Troubleshooting
editTroubleshooting
edit[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
This section provides solutions to common questions and problems, and processing and performance guidance.
Common problems
editThis section describes common problems you might encounter.
No data is indexed
editIf no data shows up, first make sure that your APM components are properly connected.
Are the URL and API key correct?
Double check that the intake URL and API key are correct in your APM agent configuration. Reference the relevant APM agent documentation for details on how to set these configuration variables.
To create a new API key, see Create a new API key.
If you see requests coming through the managed intake service but they are not accepted (a response code other than 202
),
see managed intake service response codes to narrow down the possible causes.
Are there instrumentation gaps?
APM agents provide auto-instrumentation for many popular frameworks and libraries. If the APM agent is not auto-instrumenting something that you were expecting, data won’t be sent to Elastic. Reference the relevant APM agent documentation for details on what is automatically instrumented.
Data is indexed but doesn’t appear in the Applications UI
editElastic APM relies on default index mappings, data streams, and pipelines to query and display data. If your APM data isn’t showing up in the Applications UI, but is elsewhere in Elastic, like Discover, you’ve likely made a change that overwrote a default. If you’ve manually changed a data stream, index template, or index pipeline, please verify you are not interfering with the default APM setup.
Field limit exceeded
editWhen adding too many distinct tag keys on a transaction or span, you risk creating a mapping explosion.
For example, you should avoid that user-specified data, like URL parameters, is used as a tag key. Likewise, using the current timestamp or a user ID as a tag key is not a good idea. However, tag values with a high cardinality are not a problem. Just try to keep the number of distinct tag keys at a minimum.
The symptom of a mapping explosion is that transactions and spans are not indexed anymore after a certain time. Usually, on the next day, the spans and transactions will be indexed again because a new index is created each day. But as soon as the field limit is reached, indexing stops again.
Common response codes
editHTTP 400: Data decoding error / Data validation error
editThe most likely cause for this error is using an incompatible version of an APM agent. See minimum supported APM agent versions to verify compatibility.
HTTP 400: Event too large
editAPM agents communicate with the Managed intake service by sending events in an HTTP request. Each event is sent as its own line in the HTTP request body. If events are too large, you can reduce the size of the events that your APM agents send by: enabling span compression or reducing collected stack trace information.
HTTP 401: Invalid token
editThe API key is invalid.
Related troubleshooting resources
editFor additional help with other APM components, see the links below. Elastic Agent and each APM agent has its own troubleshooting guide:
Elastic Support
editWe offer a support experience unlike any other. Our team of professionals speak human and code and love making your day. Learn more about subscriptions.