executed with the query parameter − ignore_throttled=false.

GET /index_name/_search?q=user:tpoint&ignore_throttled=false

Monitoring Frozen Indices

Frozen indices are ordinary indices that use search throttpng and a memory efficient shard implementation.

GET /_cat/indices/index_name?v&h=i,sth