Skip to content

Troubleshoot Elasticsearch problems

Use a user with only the diagnostic privileges required for the affected operation.

Check cluster health

curl --fail-with-body --user "<user>" \
  "https://<elasticsearch-hostname>/_cluster/health?pretty"

Record status, unassigned shards, node count, and task symptoms.

Writes are blocked or return HTTP 429

Check disk use and watermark messages. At flood stage, Elasticsearch can mark affected indices read-only. Reduce avoidable ingestion, remove data only under an approved retention decision, or request supported capacity. Do not permanently raise watermarks to mask a full disk.

Search returns no results

  1. Confirm the index or data stream contains documents.
  2. Confirm the user can read it.
  3. Check the Kibana data view and time range.
  4. Confirm the expected field exists and has the intended type.
  5. Check whether data was written to another index or pipeline.

Kibana is not ready

Confirm Elasticsearch connectivity and health first. Disk pressure, unavailable system indices, authentication, or certificate failures can prevent Kibana from becoming ready.

Ingest fails

Record the status code and redacted error type. Check mapping conflicts, pipeline errors, rejected requests, permissions, and target index names. Test a synthetic document rather than replaying sensitive production data.

Use Elastic troubleshooting for current product diagnostics, then get support if the managed service requires intervention.