Indexing failures on indices
Indexing failures are occurring at a rate above the configured threshold on affected indices. Failed indexing usually means documents were rejected because of mapping conflicts, malformed JSON, or similar ingest errors.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | High |
| Scope | Node |
| Domains | indexing, stability |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| Maximum allowed number of indexing failed count | Integer | 1 |
| Exclude indices based on this pattern | List of strings |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
Indexing failure rate is above your configured threshold on logs-prod-000045, logs-prod-000046.
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Check your client application logs
Condition: Always shown for this insight.
Check logs from indexing clients (Filebeat, Logstash, or custom scripts) to find why documents are failing to index.
Retry indexing with backoff
Condition: Always shown for this insight.
Retry indexing from your application with pauses between attempts until Elasticsearch accepts writes again.
When Elasticsearch rejects indexing operations, documents do not reach the index. Common causes include mapping conflicts, malformed JSON, strict dynamic mapping, and version conflicts.
If failures continue, data can lag behind client expectations and search results can miss recent documents.