# :message=\>"Failed action. ", :status=\>404, :action=\>\["index", **URL:** \ **Category:** Logstash\ **Created:** [December 9, 2015, 6:06pm UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780 "2015-12-09T18:06:31Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![thomas.dotreppe](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@thomas.dotreppe](https://discuss.elastic.co/u/thomas.dotreppe)\ **Post date:** [December 9, 2015, 6:06pm UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/1 "2015-12-09T18:06:31Z")
I receive very long log entries with issues such as these (this one is truncated) every few seconds in the logs: ```auto {:timestamp=>"2015-12-09T10:51:52.061000-0700", :message=>"Failed action. ", :status=>404, :action=>["index", {:_id=>nil, :_index=>"logstash-2015.12.09", :_type=>"fortinet", ``` It happens with LS 2.1.1 and ES 2.1 (or 1.7.3). However my output configuration is much simpler: ```auto output { if [type] != 'heartbeat' { elasticsearch { hosts => ["localhost:9200"] } } } ``` Using the Official Java 8: ```auto java version "1.8.0_66" Java(TM) SE Runtime Environment (build 1.8.0_66-b17) Java HotSpot(TM) 64-Bit Server VM (build 25.66-b17, mixed mode) ``` Checking for indices with `curl 'localhost:9200/_cat/indices?v'` works just fine and returns me the complete list. I found a topic with a similar message ([Logstash "doc\_as\_upsert" --\> Error 404](https://discuss.elastic.co/t/logstash-doc-as-upsert-error-404/36146)) however, the 'action' is different. I'm not using shield and ES is only listening on localhost (LS is on the same system). What could be the cause of the issue and how should I fix it? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 10, 2015, 3:36am UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/2 "2015-12-10T03:36:43Z")
Can you post the entire error? ---
**Author:** ![thomas.dotreppe](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@thomas.dotreppe](https://discuss.elastic.co/u/thomas.dotreppe)\ **Post date:** [December 10, 2015, 4:58pm UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/3 "2015-12-10T16:58:55Z")
It just contains a bunch of events/log entries (you can see the beginning of them at the end of the truncated message). I don't think it would be that useful. Let me know if I'm wrong. ---
**Author:** ![thomas.dotreppe](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@thomas.dotreppe](https://discuss.elastic.co/u/thomas.dotreppe)\ **Post date:** [December 14, 2015, 11:19pm UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/4 "2015-12-14T23:19:45Z")
There you go: [https://gist.github.com/ThomasdOtreppe/24ca591ac6d3b478a093](https://gist.github.com/ThomasdOtreppe/24ca591ac6d3b478a093) Does it help? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 14, 2015, 11:58pm UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/5 "2015-12-14T23:58:35Z")
Was there a corresponding error in ES at the same time? ---
**Author:** ![thomas.dotreppe](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@thomas.dotreppe](https://discuss.elastic.co/u/thomas.dotreppe)\ **Post date:** [December 15, 2015, 12:16am UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/6 "2015-12-15T00:16:21Z")
There is nothing around that time. The closest I can find is probably 20 seconds before or at least 40 seconds later and I don't think it's related: ```auto [2015-12-09 14:54:01,154][DEBUG][action.bulk] [Dark-Crawler] observer: timeout notification from cluster service. timeout setting [1m], time since start [1m] ``` ---
**Author:** ![thomas.dotreppe](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@thomas.dotreppe](https://discuss.elastic.co/u/thomas.dotreppe)\ **Post date:** [December 16, 2015, 5:45pm UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/7 "2015-12-16T17:45:38Z")
Anything else I should check? ---
**Author:** ![vtst2412](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vtst2412/32/6228_2.png) [@vtst2412](https://discuss.elastic.co/u/vtst2412)\ **Post date:** [December 16, 2015, 6:04pm UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/8 "2015-12-16T18:04:14Z")
According to the response, your ES instance might be choking up on the bulk indexing request: > response=\>{"create"=\>{"\_index"=\>"logstash-2015.12.09", "\_type"=\>"sophos", "\_id"=\>"AVGKPGYwuOQZauVwWJy6", "status"=\>404, "error"=\>"EngineClosedException[[logstash-2015.12.09][3] CurrentState[CLOSED] ]"} Looks like a warning though, I wouldn't worry about it. How much heap space are you allocating to ES? ---
**Author:** ![thomas.dotreppe](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@thomas.dotreppe](https://discuss.elastic.co/u/thomas.dotreppe)\ **Post date:** [December 16, 2015, 6:15pm UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/9 "2015-12-16T18:15:23Z")
on that one, the default value, so probably 2g. ---
**Author:** ![vtst2412](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vtst2412/32/6228_2.png) [@vtst2412](https://discuss.elastic.co/u/vtst2412)\ **Post date:** [December 16, 2015, 6:30pm UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/10 "2015-12-16T18:30:28Z")
According to the comment in the source code, this happens when a request is in-bound while the shard is closing. For more high level root cause, we will probably need the logs from ES side. ---
**Author:** ![thomas.dotreppe](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@thomas.dotreppe](https://discuss.elastic.co/u/thomas.dotreppe)\ **Post date:** [December 16, 2015, 6:42pm UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/11 "2015-12-16T18:42:27Z")
Weird, it didn't seem it was closing when I looked at the log, I only could see those: ```auto [2015-12-09 14:54:01,154][DEBUG][action.bulk] [Dark-Crawler] observer: timeout notification from cluster service. timeout setting [1m], time since start [1m] ``` ---
**Author:** ![thomas.dotreppe](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@thomas.dotreppe](https://discuss.elastic.co/u/thomas.dotreppe)\ **Post date:** [December 21, 2015, 9:04pm UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/12 "2015-12-21T21:04:11Z")
Any objection about opening a bug report about this? Anything else I should check? ---
**Author:** ![thomas.dotreppe](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@thomas.dotreppe](https://discuss.elastic.co/u/thomas.dotreppe)\ **Post date:** [December 30, 2015, 12:28am UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/13 "2015-12-30T00:28:16Z")
Anywhere else I can look? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:17am UTC](https://discuss.elastic.co/t/message-failed-action-status-404-action-index/36780/14 "2017-07-06T05:17:10Z")