Long Running Index task
An individual indexing task has run longer than expected. Single-document indexing can stall when documents are large, mappings must update, ingest pipelines are heavy, or nodes are under resource pressure.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Node |
| Domains | performance, indexing, stability, tasks |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| Long running index task threshold in minutes | Integer | 1 |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
Summary: There are 3 tasks that ran more than the 12 minutes threshold. The longest task running start time was 2026-03-15T14:22:00 UTC time. The longest task running time is 420 ms. ACTIVE TASKS: NodeName: logs-prod-000045- TaskId: es-data-01:4521
TaskSerialNumber: 12
TaskType: logs-prod-000045
Description: bulk index to logs-prod-000045
StartTimeInMillis: 1710502920000
RunningTimeInMinutes: 48
Cancellable: true
Action: indices:data/write/bulk
Headers: {} HISTORY TASKS: NodeName:logs-prod-000045- TaskId: es-data-01:4521
TaskSerialNumber: 12
TaskType: logs-prod-000045
Description: bulk index to logs-prod-000045
StartTimeInMillis: 1710502920000
RunningTimeInMinutes: 48
Cancellable: true
Action: indices:data/write/bulk
Headers: {}
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Cancel long-running tasks
Condition: Shown when one or more long-running tasks are cancellable.
Cancel long-running tasks (es-data-01:4521, es-data-02:7788) that are affecting cluster stability. Use the action below.
POST _tasks/es-data-01:4521, es-data-02:7788/_cancel
Requires the manage cluster privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
Impact: Long running indexing tasks might affect the cluster performance. Long running indexing tasks are usually a side-effect of constrained resources, most of the time high load, memory pressure or limited CPU availability. There can be various reasons why a task in charge of indexing a single document takes an unusual amount of time to complete, namely when the document being indexed satisfies one or more of the following conditions:
- it is very large
- it contains a large amount of deeply nested elements
- it requires a mapping change (that is, new field) and the elected master node is too overloaded to broadcast the mapping change to all data nodes
- it needs to go through an ingest pipeline and the ingest node running the pipeline doesn't have sufficient resources
- it needs to go through an inference processor and the machine learning node hosting the trained model doesn't have sufficient resources For these reasons, there are a few best practices to keep in mind:
- Stay on top of your index mappings, do not index too many useless fields
- Make sure your documents have a reasonable size and if you need to index large chunks of text that either need to be analyzed or vectorized, consider splitting them into several documents
- Try to not misuse nested fields and denormalize your documents as much as possible
- If you leverage ingest pipelines that contain potentially heavy processors, such as inference, scripts, grok, enrich, and so on, pay special attention to optimize them as much as possible.