# Filebeats is failing to perform the bulk index
**URL:** https://discuss.elastic.co/t/filebeats-is-failing-to-perform-the-bulk-index/70298
**Category:** Beats
**Tags:** filebeat
**Created:** [December 30, 2016, 8:23pm UTC](https://discuss.elastic.co/t/filebeats-is-failing-to-perform-the-bulk-index/70298 "2016-12-30T20:23:03Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@dubul](https://discuss.elastic.co/u/dubul)
#### Post date: [December 30, 2016, 8:23pm UTC](https://discuss.elastic.co/t/filebeats-is-failing-to-perform-the-bulk-index/70298/1 "2016-12-30T20:23:03Z")
File beat error:
ERR Failed to perform any bulk index operations: Post [http://dt1es01p02:9200/\_bulk:](http://dt1es01p02:9200/_bulk:) net/http: request canceled (Client.Timeout exceeded while awaiting headers)
Elastic search log:
[DEBUG][action.admin.indices.create] [dt1es01p02] [bit-logs-2016.12.30] failed to create
ProcessClusterEventTimeoutException[failed to process cluster event (create-index [bit-logs-2016.12.30], cause [auto(bulk api)]) within 1m]
at org.elasticsearch.cluster.service.InternalClusterService$2$1.run(InternalClusterService.java:349)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
I'm not sure about this error, Is this something I need to change the config file in elasticsearch or filebeat.yaml?
How could I fix this issue? I've tried changing the bulk index,timeout, flush interval but no use
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [January 3, 2017, 10:01am UTC](https://discuss.elastic.co/t/filebeats-is-failing-to-perform-the-bulk-index/70298/2 "2017-01-03T10:01:26Z")
It seems like the index request takes too much time. Is your elasticsearch instance under heavy load? How many log events do you try to push per second?
---
### Author:  [@dubul](https://discuss.elastic.co/u/dubul)
#### Post date: [January 5, 2017, 10:27pm UTC](https://discuss.elastic.co/t/filebeats-is-failing-to-perform-the-bulk-index/70298/3 "2017-01-05T22:27:30Z")
@ruflin how to manage the filebeat to send this many logevents per second? Is there any config I need to make change. Now filebeat.yaml and elasticsearch.yaml is working with default settings
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [January 6, 2017, 3:21pm UTC](https://discuss.elastic.co/t/filebeats-is-failing-to-perform-the-bulk-index/70298/4 "2017-01-06T15:21:00Z")
First you should share some more information about your setup. What does your ES cluster look like? How many log lines do you have per second? General memory / CPU? ...
---
### Author:  [@dubul](https://discuss.elastic.co/u/dubul)
#### Post date: [January 8, 2017, 1:53am UTC](https://discuss.elastic.co/t/filebeats-is-failing-to-perform-the-bulk-index/70298/5 "2017-01-08T01:53:37Z")
I have 3 elastic search servers with 8GB ram and 2 CPUs each.
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [January 9, 2017, 6:15pm UTC](https://discuss.elastic.co/t/filebeats-is-failing-to-perform-the-bulk-index/70298/6 "2017-01-09T18:15:59Z")
Can you share the number of log events you have per second and perhaps the size of each event?
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [January 9, 2017, 7:22pm UTC](https://discuss.elastic.co/t/filebeats-is-failing-to-perform-the-bulk-index/70298/7 "2017-01-09T19:22:44Z")
Reading the elasticsearch logs, it looks like the issue is with elasticsearch itself, due to creating an index takes longer then 1m.
If problem is with elasticsearch, changing filebeat.yml won't help. Have you tried to create an index via curl?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 6, 2017, 7:22pm UTC](https://discuss.elastic.co/t/filebeats-is-failing-to-perform-the-bulk-index/70298/8 "2017-02-06T19:22:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.