Indexing failures on indices
Elastic Cloud Hosted lets you manage and configure one or more deployments of the versioned Elastic Stack, hosted on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Elastic Cloud on Kubernetes extends Kubernetes orchestration capabilities to allow you to deploy and manage components of the Elastic Stack. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Enterprise is a self-managed orchestration platform for deploying and managing the Elastic Stack at scale. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Self-managed deployments are Elastic Stack deployments managed without the assistance of an orchestrator. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
ECH
Generally available
ECK
Generally available
ECE
Generally available
Self-managed
Generally available
Indexing failures are occurring at a rate above the configured threshold on affected indices. Failed indexing usually means documents were rejected because of mapping conflicts, malformed JSON, or similar ingest errors.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | High |
| Scope | Node |
| Domains | indexing, stability |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| Maximum allowed number of indexing failed count | Integer | 1 |
| Exclude indices based on this pattern | List of strings |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
Indexing failure rate is above your configured threshold on logs-prod-000045, logs-prod-000046.
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Check your client application logs
Condition: Always shown for this insight.
Check logs from indexing clients (Filebeat, Logstash, or custom scripts) to find why documents are failing to index.
Retry indexing with backoff
Condition: Always shown for this insight.
Retry indexing from your application with pauses between attempts until Elasticsearch accepts writes again.
When Elasticsearch rejects indexing operations, documents do not reach the index. Common causes include mapping conflicts, malformed JSON, strict dynamic mapping, and version conflicts.
If failures continue, data can lag behind client expectations and search results can miss recent documents.