# Failed to start transform **URL:** \ **Category:** Elasticsearch\ **Tags:** transforms\ **Created:** [August 25, 2020, 11:38am UTC](https://discuss.elastic.co/t/failed-to-start-transform/246273 "2020-08-25T11:38:33Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![liorg2](https://avatars.discourse-cdn.com/v4/letter/l/ed8c4c/32.png) [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Post date:** [August 25, 2020, 11:38am UTC](https://discuss.elastic.co/t/failed-to-start-transform/246273/1 "2020-08-25T11:38:33Z")
Hi I'm trying to start a transform but keep getting errors and turns the cluster's state into red (sooooo... frustrating ) last message on Kinana is "Created transform." Any help will be appreciated (removing the painless script doesnt help) ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/7/472295e1d0fde6b5474a9134d48885e520d88894.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/f/9f8b0b7ce9fdd7ce566f8c7ba7df5e8432e17320.png) ``` PUT _transform/daily { "source": { "index": [ "metrics-*" ], "query": { "bool": { "must": [ { "range": { "datetime": { "gte": "now-3d" } } }, { "exists": { "field": "value" } } ] } } }, "settings":{ "docs_per_second":500 }, "pivot": { "group_by": { "clientname": { "terms": { "script": { "source": "if (doc.containsKey('clientname.keyword')) { return doc['clientname.keyword'].value} else { return doc['clientname'].value}" } } }, "servername": { "terms": { "field": "servername" } }, "category": { "terms": { "field": "category" } }, "counter": { "terms": { "field": "counter" } }, "instance": { "terms": { "field": "instance" } }, "datetime": { "date_histogram": { "field": "datetime", "calendar_interval": "1d" } } }, "aggregations": { "clientid": { "max": { "field": "clientid" } }, "avg_value": { "avg": { "field": "value" } }, "percentiles_value": { "percentiles": { "field": "value", "percents": [ 4, 11, 90, 97 ] } }, "min_value": { "min": { "field": "value" } }, "max_value": { "max": { "field": "value" } } } }, "dest": { "index": "daily" }, "frequency": "1h", "sync": { "time": { "field": "datetime", "delay": "1h" } } } ``` ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [August 25, 2020, 11:06pm UTC](https://discuss.elastic.co/t/failed-to-start-transform/246273/2 "2020-08-25T23:06:30Z")
Why not use support instead of posting here? You are a cloud customer so you have support access... ---
**Author:** ![liorg2](https://avatars.discourse-cdn.com/v4/letter/l/ed8c4c/32.png) [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Post date:** [August 26, 2020, 6:08am UTC](https://discuss.elastic.co/t/failed-to-start-transform/246273/3 "2020-08-26T06:08:56Z")
Hi @richcollier I'm a standard customer in the cloud, and usually they only send links to documentation but i'll try. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 26, 2020, 6:18am UTC](https://discuss.elastic.co/t/failed-to-start-transform/246273/4 "2020-08-26T06:18:28Z")
Is there anything in the Elasticsearch logs? ---
**Author:** ![liorg2](https://avatars.discourse-cdn.com/v4/letter/l/ed8c4c/32.png) [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Post date:** [August 26, 2020, 9:22am UTC](https://discuss.elastic.co/t/failed-to-start-transform/246273/5 "2020-08-26T09:22:38Z")
@warkolm I think I've found the problem. 1 of 85 indices, that the transform was referring to, had a wrong mapping- text instead of keyword. I still don't understand why it kills the cluster, and causing 200+ unassigned shards. from the logs: (nothing more meaningful ) `[instance-0000000072] Not starting transform [daily], because not all primary shards are active for the following indices [.transform-internal-005,.transform-internal-004,.transform-internal-003]` ---
**Author:** ![liorg2](https://avatars.discourse-cdn.com/v4/letter/l/ed8c4c/32.png) [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Post date:** [August 27, 2020, 8:05am UTC](https://discuss.elastic.co/t/failed-to-start-transform/246273/6 "2020-08-27T08:05:02Z")
ok there is something in the logs ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/a/ea71de68f3afb512ab91efb4cc602e6e0431e6c2.png) The bottom log is when the transform starts then elastic update replicas to 0 and to 1 then it cannot start the transform as the cluster became red state ---
**Author:** ![sophie\_chang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sophie_chang/32/18008_2.png) [@sophie\_chang](https://discuss.elastic.co/u/sophie_chang)\ **Post date:** [August 27, 2020, 8:54am UTC](https://discuss.elastic.co/t/failed-to-start-transform/246273/7 "2020-08-27T08:54:01Z")
HI @liorg2 The indices have `"auto_expand_replicas" : "0-1",` so that fact they are jumping from zero and 1 replicas implies that an additional node has appeared. It seems unlikely to me that you added additional nodes at the exact same time as you were starting transforms. I cannot comment on the cause of this, but it feels unlikely that a `PUT transform` action could achieve this. Your screenshot shows there are no transforms running, so this statement isn't moving any data around yet. However if you've seen earlier logging and it is repeatable then it could be a trigger and requires investigation. The issue you are seeing implies an instability in your cloud environment and could be related to its configuration. I would recommend you seek help from our cloud support specialists. They have more experience and tooling relevant for this issue. Best wishes Sophie ---
**Author:** ![liorg2](https://avatars.discourse-cdn.com/v4/letter/l/ed8c4c/32.png) [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Post date:** [August 27, 2020, 8:56am UTC](https://discuss.elastic.co/t/failed-to-start-transform/246273/8 "2020-08-27T08:56:53Z")
its actually the POST \_transform/.../start thanks @sophie_chang very appreciated ---
**Author:** ![liorg2](https://avatars.discourse-cdn.com/v4/letter/l/ed8c4c/32.png) [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Post date:** [September 1, 2020, 10:24am UTC](https://discuss.elastic.co/t/failed-to-start-transform/246273/9 "2020-09-01T10:24:09Z")
Apparently this is a bug in elasticsearch that will be fixed in the next minor version 🤕 IMHO I think that transform became a very critical resource in elastic, and bugs in it should be fixed immediately > > > Affected versions: 7.7 - 7.9 > Continuous transform minimize the amount of updates by querying only changed buckets, the logic uses a combination... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 29, 2020, 10:24am UTC](https://discuss.elastic.co/t/failed-to-start-transform/246273/10 "2020-09-29T10:24:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.