# Elastic crash, nodes timed out

**URL:** <https://discuss.elastic.co/t/elastic-crash-nodes-timed-out/363764>\
**Category:** Elasticsearch\
**Tags:** docker\
**Created:** [July 25, 2024, 7:42am UTC](https://discuss.elastic.co/t/elastic-crash-nodes-timed-out/363764 "2024-07-25T07:42:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![PustyB](https://avatars.discourse-cdn.com/v4/letter/p/c67d28/32.png) [@PustyB](https://discuss.elastic.co/u/PustyB)\
**Post date:** [July 25, 2024, 7:42am UTC](https://discuss.elastic.co/t/elastic-crash-nodes-timed-out/363764/1 "2024-07-25T07:42:09Z")

</div>

Hi. I have an elastic cluster on Kubernetes. Since yesterday I am facing the problem of kubernetes nodes stopping.  
3 nodes (64GB RAM)

The last logs it reads before crashing are:

```auto
{"@timestamp":"2024-07-25T05:44:12.428Z", "log.level": "WARN", "message":"nested repeat operator '?' and '*' was replaced with '*' in regular expression /(?:((?<SYSLOGTIMESTAMP:timestamp>(?:\\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|ä)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y|i)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\\b) +(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])) (?:(?!<[0-9])(?:(?:2[0123]|[01]?[0-9])):(?:(?:[0-5][0-9]))(?::(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))(?![0-9])))) ((?<WORD:nf_host>\\b\\w+\\b)) .*Shorewall:((?<WORD:nf_action1>\\b\\w+\\b))?:((?<WORD:nf_action2>\\b\\w+\\b))?.*IN=((?<USERNAME:nf_in_interface>[a-zA-Z0-9._-]+))?.*(OUT= *MAC=((?<COMMONMAC:nf_dst_mac>(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2}))):((?<COMMONMAC:nf_src_mac>(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})))?|OUT=(?<USERNAME:nf_out_interface>[a-zA-Z0-9._-]+)).*SRC=((?<IPV4:nf_src_ip>(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))).*DST=((?<IPV4:nf_dst_ip>(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))).*LEN=((?<WORD:nf_len>\\b\\w+\\b)).?*TOS=((?<WORD:nf_tos>\\b\\w+\\b)).?*PREC=((?<WORD:nf_prec>\\b\\w+\\b)).?*TTL=((?<INT:nf_ttl>(?:[+-]?(?:[0-9]+)))).?*ID=((?<INT:nf_id>(?:[+-]?(?:[0-9]+)))).?*PROTO=((?<WORD:nf_protocol>\\b\\w+\\b)).?*SPT=((?<INT:nf_src_port>(?:[+-]?(?:[0-9]+)))?.*DPT=(?<INT:nf_dst_port>(?:[+-]?(?:[0-9]+)))?.*))/", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"elasticsearch[my-cluster-es-default-1][transport_worker][T#10]","log.logger":"org.elasticsearch.xpack.textstructure.structurefinder.GrokPatternCreator","trace.id":"e9ecb4d6cf4de633da9a0bb3dc5c3b8d","elasticsearch.cluster.uuid":"Q6pqPh4ORYC21ggUvF5V8A","elasticsearch.node.id":"MZjT-4yGSjapW9MjLndj6w","elasticsearch.node.name":"my-cluster-es-default-1","elasticsearch.cluster.name":"my-cluster"}
{"@timestamp":"2024-07-25T05:44:12.430Z", "log.level": "WARN", "message":"nested repeat operator '?' and '*' was replaced with '*' in regular expression /(?:((?<SYSLOGTIMESTAMP:timestamp>(?:\\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|ä)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y|i)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\\b) +(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])) (?:(?!<[0-9])(?:(?:2[0123]|[01]?[0-9])):(?:(?:[0-5][0-9]))(?::(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))(?![0-9])))) ((?<WORD:nf_host>\\b\\w+\\b)) .*Shorewall:((?<WORD:nf_action1>\\b\\w+\\b))?:((?<WORD:nf_action2>\\b\\w+\\b))?.