This example error may return from Elasticsearch to any ingestor (e.g. Logstash, Bulk, API, Beats, etc):
[{TIMESTAMP}][WARN][logstash.outputs.elasticsearch][x][y] Could not index event to Elasticsearch. {
:status=> 400,
:action=> [ "index", {
:_id=> "z",
:_index=> "x",
:routing=> nil,
:_type=> "_doc"
}, #<LogStash::Event:#>],
:response=>{
"index"=> {
"_index"=> "x",
"_type"=> "_doc",
"_id"=> "z",
"status"=> 400,
"error"=> {
"type"=> "illegal_argument_exception",
- "reason"=> "Validation Failed: 1: this action would add [#] shards, but this cluster currently has [####]/[####] maximum normal shards open;" }}}}