json Errors
23 error patterns
Elasticsearch index read-only due to disk watermark
elasticsearch.*cluster_block_exception.*index.*read-only.*allow_delete
- •Free disk space on Elasticsearch data nodes
- •Reset read-only flag: PUT /_settings {'index.blocks.read_only_allow_delete': null}
Logstash pipeline failed to index to Elasticsearch
logstash.*pipeline.*error.*could not index event to Elasticsearch
- •Check Elasticsearch cluster health and disk space
- •Verify mapping conflicts (field type mismatch)
Kibana cannot connect to Elasticsearch
kibana.*Unable to connect to Elasticsearch.*ECONNREFUSED
- •Verify Elasticsearch is running and healthy
- •Check elasticsearch.hosts in kibana.yml
Grafana panel query timeout
grafana.*panel.*error.*query timeout
- •Optimize the PromQL/SQL query for the panel
- •Increase query timeout in datasource settings
Elasticsearch field mapping parse failure
elasticsearch.*MapperParsingException.*failed to parse field
- •Check field value type matches the mapping type
- •Use dynamic templates to handle varying field types
Grafana provisioning invalid datasource type
grafana.*provisioning.*error.*invalid datasource.*type
- •Check datasource type matches an installed plugin
- •Install the required datasource plugin before provisioning
Elasticsearch circuit breaker tripped (data too large)
elasticsearch.*CircuitBreakingException.*parent.*data too large
- •Reduce query complexity or aggregation cardinality
- •Increase indices.breaker.total.limit (risky - may cause OOM)
Elasticsearch index not found
elasticsearch.*IndexNotFoundException.*no such index
- •Check index name and ensure it exists: GET _cat/indices
- •Use index alias that auto-creates with ILM rollover policy
Grafana alert stuck in NoData state
grafana.*alerting.*NoData.*state.*transition
- •Verify datasource is returning data for the alert query
- •Configure 'No Data' handling: set to Alerting or OK
DynamoDB provisioned throughput exceeded (hot partition)
DynamoDB.*ProvisionedThroughputExceededException
- •Enable auto-scaling or switch to on-demand capacity mode
- •Improve partition key design for better distribution
DynamoDB GSI doesn't project required attribute
DynamoDB.*ValidationException.*projected.*attribute.*not.*GSI
- •Add the attribute to GSI projection: INCLUDE or ALL
- •Query the base table for non-projected attributes
DynamoDB transaction cancelled due to condition failure
DynamoDB.*TransactionCanceledException.*ConditionalCheckFailed
- •Check condition expressions match current item state
- •Implement retry with fresh read before conditional write
DynamoDB item size limit exceeded (400KB)
DynamoDB.*ValidationException.*Item size.*exceeded.*maximum
- •Store large attributes in S3 and keep a reference in DynamoDB
- •Compress large attributes before storing
DynamoDB expression attribute values unused
DynamoDB.*ValidationException.*ExpressionAttributeValues.*contains unused
- •Remove unused :value placeholders from ExpressionAttributeValues
- •Verify all :value references are used in the expression
DynamoDB table not found
DynamoDB.*ResourceNotFoundException.*Cannot do operations on a non-existent table
- •Verify table name and region match exactly
- •Wait for table creation to complete: ACTIVE status
DynamoDB invalid KeyConditionExpression operator
DynamoDB.*ValidationException.*KeyConditionExpression.*only supports.*EQ.*begins_with
- •Sort key in KeyConditionExpression supports: =, <, >, <=, >=, BETWEEN, begins_with
- •Partition key only supports = operator in key conditions
DynamoDB request throttling
DynamoDB.*ThrottlingException.*Rate of requests exceeds the allowed throughput
- •Implement exponential backoff with jitter
- •Switch to on-demand capacity mode for unpredictable workloads
DynamoDB transaction multiple operations on same item
DynamoDB.*ValidationException.*Transaction request cannot include multiple operations on one item
- •Combine multiple operations into a single Update expression
- •Split into separate transactions if operations must be distinct
DynamoDB Query missing partition key in condition
DynamoDB.*ValidationException.*Query.*condition missed key schema element
- •Always provide partition key equality condition in Query
- •Use Scan with FilterExpression if partition key is unknown
DynamoDB Streams subscriber limit exceeded
DynamoDB.*LimitExceededException.*Subscriber limit exceeded
- •Reduce number of simultaneous stream consumers
- •Share a single Kinesis Data Streams consumer across multiple processors
DynamoDB conditional check expression failed
DynamoDB.*ConditionalCheckFailedException
- •Verify current item state matches condition expression
- •Implement optimistic locking pattern with version attribute
DynamoDB number overflow (38 digits max)
DynamoDB.*ValidationException.*Number overflow
- •DynamoDB numbers support up to 38 significant digits
- •Store very large numbers as strings if precision is needed
DynamoDB expression attribute name invalid character
DynamoDB.*ValidationException.*ExpressionAttributeNames.*contains invalid.*character
- •Use # prefix for attribute name placeholders: #name
- •Only alphanumeric and underscore allowed in placeholder names