Level: Critical

Purpose: This alert informs that the MDC tracker cannot write to Elastic Search.

Scenario: Kibana and/or elastic search service has failed on the esk (elk stack) server, usually due to the error message “Data too large”.

Resolution: Check if kibana and elastic search service are running. Usually restarting elastic search, even if it's running, followed by kibana, will fix the issue.

Manual Action Steps:

sudo service elasticsearch restart
sudo service kibana restart

Auto Clear: This will auto-clear if the log line “Failed to write object due to ElasticSearch Status Exception” doesn't appear in the tracker logs for more than 30 minutes.