Elasticsearch

Search Elasticsearch pages

Integrations

ElasticSearch (Exporter)

Learn how the ElasticSearch (Exporter) integration connects with Netdata and how to configure it.

Elasticsearch (go.d.plugin elasticsearch)

Monitor Elasticsearch cluster and node health, indexing, search, storage, JVM, and resource performance metrics.

Comparisons

Netdata vs ELK Stack | Monitoring Tools Comparison

Struggling with ELK complexity? Get instant deployment, sub-2s visibility, lightweight agents, & zero-maintenance storage with Netdata instead. Learn more!

Guides

Guides overview 1 page

Elasticsearch Operations Guides

Practical guides for running, troubleshooting, and monitoring Elasticsearch in production.

Elasticsearch Operations Guides 32 pages

Open the Elasticsearch Operations Guides hub

Elasticsearch All Shards Failed: How To Fix It

Diagnose and fix Elasticsearch search_phase_execution_exception when all shards fail, distinguishing data unavailability from query errors and resource exhaustion.

Elasticsearch ALLOCATION_FAILED after max retries: reroute and corrupt shard recovery

Recover Elasticsearch shards stuck in ALLOCATION_FAILED after exceeding max retries, including reroute API usage and corrupt shard recovery paths.

Elasticsearch cluster health red: unassigned primaries and how to recover

Diagnose and recover from a red Elasticsearch cluster when primary shards are unassigned, including allocation explain, disk watermarks, and manual reroute.

Elasticsearch cluster health yellow: unassigned replicas vs real allocation blocks

Distinguish benign yellow cluster states from real allocation blockers. Diagnose unassigned replicas, disk watermarks, and shard allocation failures in Elasticsearch.

Elasticsearch cluster state too large: field count, index count, and per-node heap

Diagnose and fix an oversized Elasticsearch cluster state that burns heap on every node and overwhelms the master.

Elasticsearch cluster_block_exception: blocked by, the read-only blocks explained

Map Elasticsearch cluster_block_exception codes to their root causes and clear read-only blocks on indices or the cluster.

Elasticsearch coordinating node overload: aggregation merge, heap spikes, and 429s

Diagnose and fix Elasticsearch coordinating node overload caused by aggregation merges, heap spikes, and circuit breaker trips that return HTTP 429.

Elasticsearch disk full: emergency recovery and freeing space safely

Emergency recovery steps when Elasticsearch data nodes exhaust disk space, including safe deletion order, replica reduction, and clearing flood-stage read-only blocks.

Elasticsearch disk watermark cascade: from low watermark to cluster-wide read-only

Operational guide to diagnosing and recovering from the Elasticsearch disk watermark cascade: low, high, and flood stage thresholds, read-only index blocks, and relocation storms.

Elasticsearch EsRejectedExecutionException: write thread pool rejections and HTTP 429

Diagnose and fix Elasticsearch write thread pool rejections that surface as EsRejectedExecutionException and HTTP 429 responses.

Elasticsearch expensive queries: leading wildcards, regex, deep pagination, and scripts

Find and fix Elasticsearch queries that burn CPU and heap. Covers leading wildcards, regex, deep pagination, scripts, and the diagnostic signals that expose them.

Elasticsearch exposed without authentication: open clusters and snapshot exfiltration

Detect and respond to unauthenticated Elasticsearch clusters and snapshot repository exfiltration.

Elasticsearch fielddata circuit breaker tripped: text-field aggregations and the keyword fix

Diagnose and fix Elasticsearch fielddata circuit breaker trips caused by aggregating or sorting on analyzed text fields. Use keyword sub-fields and monitor the right signals.

Elasticsearch FORBIDDEN/12/index read-only / allow delete (api) — flood stage recovery

Recover from Elasticsearch cluster_block_exception when flood-stage disk watermark sets index.blocks.read_only_allow_delete, blocking writes.

Elasticsearch heap pressure death spiral: GC, node removal, and the cascade

How sustained heap pressure above 85% triggers old GC pauses, node removal, and cascading shard reallocation in Elasticsearch clusters, and how to break the cycle.

Elasticsearch high disk watermark [90%] exceeded: shard relocation and the cascade

Diagnose and stop the Elasticsearch disk watermark cascade when shard relocations from high-watermark nodes push targets toward their own limits.