*IN=((?<USERNAME:nf_in_interface>[a-zA-Z0-9._-]+))?.*(OUT= *MAC=((?<COMMONMAC:nf_dst_mac>(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2}))):((?<COMMONMAC:nf_src_mac>(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})))?|OUT=(?<USERNAME:nf_out_interface>[a-zA-Z0-9._-]+)).*SRC=((?<IPV4:nf_src_ip>(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))).*DST=((?<IPV4:nf_dst_ip>(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))).*LEN=((?<WORD:nf_len>\\b\\w+\\b)).?*TOS=((?<WORD:nf_tos>\\b\\w+\\b)).?*PREC=((?<WORD:nf_prec>\\b\\w+\\b)).?*TTL=((?<INT:nf_ttl>(?:[+-]?(?:[0-9]+)))).?*ID=((?<INT:nf_id>(?:[+-]?(?:[0-9]+)))).?*PROTO=((?<WORD:nf_protocol>\\b\\w+\\b)).?*SPT=((?<INT:nf_src_port>(?:[+-]?(?:[0-9]+)))?.*DPT=(?<INT:nf_dst_port>(?:[+-]?(?:[0-9]+)))?.*))/", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"elasticsearch[my-cluster-es-default-1][transport_worker][T#10]","log.logger":"org.elasticsearch.xpack.textstructure.structurefinder.GrokPatternCreator","trace.id":"e9ecb4d6cf4de633da9a0bb3dc5c3b8d","elasticsearch.cluster.uuid":"Q6pqPh4ORYC21ggUvF5V8A","elasticsearch.node.id":"MZjT-4yGSjapW9MjLndj6w","elasticsearch.node.name":"my-cluster-es-default-1","elasticsearch.cluster.name":"my-cluster"}
{"@timestamp":"2024-07-25T05:44:12.430Z", "log.level": "WARN", "message":"nested repeat operator '?' and '*' was replaced with '*' in regular expression /(?:((?<SYSLOGTIMESTAMP:timestamp>(?:\\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|ä)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y|i)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\\b) +(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])) (?:(?!<[0-9])(?:(?:2[0123]|[01]?[0-9])):(?:(?:[0-5][0-9]))(?::(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))(?![0-9])))) ((?<WORD:nf_host>\\b\\w+\\b)) .*Shorewall:((?<WORD:nf_action1>\\b\\w+\\b))?:((?<WORD:nf_action2>\\b\\w+\\b))?.*IN=((?<USERNAME:nf_in_interface>[a-zA-Z0-9._-]+))?.*(OUT= *MAC=((?<COMMONMAC:nf_dst_mac>(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2}))):((?<COMMONMAC:nf_src_mac>(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})))?|OUT=(?<USERNAME:nf_out_interface>[a-zA-Z0-9._-]+)).*SRC=((?<IPV4:nf_src_ip>(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))).*DST=((?<IPV4:nf_dst_ip>(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))).*LEN=((?<WORD:nf_len>\\b\\w+\\b)).?*TOS=((?<WORD:nf_tos>\\b\\w+\\b)).?*PREC=((?<WORD:nf_prec>\\b\\w+\\b)).?*TTL=((?<INT:nf_ttl>(?:[+-]?(?:[0-9]+)))).?*ID=((?<INT:nf_id>(?:[+-]?(?:[0-9]+)))).?*PROTO=((?<WORD:nf_protocol>\\b\\w+\\b)).?*SPT=((?<INT:nf_src_port>(?:[+-]?(?:[0-9]+)))?.*DPT=(?<INT:nf_dst_port>(?:[+-]?(?:[0-9]+)))?.*))/", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"elasticsearch[my-cluster-es-default-1][transport_worker][T#10]","log.logger":"org.elasticsearch.xpack.textstructure.structurefinder.GrokPatternCreator","trace.id":"e9ecb4d6cf4de633da9a0bb3dc5c3b8d","elasticsearch.cluster.uuid":"Q6pqPh4ORYC21ggUvF5V8A","elasticsearch.node.id":"MZjT-4yGSjapW9MjLndj6w","elasticsearch.node.name":"my-cluster-es-default-1","elasticsearch.cluster.name":"my-cluster"}
