Error log "Couldn't index event to elastic"

Elastic Stack Logstash
1

Hi there,

I want to confirm, if I got "Could not index event to elasticsearch" error, will it be retried if the reason that log has been resolved? I got this error and the reason shows me it caused by "Limit total fields" I've been increased the field limit but the log that rejected before didn't show up at all after I increased the field limit

Thanks

2

No, they will not be retried.

This error has a 400 response from Elasticsearch, and according to the retry policy a 400 and 404 response will send the event to the DLQ, if enabled, and drop it.

If you do not have DLQ enabled the event is just dropped.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.