elastic老是自动挂掉

是查询的时候中断吗？
 
内存配了多少, 是节点es-3节点断掉吗?

这个是最新日志：
目前服务已经挂了，没有查询操作。

[2017-09-28T14:23:04,895][WARN ][o.e.m.j.JvmGcMonitorService] [es-1] [gc][2175] overhead, spent [1s] collecting in the last [1s]
[2017-09-28T14:23:05,942][WARN ][o.e.m.j.JvmGcMonitorService] [es-1] [gc][2176] overhead, spent [1s] collecting in the last [1s]
[2017-09-28T14:23:09,390][WARN ][o.e.m.j.JvmGcMonitorService] [es-1] [gc][2178] overhead, spent [1.1s] collecting in the last [1.2s]
[2017-09-28T14:23:09,747][ERROR][o.e.t.n.Netty4Utils      ] fatal error on the network layer
at org.elasticsearch.transport.netty4.Netty4Utils.maybeDie(Netty4Utils.java:140)
at org.elasticsearch.transport.netty4.Netty4MessageChannelHandler.exceptionCaught(Netty4MessageChannelHandler.java:83)
at io.netty.channel.AbstractChannelHandlerContext.invokeExceptionCaught(AbstractChannelHandlerContext.java:285)
at io.netty.channel.AbstractChannelHandlerContext.notifyHandlerException(AbstractChannelHandlerContext.java:850)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:364)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:293)
at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:280)
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:396)
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:248)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926)
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134)
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:624)
at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:524)
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:478)
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:438)
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858)
at java.lang.Thread.run(Thread.java:748)
[2017-09-28T14:23:10,434][WARN ][o.e.m.j.JvmGcMonitorService] [es-1] [gc][2179] overhead, spent [985ms] collecting in the last [1s]
[2017-09-28T14:23:12,879][WARN ][o.e.m.j.JvmGcMonitorService] [es-1] [gc][2180] overhead, spent [2.4s] collecting in the last [1.1s]
[2017-09-28T14:23:15,748][WARN ][o.e.m.j.JvmGcMonitorService] [es-1] [gc][2181] overhead, spent [2.8s] collecting in the last [2.7s]

你机器的内存多大的？

同楼上，内存溢出啦。

请问楼主问题解决了么？

用/_nodes/stats/jvm?pretty 命令看下JVM的统计数据，你的512M的heap size 对ES来说太小了。 ES默认是1G。

# Heap size defaults to 256m min, 1g max
# Set ES_HEAP_SIZE to 50% of available RAM, but no more than 31g
#ES_HEAP_SIZE=2g

 

有JVM崩溃日志，之前我们处理过一起，日志集群，有六十多个日志索引，然后有人使用通配符查询这六十多个索引的内容，结果每天都有节点丢失。。  主要就是内存不够，而且使用不当