Index indexing failed
Indexing failures are occurring at a rate above the configured threshold on affected indices. Failed indexing usually means documents were rejected because of mapping conflicts, malformed JSON, or similar ingest errors.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | High |
| Scope | Node |
| Domains | indexing, stability |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| Maximum allowed number of indexing failed count | Integer | 1 |
| Exclude indices based on this pattern | List of strings |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
The affected indices: logs-prod-000045, logs-prod-000046
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Check your client application logs
Condition: Always shown for this insight.
Check logs from indexing clients (Filebeat, Logstash, or custom scripts) to find why documents are failing to index.
Retry indexing with backoff
Condition: Always shown for this insight.
Retry indexing from your application with pauses between attempts until Elasticsearch accepts writes again.
The index failed rate is above threshold. Impact: The index failed count refers to the number of indexing operations that have been rejected, typically due to mapping or syntax related issues. If the index failed count is high and continues to grow, it might lead to data loss as requests will be rejected. This can also affect the quality of searches in your system.