Cluster State Update Delays
warningSlow cluster state updates cause delays in shard allocation, index creation, and mapping updates. Large cluster state size or master node resource constraints are common causes.
elasticsearch.cluster.state_update.time increasing significantly or elasticsearch.cluster.pending_tasks accumulating (>10 sustained), indicating cluster state processing bottleneck
Investigate cluster state size via _cluster/state endpoint - states >100MB indicate problems. Check elasticsearch.cluster.published_states.full vs elasticsearch.cluster.published_states.differences ratio - high full state publishes are expensive. Common causes: (1) Mapping explosion from high-cardinality dynamic fields - refactor to use arrays of objects instead of dynamic keys, (2) Too many indices/shards - implement ILM to consolidate, (3) Large number of cluster settings or templates. Review elasticsearch.templates.count and optimize. Ensure master nodes have adequate CPU and are not handling data/ingest workload. Monitor elasticsearch.task.stats for long-running tasks blocking cluster state updates.