Differences

This shows you the differences between two versions of the page.

--- resolution_area:watchdog_resolutions:res-w9239 [2022/03/02 08:39] – created 10.91.120.28
+++ resolution_area:watchdog_resolutions:res-w9239 [2022/11/08 14:25] (current) – 10.91.129.17
@@ Line 6: / Line 6: @@
 **Purpose:** This alert informs that the MDC tracker cannot write to Elastic Search.
-**Scenario:** Kibana and/or elastic search service has failed on the esk (elk stack) server, usually due to the error message "Data too large".
+**Scenario:** The tracker log contains the following: "Failed to write object due to ElasticSearch Status Exception". Check the reason in exception message.
-**Resolution:** Check if kibana and elastic search service are running. Usually restarting elastic search, even if it's running, followed by kibana, will fix the issue.
+  * "Data too large" -  Kibana and/or elastic search service has failed on the esk (elk stack) server
+  * "failed to parse field" - this indicates an error with agent parsing
+**Resolution:** Check if kibana and elastic search service are running. Usually restarting elastic search, even if it's running, followed by kibana, will fix the issue.
+If you get the parse field error you will need to track down the agent causing the issue; this is not as serious as the "Data too large" issue.
 **Manual Action Steps:**

Internal Errigal Collaboration Wiki