Ingest spike
Cluster ingest in the latest hour is well above its recent rolling baseline. AutoOps raised this insight because that level persisted for the configured number of consecutive hours, which might point to an unplanned data influx.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Cluster |
| Domains | indexing, resource-utilization |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| Sensitivity (% above baseline to trigger) | Integer | 50 |
| Consecutive hours above baseline required to trigger | Integer | 1 |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
In the latest 1-hour period, cluster ingest was 18.4 GB (42,000,000 documents), 52% above the baseline (12.1 GB / 28,000,000), and that level persisted for 2 consecutive hour(s) above your spike threshold. Top contributors: logs-prod-000045 (62%), metrics-apm-000012 (21%)
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Review top ingest contributors
Condition: Always shown for this insight.
Review logs-prod-000045 (62%), metrics-apm-000012 (21%) to understand which indices or data streams drove the ingest spike. 1. Open each contributor in the Index view to inspect its ingest pattern.
2. Confirm with the owner whether the increase was expected (release, migration, batch job, or backfill).
3. If expected, adjust sensitivity or consecutive-hours thresholds in customization settings if alerts are acceptable noise.
4. If unexpected, investigate for new integrations, duplicate pipelines, misconfigured collectors, upstream traffic changes, or recent deployments.
Cluster ingest is how much data your cluster indexed each hour. When that volume jumps well above recent normal, it is often planned (release, migration, backfill) but can also mean a new source, a duplicate pipeline, or misconfiguration. Check Top contributors to see which index or data stream drove the increase. Confirm with the owner whether the jump was expected. If it was not, review ingest pipelines, collectors, and recent deployments for those sources. If ingest stays high without a clear explanation, you risk heavier load on hot nodes, slower indexing, and pressure on disk and heap.