Long Running Shard Task
A shard-level task such as recovery, relocation, or initialization has run longer than the threshold. Shard work is normal after topology changes, snapshot restores, or replica adjustments, but very large shards or many concurrent movements prolong it.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Node |
| Domains | performance, shard-allocation, stability, tasks |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| Long running shard task threshold in minutes | Integer | 60 |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
Summary: There are 3 tasks that ran more than the 12 minutes threshold. The longest task running start time was 2026-03-15T14:22:00 UTC time. The longest task running time is 420 ms. ACTIVE TASKS: NodeName: logs-prod-000045- TaskId: es-data-01:4521
TaskSerialNumber: 12
TaskType: logs-prod-000045
Description: bulk index to logs-prod-000045
StartTimeInMillis: 1710502920000
RunningTimeInMinutes: 48
Cancellable: true
Action: indices:data/write/bulk
Headers: {} HISTORY TASKS: NodeName:logs-prod-000045- TaskId: es-data-01:4521
TaskSerialNumber: 12
TaskType: logs-prod-000045
Description: bulk index to logs-prod-000045
StartTimeInMillis: 1710502920000
RunningTimeInMinutes: 48
Cancellable: true
Action: indices:data/write/bulk
Headers: {}
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Cancel long-running tasks
Condition: Shown when cancellable.
Cancel long-running tasks (es-data-01:4521, es-data-02:7788) that are affecting cluster stability. Use the action below.
POST _tasks/es-data-01:4521, es-data-02:7788/_cancel
Requires the manage cluster privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
Fix non-cancellable shard tasks
Condition: Shown when not cancellable.
Balance or reroute shards during off-peak hours, or reduce cluster load so long-running shard recovery and relocation can finish.
Fix non-cancellable shard tasks
Condition: Shown when shard task is not cancellable.
Balance or reroute shards during off-peak hours, or add or remove nodes so long-running shard tasks can finish.
Impact: Long running shard tasks might affect the cluster performance. The most usual cause for long running shard tasks are related to shard movements within your cluster. to make sure that your shards are always properly spread over your nodes, the cluster regularly checks that they are well balanced, and will move shards around if that's not the case. Shard rebalancing can happen in many different situations, such as:
- when creating or deleting one or more indexes
- when cloning, shrinking or splitting an index
- when changing shard allocation filtering or forced awareness rules
- when adding or removing nodes
- when changing the number of replica shards
- when modifying the size or watermarks of your disk storage
- when restoring a snapshot
- when leveraging cross-cluster replication to un-/follow remote indexes all the above actions will either result in increasing or decreasing the number of shards in the cluster or modifying their placement constraints, and hence, potentially induce shard movement. For this reason, you should be mindful when running any of the above operations, especially in presence of large shards, as it will take more time to move them around. Also make sure to not trigger several of those operations at the same time, and ideally not during peak times, so as to not worsen the problem.