Elasticsearch ILM stuck: indices not rolling over, shrinking, or deleting

Diagnose and unstick Elasticsearch Index Lifecycle Management when indices fail to advance through rollover, shrink, or delete actions.

Elasticsearch indexing rate dropped to zero: where the write path stalls

Diagnose why Elasticsearch indexing stops despite active ingestion. Covers write thread pool saturation, merge storms, ingest pipeline bottlenecks, unassigned primaries, circuit breakers, and read-only disk blocks.

Elasticsearch JVM heap usage high: reading the sawtooth and the post-GC floor

Diagnose Elasticsearch JVM heap pressure by reading the post-GC floor instead of the sawtooth peak. Identify shard, fielddata, and aggregation drivers before they trigger GC death spirals.

Elasticsearch Limit of total fields [1000] in index has been exceeded — mapping explosion

Diagnose and fix the Elasticsearch illegal_argument_exception when dynamic mapping causes the index total fields limit of 1000 to be exceeded.

Elasticsearch long GC pauses: old-generation stop-the-world and node drops

Diagnose and fix Elasticsearch old-generation GC pauses that trigger stop-the-world events, fault-detection timeouts, and cascading node removals.

Elasticsearch mapper_parsing_exception: type conflicts and failed document indexing

Fix mapper_parsing_exception errors in Elasticsearch caused by type conflicts, strict mapping, and malformed fields. Learn to detect, diagnose, and reindex safely.

Elasticsearch mapping explosion: dynamic mapping, cluster state bloat, and master pressure

Diagnose and fix Elasticsearch mapping explosion from dynamic mapping, including field limits, cluster state bloat, and master node pressure.

Elasticsearch master instability: frequent elections and metadata overload

Diagnose and fix Elasticsearch master node flapping caused by cluster state metadata overload, GC pauses, and election timeouts.

Elasticsearch master_not_discovered_exception: no elected master and stalled writes

Diagnose and resolve Elasticsearch master_not_discovered_exception when no master is elected and writes stall due to quorum loss, GC pauses, network partitions, or cluster state overload.

Elasticsearch merge storms: segment explosion, I/O saturation, and refresh tuning

Diagnose and fix Elasticsearch merge storms caused by segment explosion, I/O saturation, and aggressive refresh intervals.

Elasticsearch monitoring checklist: the signals every production cluster needs

A production monitoring checklist for Elasticsearch organized by survival, operational, mature, and expert maturity levels.

Elasticsearch node left the cluster: fault detection, reallocation, and recovery

Diagnose and recover when an Elasticsearch node departs unexpectedly, including fault detection mechanics, delayed reallocation, and voting configuration cleanup.

Elasticsearch node OOM-killed: heap ceiling, page cache, and container limits

Diagnose and fix Elasticsearch nodes killed by the Linux OOM-killer due to heap, off-heap, page cache, and container memory limit pressure.

Elasticsearch this action would add too many shards: max_shards_per_node limit

Fix the Elasticsearch validation_exception when cluster.max_shards_per_node is breached. Why raising the limit is wrong and how to consolidate shards.

Elasticsearch unassigned shards: reading allocation explain and fixing each reason

Diagnose and resolve unassigned shards in Elasticsearch by reading the allocation explain API, interpreting unassigned.reason values, and applying targeted fixes per failure mode.

Fix Elasticsearch CircuitBreakingException Errors

Diagnose and resolve the Elasticsearch [parent] Data too large CircuitBreakingException. Covers real-memory tracking, heap consumers, task cancellation, and prevention.

Academy

Elasticsearch Yellow Cluster: Unassigned Shards Fix

A guide to resolving the common Elasticsearch yellow state by investigating shard allocation- understanding master election- and preventing data divergence

OpenSearch vs Elasticsearch Which One Is Better In 2025?

Making the right choice between the search giants depends on your priorities for licensing- performance- and cloud integration

Elasticsearch Monitoring

Learn everything about monitoring & troubleshooting Elasticsearch, what metrics are important to monitor and why, and how to monitor Elasticsearch with Netdata.

Resources

11 Best Elasticsearch Monitoring Tools Ranked (2026)

Compare the 11 best Elasticsearch monitoring tools for 2026: cluster health, JVM, thread pools, pricing shapes, and which tool actually fits your stack.