{"@timestamp":"2024-07-25T05:44:12.431Z", "log.level": "WARN", "message":"nested repeat operator '?' and '*' was replaced with '*' in regular expression /(?:((?<SYSLOGTIMESTAMP:timestamp>(?:\\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|ä)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y|i)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\\b) +(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])) (?:(?!<[0-9])(?:(?:2[0123]|[01]?[0-9])):(?:(?:[0-5][0-9]))(?::(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))(?![0-9])))) ((?<WORD:nf_host>\\b\\w+\\b)) .*Shorewall:((?<WORD:nf_action1>\\b\\w+\\b))?:((?<WORD:nf_action2>\\b\\w+\\b))?.*IN=((?<USERNAME:nf_in_interface>[a-zA-Z0-9._-]+))?.*(OUT= *MAC=((?<COMMONMAC:nf_dst_mac>(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2}))):((?<COMMONMAC:nf_src_mac>(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})))?|OUT=(?<USERNAME:nf_out_interface>[a-zA-Z0-9._-]+)).*SRC=((?<IPV4:nf_src_ip>(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))).*DST=((?<IPV4:nf_dst_ip>(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))).*LEN=((?<WORD:nf_len>\\b\\w+\\b)).?*TOS=((?<WORD:nf_tos>\\b\\w+\\b)).?*PREC=((?<WORD:nf_prec>\\b\\w+\\b)).?*TTL=((?<INT:nf_ttl>(?:[+-]?(?:[0-9]+)))).?*ID=((?<INT:nf_id>(?:[+-]?(?:[0-9]+)))).?*PROTO=((?<WORD:nf_protocol>\\b\\w+\\b)).?*SPT=((?<INT:nf_src_port>(?:[+-]?(?:[0-9]+)))?.*DPT=(?<INT:nf_dst_port>(?:[+-]?(?:[0-9]+)))?.*))/", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"elasticsearch[my-cluster-es-default-1][transport_worker][T#10]","log.logger":"org.elasticsearch.xpack.textstructure.structurefinder.GrokPatternCreator","trace.id":"e9ecb4d6cf4de633da9a0bb3dc5c3b8d","elasticsearch.cluster.uuid":"Q6pqPh4ORYC21ggUvF5V8A","elasticsearch.node.id":"MZjT-4yGSjapW9MjLndj6w","elasticsearch.node.name":"my-cluster-es-default-1","elasticsearch.cluster.name":"my-cluster"}
{"@timestamp":"2024-07-25T05:44:12.431Z", "log.level": "WARN", "message":"nested repeat operator '?' and '*' was replaced with '*' in regular expression /(?:((?<SYSLOGTIMESTAMP:timestamp>(?:\\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|ä)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y|i)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\\b) +(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])) (?:(?!<[0-9])(?:(?:2[0123]|[01]?[0-9])):(?:(?:[0-5][0-9]))(?::(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))(?![0-9])))) ((?<WORD:nf_host>\\b\\w+\\b)) .*Shorewall:((?<WORD:nf_action1>\\b\\w+\\b))?:((?<WORD:nf_action2>\\b\\w+\\b))?.*IN=((?<USERNAME:nf_in_interface>[a-zA-Z0-9._-]+))?.*(OUT= *MAC=((?<COMMONMAC:nf_dst_mac>(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2}))):((?<COMMONMAC:nf_src_mac>(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})))?|OUT=(?<USERNAME:nf_out_interface>[a-zA-Z0-9._-]+)).*SRC=((?<IPV4:nf_src_ip>(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))).*DST=((?<IPV4:nf_dst_ip>(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))).*LEN=((?<WORD:nf_len>\\b\\w+\\b)).?*TOS=((?<WORD:nf_tos>\\b\\w+\\b)).?*PREC=((?<WORD:nf_prec>\\b\\w+\\b)).?*TTL=((?<INT:nf_ttl>(?:[+-]?(?:[0-9]+)))).?*ID=((?<INT:nf_id>(?:[+-]?(?:[0-9]+)))).?*PROTO=((?<WORD:nf_protocol>\\b\\w+\\b)).?*SPT=((?<INT:nf_src_port>(?:[+-]?(?:[0-9]+)))?.*DPT=(?<INT:nf_dst_port>(?:[+-]?(?:[0-9]+)))?.*))/", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"elasticsearch[my-cluster-es-default-1][transport_worker][T#10]","log.logger":"org.elasticsearch.xpack.textstructure.structurefinder.GrokPatternCreator","trace.id":"e9ecb4d6cf4de633da9a0bb3dc5c3b8d","elasticsearch.cluster.uuid":"Q6pqPh4ORYC21ggUvF5V8A","elasticsearch.node.id":"MZjT-4yGSjapW9MjLndj6w","elasticsearch.node.name":"my-cluster-es-default-1","elasticsearch.cluster.name":"my-cluster"}
