ES builds up to 1m entries unless it says its doing a full index
rebuild due to corrupt files on disk etc.
If you read the logs it even tells you how many entries it rebuilt:
[PID:05908:017 2016.05.09 07:03:25.103 DEBUG IndexCommitter ]
ReadIndex rebuilding done: total processed 866754 records, time
elapsed: 01:03:01.9556591.
To test I just created a db with +- 950k records in it. I used
testclient and did a wrfl 10 1000000 (stopped it just short of 1m). I
then restarted the node.
[22295,10,12:07:30.278] CACHED TFChunk #0-0 (chunk-000000.000000) in
00:00:00.8777061.
[22295,16,12:07:30.332] ReadIndex Rebuilding: processed 100000 records (10.9%).
[22295,16,12:07:30.778] ReadIndex Rebuilding: processed 200000 records (21.9%).
[22295,16,12:07:31.277] ReadIndex Rebuilding: processed 300000 records (32.8%).
[22295,16,12:07:31.746] ReadIndex Rebuilding: processed 400000 records (43.7%).
[22295,16,12:07:32.257] ReadIndex Rebuilding: processed 500000 records (54.6%).
[22295,16,12:07:32.780] ReadIndex Rebuilding: processed 600000 records (65.6%).
[22295,16,12:07:33.270] ReadIndex Rebuilding: processed 700000 records (76.5%).
[22295,16,12:07:33.782] ReadIndex Rebuilding: processed 800000 records (87.4%).
[22295,16,12:07:34.278] ReadIndex Rebuilding: processed 900000 records (98.3%).
[22295,16,12:07:34.356] ReadIndex rebuilding done: total processed
915193 records, time elapsed: 00:00:04.7460410.
This is on battery power so its a bit slower than when plugged in. As
I mentioned previously there are two possibilities in terms of
differences, the first is size of events (eg if all my events were
500kb then reading 1m is far more work than if they are 500 bytes) the
second is environmental.
You can also control the size of the memtable using --max-mem-table-size
Cheers,
Greg