ElasticRAM Deterministic Sizing Methodology: -Xmx31g OOPs, Lucene mmap & 85% NVMe Watermarks
We derive every equation inside our ElasticRAM Studio directly from official OpenJDK HotSpot memory specifications, Apache Lucene 9 segment internals, and OpenSearch 2.x / Elasticsearch 8.x operational manuals.
Empirical benchmark transparency: direct host-level telemetry verification on your target instance — ElasticRAM strictly separates deterministic math from empirical hardware logs.
Core Equations Inside the ElasticRAM Sizing Engine
Indexed_Cluster_GB = Daily_Ingest_GB * Retention_Days * (1 + Replicas) * 1.15
Total_Hot_NVMe_GB = ceil(Indexed_Cluster_GB / 0.85) # 15% free below watermark.low: 85%
Primary_Shards = clamp_shard_window(Primary_Indexed_GB, target = 25..38 GB/shard)
Node_JVM_Heap_GB = min(31, floor(Node_RAM_GB / 2)) # Preserves 4-byte 32-bit Compressed OOPs
Lucene_OS_Cache_GB = Node_RAM_GB - Node_JVM_Heap_GB # >= 50% RAM for kernel mmap segments
Split_Brain_Quorum = floor(Voting_Manager_Nodes / 2) + 1
ElasticRAM Parameter & Disk Watermark Reference Table
| Configuration Parameter | Target Threshold | ElasticRAM Engineering Rationale |
|---|---|---|
-Xms31g / -Xmx31g (jvm.options) |
<= 31 GB (50% RAM) |
Locks initial and max HotSpot heap identically below the ~31.8 GB boundary so 4-byte 32-bit Compressed OOPs stay active and the JVM never pauses to resize memory. |
Linux OS Page Cache (Lucene mmap) |
>= 50% Host RAM |
Apache Lucene maps immutable segment postings, column-oriented doc_values, and HNSW vector graphs directly into kernel filesystem cache outside the Java heap. |
index.number_of_shards (ISM Rollover) |
10–50 GB / shard |
Keep search shards around 10–30 GB and time-series Wazuh/ELK log shards between 30–50 GB via ISM rollover to prevent both tiny-shard heap waste and slow merges. |
cluster.max_shards_per_node |
<= 20 * Heap_GB |
Caps total open primary + replica shards per data node (e.g., 620 max shards on -Xmx31g) so Lucene FST metadata never exhausts Old Gen JVM memory. |
cluster.routing.allocation.disk.watermark.low |
85% NVMe Used |
Once a node reaches 85% disk usage, OpenSearch stops allocating new replica shards to that disk. ElasticRAM divides indexed volume by 0.85 to keep 15% free. |
cluster.routing.allocation.disk.watermark.high |
90% NVMe Used |
At 90% disk occupancy, the cluster actively relocates existing shards away from the constrained node, spiking network and NVMe I/O if all nodes run tight. |
cluster.routing.allocation.disk.watermark.flood_stage |
95% NVMe Used |
Emergency safeguard that flips indices on the affected disk into index.blocks.read_only_allow_delete: true, halting Wazuh SIEM and log writes until space is freed. |
Open the Interactive ElasticRAM jvm.options & opensearch.yml Studio →