{"@timestamp":"2024-07-25T05:44:12.432Z", "log.level": "WARN", "message":"nested repeat operator '?' and '*' was replaced with '*' in regular expression /(?:((?<SYSLOGTIMESTAMP:timestamp>(?:\\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|ä)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y|i)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\\b) +(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])) (?:(?!<[0-9])(?:(?:2[0123]|[01]?[0-9])):(?:(?:[0-5][0-9]))(?::(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))(?![0-9])))) ((?<WORD:nf_host>\\b\\w+\\b)) .*Shorewall:((?<WORD:nf_action1>\\b\\w+\\b))?:((?<WORD:nf_action2>\\b\\w+\\b))?.*IN=((?<USERNAME:nf_in_interface>[a-zA-Z0-9._-]+))?.*(OUT= *MAC=((?<COMMONMAC:nf_dst_mac>(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2}))):((?<COMMONMAC:nf_src_mac>(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})))?|OUT=(?<USERNAME:nf_out_interface>[a-zA-Z0-9._-]+)).*SRC=((?<IPV4:nf_src_ip>(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))).*DST=((?<IPV4:nf_dst_ip>(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))).*LEN=((?<WORD:nf_len>\\b\\w+\\b)).?*TOS=((?<WORD:nf_tos>\\b\\w+\\b)).?*PREC=((?<WORD:nf_prec>\\b\\w+\\b)).?*TTL=((?<INT:nf_ttl>(?:[+-]?(?:[0-9]+)))).?*ID=((?<INT:nf_id>(?:[+-]?(?:[0-9]+)))).?*PROTO=((?<WORD:nf_protocol>\\b\\w+\\b)).?*SPT=((?<INT:nf_src_port>(?:[+-]?(?:[0-9]+)))?.*DPT=(?<INT:nf_dst_port>(?:[+-]?(?:[0-9]+)))?.*))/", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"elasticsearch[my-cluster-es-default-1][transport_worker][T#10]","log.logger":"org.elasticsearch.xpack.textstructure.structurefinder.GrokPatternCreator","trace.id":"e9ecb4d6cf4de633da9a0bb3dc5c3b8d","elasticsearch.cluster.uuid":"Q6pqPh4ORYC21ggUvF5V8A","elasticsearch.node.id":"MZjT-4yGSjapW9MjLndj6w","elasticsearch.node.name":"my-cluster-es-default-1","elasticsearch.cluster.name":"my-cluster"}
{"timestamp": "2024-07-25T05:44:22+00:00", "message": "readiness probe failed", "curl_rc": "28"}
{"timestamp": "2024-07-25T05:44:34+00:00", "message": "readiness probe failed", "curl_rc": "28"}
{"timestamp": "2024-07-25T05:44:46+00:00", "message": "readiness probe failed", "curl_rc": "28"}
{"timestamp": "2024-07-25T05:44:56+00:00", "message": "readiness probe failed", "curl_rc": "28"}
{"timestamp": "2024-07-25T05:45:06+00:00", "message": "readiness probe failed", "curl_rc": "28"}
{"timestamp": "2024-07-25T05:45:17+00:00", "message": "readiness probe failed", "curl_rc": "28"}

```

Anyone know where I can look for the reason that the cluster stops responding/responding after a very long time?

---

<div class="post-metadata">

**Author:** ![PustyB](https://avatars.discourse-cdn.com/v4/letter/p/c67d28/32.png) [@PustyB](https://discuss.elastic.co/u/PustyB)\
**Post date:** [July 26, 2024, 10:34am UTC](https://discuss.elastic.co/t/elastic-crash-nodes-timed-out/363764/2 "2024-07-26T10:34:33Z")

</div>

Okay I consider the problem solved. It turned out that the problem was that I was uploading a corrupted file through File Data Visualizer and this was causing these errors and then a timeout on the node.