Failed to connect to Elasticsearch error
The error message 'Health check failed: Failed to connect to Elasticsearch' occurs when Grafana cannot establish a network connection to the Elasticsearch server. Solutions include: verifying the Elasticsearch URL is correct in the data source configuration, checking that Elasticsearch is running and accessible from the Grafana server, ensuring there are no firewall rules blocking the connection, verifying proxy settings if using a proxy, and for Grafana Cloud, configuring Private data source connect if the Elasticsearch instance is not publicly accessible.
Request timed out Elasticsearch error
The error message 'Health check failed: Elasticsearch data source is not healthy. Request timed out' occurs when the connection to Elasticsearch times out before receiving a response. Solutions include: checking network latency between Grafana and Elasticsearch, verifying that Elasticsearch is not overloaded or experiencing performance issues, increasing the timeout setting in the data source configuration if needed, and checking if network devices like load balancers or proxies are timing out the connection.
Unauthorized (401) Elasticsearch error
The error message 'Health check failed: Elasticsearch data source is not healthy. Status: 401 Unauthorized' occurs when authentication credentials are invalid or missing. Solutions include: verifying that the username and password are correct, ensuring the API key is valid and has not expired if using an API key, checking that the authentication method selected matches the Elasticsearch configuration, and verifying the user has the required permissions to access the Elasticsearch cluster.
Forbidden (403) Elasticsearch error
The error message 'Health check failed: Elasticsearch data source is not healthy. Status: 403 Forbidden' occurs when the authenticated user does not have permission to access the requested resource. Solutions include: verifying the user has read access to the specified index, checking Elasticsearch security settings and role mappings, ensuring the user has permission to access the _cluster/health endpoint, and if using AWS Elasticsearch Service with SigV4 authentication, verifying the IAM policy grants the required permissions.
Cluster status is red Elasticsearch error
The error message 'Health check failed: Elasticsearch data source is not healthy' with a red cluster status indicates one or more primary shards are not allocated. Solutions include: checking the Elasticsearch cluster health using GET /_cluster/health, reviewing Elasticsearch logs for errors, verifying all nodes in the cluster are running and connected, checking for unassigned shards using GET /_cat/shards?v&h=index,shard,prirep,state,unassigned.reason, and considering increasing the cluster's resources or reducing the number of shards.
Bad Gateway (502) Elasticsearch error
The error message 'Health check failed: Elasticsearch data source is not healthy. Status: 502 Bad Gateway' occurs when a proxy or load balancer between Grafana and Elasticsearch returns an error. Solutions include: checking the health of any proxies or load balancers in the connection path, verifying Elasticsearch is running and accepting connections, reviewing proxy or load balancer logs for more details, and ensuring the proxy timeout is configured appropriately for Elasticsearch requests.
Index not found error
The error message 'Error validating index: index_not_found' occurs when the specified index or index pattern does not match any existing indices. Solutions include: verifying the index name or pattern in the data source configuration, checking that the index exists using GET /_cat/indices, ensuring indices exist for the selected time range if using a time-based index pattern (for example, [logs-]YYYY.MM.DD), and verifying the user has permission to access the index.
Time field not found error
The error message 'Could not find time field '@timestamp' with type date in index' occurs when the specified time field does not exist in the index or is not of type date. Solutions include: verifying the time field name in the data source configuration matches the field in the index, checking the field mapping using GET /<index>/_mapping, ensuring the time field is mapped as a date type and not text or keyword, and if the field name is different (for example, timestamp instead of @timestamp), updating the data source configuration.
Too many buckets Elasticsearch error
The error message 'Trying to create too many buckets. Must be less than or equal to: [65536].' occurs when the query is generating more aggregation buckets than Elasticsearch allows. Solutions include: reducing the time range of the query, increasing the date histogram interval (for example, change from 10s to 1m), adding filters to reduce the number of documents being aggregated, and increasing the search.max_buckets setting in Elasticsearch (requires cluster admin access).
Required field missing Elasticsearch error
The error message 'Required one of fields [field, script], but none were specified.' occurs when a metric aggregation (such as Average, Sum, or Min) was added without specifying a field. Solutions include: selecting a field for the metric aggregation in the query editor and ensuring the selected field exists in the index and contains numeric data.
Unsupported interval error
The error message 'unsupported interval' occurs when the interval specified for the index pattern is not valid. Solutions include: using a supported interval (Hourly, Daily, Weekly, Monthly, or Yearly) and if a time-based index pattern is not needed, using No pattern and specifying the exact index name.
Unsupported Elasticsearch version
The error message 'Support for Elasticsearch versions after their end-of-life (currently versions < 7.16) was removed. Using unsupported version of Elasticsearch may lead to unexpected and incorrect results.' occurs when the Elasticsearch version is no longer supported by the Grafana data source. Solutions include: upgrading Elasticsearch to a supported version (7.17+, 8.x, or 9.x) and referencing Elastic Product End of Life Dates for version support information. Note that queries may still work, but Grafana does not guarantee functionality for unsupported versions.
Empty query results issue
Empty query results can be caused by the query returning no data. Solutions include: verifying the time range includes data in the index, checking the Lucene query syntax for errors, testing the query directly in Elasticsearch using the _search API, and ensuring the index contains documents matching the query filters.
Slow query performance issue
Slow query performance can occur when queries take a long time to execute. Solutions include: reducing the time range of the query, adding more specific filters to limit the data scanned, increasing the date histogram interval, checking Elasticsearch cluster performance and resource utilization, and considering using index aliases or data streams for better query routing.
CORS errors in browser console
Cross-Origin Resource Sharing (CORS) errors in the browser console block requests from the browser to Elasticsearch. Solutions include: using Server (proxy) access mode instead of Browser access mode in the data source configuration, and if Browser access is required, configuring CORS settings in Elasticsearch with http.cors.enabled set to true, http.cors.allow-origin set to the Grafana URL, http.cors.allow-headers set to 'Authorization, Content-Type', and http.cors.allow-credentials set to true. Server (proxy) access mode is recommended for security and reliability.