---
title: Ingest spike
description: Describes what AutoOps detects and surfaces with the Ingest spike insight: Cluster ingest in the latest hour is well above its recent rolling baseline.
url: https://docs-v3-preview.elastic.dev/elastic/autoops-insights/tree/main/elasticsearch/ingest_spike
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud on Kubernetes
  - Elasticsearch
applies_to:
  - Elastic Cloud Hosted: Generally available
  - Elastic Cloud on Kubernetes: Generally available
  - Elastic Cloud Enterprise: Generally available
  - Self-managed Elastic deployments: Generally available
---

# Ingest spike
Cluster ingest in the latest hour is well above its recent rolling baseline. AutoOps raised this insight because that level persisted for the configured number of consecutive hours, which might point to an unplanned data influx.
<note>
  For a complete list of insights, refer to [AutoOps insights](https://docs-v3-preview.elastic.dev/elastic/autoops-insights/tree/main/elasticsearch).
</note>


## Insight details


| Field     | Value                          |
|-----------|--------------------------------|
| Component | Elasticsearch                  |
| Severity  | Medium                         |
| Scope     | Cluster                        |
| Domains   | indexing, resource-utilization |


## Customization settings

You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to [AutoOps event settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/monitor/autoops/ec-autoops-event-settings) for details.
The default customization settings are:

| Setting                                              | Type    | Default |
|------------------------------------------------------|---------|---------|
| Sensitivity (% above baseline to trigger)            | Integer | 50      |
| Consecutive hours above baseline required to trigger | Integer | 1       |


## Example: What you might see in AutoOps

The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.

### Ingest spike on prod-logs-cluster


#### What was detected

In the latest 1-hour period, cluster ingest was 18.4 GB (42,000,000 documents), 52% above the baseline (12.1 GB / 28,000,000), and that level persisted for 2 consecutive hour(s) above your spike threshold. Top contributors: `logs-prod-000045` (62%), `metrics-apm-000012` (21%)

#### Recommendations

<note>
  AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
</note>

<dropdown title="Review top ingest contributors">
  **Condition**: Always shown for this insight.Review `logs-prod-000045` (62%), `metrics-apm-000012` (21%) to understand which indices or data streams drove the ingest spike. 1. Open each contributor in the Index view to inspect its ingest pattern.
  2. Confirm with the owner whether the increase was expected (release, migration, batch job, or backfill).
  3. If expected, adjust sensitivity or consecutive-hours thresholds in customization settings if alerts are acceptable noise.
  4. If unexpected, investigate for new integrations, duplicate pipelines, misconfigured collectors, upstream traffic changes, or recent deployments.
</dropdown>


#### Background and impact

Cluster ingest is how much data your cluster indexed each hour. When that volume jumps well above recent normal, it is often planned (release, migration, backfill) but can also mean a new source, a duplicate pipeline, or misconfiguration. Check **Top contributors** to see which index or data stream drove the increase. Confirm with the owner whether the jump was expected. If it was not, review ingest pipelines, collectors, and recent deployments for those sources. If ingest stays high without a clear explanation, you risk heavier load on hot nodes, slower indexing, and pressure on disk and heap.