Ingest spike
Elastic Cloud Hosted lets you manage and configure one or more deployments of the versioned Elastic Stack, hosted on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Elastic Cloud on Kubernetes extends Kubernetes orchestration capabilities to allow you to deploy and manage components of the Elastic Stack. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Enterprise is a self-managed orchestration platform for deploying and managing the Elastic Stack at scale. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Self-managed deployments are Elastic Stack deployments managed without the assistance of an orchestrator. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
ECH
Generally available
ECK
Generally available
ECE
Generally available
Self-managed
Generally available
Cluster ingest in the latest hour is well above its recent rolling baseline. AutoOps raised this insight because that level persisted for the configured number of consecutive hours, which might point to an unplanned data influx.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Cluster |
| Domains | indexing, resource-utilization |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| Sensitivity (% above baseline to trigger) | Integer | 50 |
| Consecutive hours above baseline required to trigger | Integer | 1 |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
In the latest 1-hour period, cluster ingest was 18.4 GB (42,000,000 documents), 52% above the baseline (12.1 GB / 28,000,000), and that level persisted for 2 consecutive hour(s) above your spike threshold.
Top contributors: logs-prod-000045 (62%), metrics-apm-000012 (21%)
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Review top ingest contributors
Condition: Always shown for this insight.
Review logs-prod-000045 (62%), metrics-apm-000012 (21%) to understand which indices or data streams drove the ingest spike.
- Open each contributor in the Index view to inspect its ingest pattern.
- Confirm with the owner whether the increase was expected (release, migration, batch job, or backfill).
- If expected, adjust sensitivity or consecutive-hours thresholds in customization settings if alerts are acceptable noise.
- If unexpected, investigate for new integrations, duplicate pipelines, misconfigured collectors, upstream traffic changes, or recent deployments.
Cluster ingest is how much data your cluster indexed each hour. When that volume jumps well above recent normal, it is often planned (release, migration, backfill) but can also mean a new source, a duplicate pipeline, or misconfiguration.
Check Top contributors to see which index or data stream drove the increase. Confirm with the owner whether the jump was expected. If it was not, review ingest pipelines, collectors, and recent deployments for those sources.
If ingest stays high without a clear explanation, you risk heavier load on hot nodes, slower indexing, and pressure on disk and heap.