Elasticsearch:CAT observation

Slice CAT queries data and counts documents. It may run searches and aggregations across multiple Backings. Do not call Slice CAT from application startup or initialization flows, from application request paths, or from frequent inspection tasks. During troubleshooting, specify a single Slice or Backing whenever possible and limit the request frequency. h only filters the returned columns. Even if docs.count is not displayed, the server still counts documents. If you only need a list of Slices, use the Paginate through Slices operation, which does not count documents.

Default columns:

Common query parameters:

For programmatic processing, use format=json and specify the columns explicitly instead of relying on the default columns to remain unchanged:

GET /_cat/slice_collection/knowledge-chunks?format=json&h=collection,state,backings,slices,docs.count,dataset.size

Collection and backing behavior and limits

• Path syntax — In the Collection API, {name} accepts an exact name, a comma-separated list, or a wildcard. {collection} in the Backing and Slice CAT APIs must be an exact name.

• Column semantics — dataset.size is the sum of the primary shard dataset sizes of all Backings. Only primary shards are counted, so the value is not multiplied by the number of replicas.

• Column semantics — The remaining value of a Backing does not equal the number of Slices that the Backing will necessarily allocate. If assign=disabled, the Backing does not accept new Slices even when remaining is greater than 0.

• Column semantics — If not all primary shards are started, docs.count and pri.store.size may be empty. Interpret these values together with health and unassigned, and do not treat an empty value as 0.

• Column semantics — pri.store.size and store.size indicate the size of indexed data. They are not the same as the local disk usage of stateless nodes, and they do not include historical data that is waiting to be cleaned up in object storage.

• Limit — If a Collection summary or a Backing list expands to more than 10,000 Backings, the request returns HTTP 400. Use a narrower Collection scope.

Slice list-specific parameters

Filtering Slices by shard takes two steps. First, list the Backings of the Collection. In this request, v returns the column headers so that you can identify the complete Backing name in the response:

GET /_cat/slice_collection/knowledge-chunks/backings?v

Then filter the Slices by shard. Replace the placeholder in the following request with the complete Backing name from the backing column of the first response:

GET /_cat/slice_collection/knowledge-chunks/slices?backing=<complete-backing-name>&shard=0,1&h=slice,backing,shardIds&format=json

The backing name applies only to this operational filtering task. Applications still read and write data through the Collection and, at the Slice level, through _slice.

shard must fall within the range from 0 to index.number_of_shards minus 1. For a value outside this range, the request returns HTTP 400. If you specify shard without backing, the request also returns HTTP 400. Multiple shard IDs are matched with OR semantics. If docs.count, or its alias dc, is the first sort field of s, you cannot use shard together with that sorting.

s=docs.count sorts in ascending order by default. As long as docs.count is the first sort field, both ascending and descending sorting aggregate on the target Backings before selecting results. If backing is not specified, the request scans all Backings in the Collection and returns HTTP 400 unless allow_expensive_search=true is explicitly set. This parameter applies only to the current request. When another field is the first sort field, sorting applies only to the results already selected by Slice name and does not produce a global ranking.

A Slice with a document count of 0 does not appear in results sorted by document count, but it still appears in the default list or in an exact Slice query.

CAT behavior and usage recommendations

• If the result exceeds the server-side row limit, CAT does not paginate it. The response returns the maximum number of rows allowed and uses the HTTP Warning header to indicate that the result is incomplete.

• Document-count sorting relies on distributed aggregation, so the order and the document counts may be inaccurate. When the result may be inaccurate, the response includes the HTTP Warning header to explain the reason.

• CAT is a near-real-time view. Documents that have just been written but have not yet been refreshed may not be counted in docs.count.

• CAT does not provide the storage size of a single Slice and does not support sorting by Slice storage size. To get the document count of a single Slice without running a Slice CAT query, use Query a single Slice with include_doc_count=true.

• When you use Branch Slice (Beta), CAT lists that return multiple rows and document-count sorting do not fully include inherited data. Follow the instructions in that topic to query the document count of the target Slice separately.

  For instance-level monitoring metrics and the console entry point, see Cluster monitoring.