# Diagnosing an Elasticsearch field mapping explosion incident

DevFeed: [Diagnosing an Elasticsearch field mapping explosion incident](<https://devfeed.tech/articles/elasticwars-episode-iv-a-new-field-27993.md>)

Original publisher: [Read original article](<https://tech.trivago.com/post/2020-06-03-elasticwarsepisodeivanewfield/>)

Author: Jorge Luis Betancourt Follow

Published: 2020-06-03T00:00:00Z

Content type: article

Language: en

Sources: [Trivago](<https://devfeed.tech/sources/trivago.md>)

Topics: [elasticsearch](<https://devfeed.tech/topics/elasticsearch.md>), [incident](<https://devfeed.tech/topics/incident.md>), [logstash](<https://devfeed.tech/topics/logstash.md>), [Kafka](<https://devfeed.tech/topics/kafka.md>), [Monitoring](<https://devfeed.tech/topics/monitoring.md>), [Grafana](<https://devfeed.tech/topics/grafana.md>), [SIEM, Security, Observability](<https://devfeed.tech/topics/siem-security-observability.md>)

Tags: [backend](<https://devfeed.tech/tags/backend.md>), [dashboards](<https://devfeed.tech/tags/dashboards.md>), [devops](<https://devfeed.tech/tags/devops.md>), [elasticsearch](<https://devfeed.tech/tags/elasticsearch.md>), [incident](<https://devfeed.tech/tags/incident.md>), [kafka](<https://devfeed.tech/tags/kafka.md>), [logs](<https://devfeed.tech/tags/logs.md>), [logstash](<https://devfeed.tech/tags/logstash.md>), [monitoring](<https://devfeed.tech/tags/monitoring.md>)

## AI overview

The article describes a production incident in which Logstash consumers fell behind, Elasticsearch ingestion stopped, and client nodes experienced memory pressure and long garbage-collection cycles. Monitoring showed rejected writes, saturated write threads, and queued operations, leading the team to identify a field mapping explosion as the underlying issue.

## Source excerpt

On a normal day, we ingest a lot of data into our ELK clusters (~6TB across all of our data centers). This is mostly operational data (logs) from different components in our infrastructure. This...