Field Data Cache Eviction Thrash
warningField data (inverted reverse index for aggregations) loads into JVM heap on first access and persists for segment lifetime. When circuit breaker limit or cache size is too small, frequent evictions cause repeated expensive field data loading, spiking CPU and heap pressure.
elasticsearch.node.cache.count or elasticsearch.cluster.indices.cache.evictions showing high eviction rate with correlated CPU spikes in elasticsearch.os.cpu.usage during aggregation queries
Increase indices.fielddata.cache.size from default unbounded to 40% of heap, monitor elasticsearch.breaker.memory.estimated for fielddata breaker closely. Enable doc_values on frequently aggregated fields (default for all except text) to move data off-heap - verify via index mappings. Review queries using text field aggregations and switch to keyword type if possible. Use index.queries.cache.enabled:false on indices with unique query patterns that don't benefit from caching. For high-cardinality aggregations, implement composite aggregations to paginate results instead of loading all unique values. Monitor elasticsearch.node.cache.size to track total cache memory consumption.