Long Running Bulk Index Task
At least one bulk indexing task has exceeded the configured runtime threshold. Long bulk jobs hold thread pool and heap resources and can contend with other ingest and search.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Node |
| Domains | performance, indexing, stability, tasks |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| Long running Bulk Index task threshold in minutes | Integer | 10 |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
Summary: There are 3 tasks that ran more than the 12 minutes threshold. The longest task running start time was 2026-03-15T14:22:00 UTC time. The longest task running time is 420 ms. ACTIVE TASKS: NodeName: logs-prod-000045- TaskId: es-data-01:4521
TaskSerialNumber: 12
TaskType: logs-prod-000045
Description: bulk index to logs-prod-000045
StartTimeInMillis: 1710502920000
RunningTimeInMinutes: 48
Cancellable: true
Action: indices:data/write/bulk
Headers: {} HISTORY TASKS: NodeName:logs-prod-000045- TaskId: es-data-01:4521
TaskSerialNumber: 12
TaskType: logs-prod-000045
Description: bulk index to logs-prod-000045
StartTimeInMillis: 1710502920000
RunningTimeInMinutes: 48
Cancellable: true
Action: indices:data/write/bulk
Headers: {}
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Improve long bulk index tasks
Condition: Shown when always included (bulk index tasks are not cancellable.
Split bulk payloads into smaller batches and limit parallel bulk requests to reduce memory pressure. Temporarily raise or turn off the refresh interval during the run, and review index mappings and analysis for optimization opportunities.
Impact: Long running bulk index tasks might affect the cluster performance. Bulk indexing is a process that allows you to perform multiple indexing operations in a single API call. It is much more performant than indexing all documents with separate indexing requests. Bulk requests consume resources in your cluster. You should make sure that all the following resources are configured properly to accomodate your ingestion needs:
- network bandwidth: pay attention to the payload size
- memory: size your heap and indexing buffer adequately
- CPU: ensure your ingest pipelines (if any) are defined optimally
- disk storage: make sure to provision ample storage to accomodate your ingest rate There are a few best practices to keep in mind:
- Even though the maximum HTTP payload size is set to 100MB, it doesn't mean that you should send that much in each request. You should figure out the optimal payload size for your bulk requests by starting small (for example, 100 documents) and then gradually increase until you reach the maximum ingestion rate
- Do not run too many bulk requests in parallel
- Try to run bulk requests during off-peak hours
- Set appropriate timeouts on your client or you run the risk of indexing duplicate data if your client implements automatic retries and you are using auto-generated IDs (for example, Logstash has a 60s default timeout and will send the bulk request again if the response takes longer to return)
- The indexing buffer on a node (10% of the heap by default) is shared among all shards hosted on that node, so be mindful that not all indexes might benefit from the same indexing rate.