ES 7.11 How to debug search_failures for rollup jobs

Elastic Stack Elasticsearch
1

My new rollup job is showing search_failures and not indexing anything. Where can I go to see the details as to why the search failures are occuring?

I looked at the rollup job details and the capabilities but there are only high level information:

      "stats" : {
        "pages_processed" : 0,
        "documents_processed" : 0,
        "rollups_indexed" : 0,
        "trigger_count" : 177,
        "index_time_in_ms" : 0,
        "index_total" : 0,
        "index_failures" : 0,
        "search_time_in_ms" : 0,
        "search_total" : 0,
        "search_failures" : 176,
        "processing_time_in_ms" : 0,
        "processing_total" : 0
      }
2

After some playing around and tweaking the job definition, it turned out that the job was failing because the page_size was too large causing the search query to fail.

But it would be good to have some feedback when checking the status because manual debugging and tweaking took some time.

I also noticed that the rollup job just keeps going even when there is a bulk execution failure which is not ideal in my case as it means documents are skipped. In my case, the bulk failure was due to the below template mapping which I will fix but it would be good if we can configure the rollup job to fail if there is any bulk failures so that there is no data loss:

org.elasticsearch.index.mapper.MapperParsingException: Could not dynamically add mapping for field [@timestamp.date_histogram._count]. Existing mapping for [@timestamp] must be of type object but found [date].

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.