Briefly, this error occurs when Elasticsearch’s machine learning job fails, causing the associated datafeed to stop. This could be due to various reasons such as insufficient memory, incorrect job configuration, or network issues. To resolve this, you can try increasing the memory limit, checking the job configuration for any errors, or troubleshooting network connectivity. Additionally, check the Elasticsearch logs for more detailed error messages that can help pinpoint the exact cause of the job failure.
This guide will help you check for common problems that cause the log ” [{}] stopped associated datafeed [{}] after job failure ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: plugin, task.
Overview
A task is an Elasticsearch operation, which can be any request performed on an Elasticsearch cluster, such as a delete by query request, a search request and so on. Elasticsearch provides a dedicated Task API for the task management which includes various actions, from retrieving the status of current running tasks to canceling any long running task.
Examples
Get all currently running tasks on all nodes of the cluster
Apart from other information, the response of the below request contains task IDs of all the tasks which can be used to get detailed information about the particular task in question.
GET _tasks
Get detailed information of a particular task
Where clQFAL_VRrmnlRyPsu_p8A:1132678759 is the ID of the task in below request
GET _tasks/clQFAL_VRrmnlRyPsu_p8A:1132678759
Get all the current tasks running on particular nodes
GET _tasks?nodes=nodeId1,nodeId2
Cancel a task
Where clQFAL_VRrmnlRyPsu_p8A:1132678759 is the ID of the task in the below request
POST /_tasks/clQFAL_VRrmnlRyPsu_p8A:1132678759/_cancel?pretty
Notes
- The Task API will be most useful when you want to investigate the spike of resource utilization in the cluster or want to cancel an operation.
Log Context
Log “[{}] stopped associated datafeed [{}] after job failure” classname is OpenJobPersistentTasksExecutor.java.
We extracted the following from Elasticsearch source code for those seeking an in-depth context :
ML_ORIGIN;
StopDatafeedAction.INSTANCE;
request;
ActionListener.wrap(
// StopDatafeedAction will audit the stopping of the datafeed if it succeeds so we don't need to do that here
r -> logger.info("[{}] stopped associated datafeed [{}] after job failure"; jobId; runningDatafeedId);
e -> {
if (autodetectProcessManager.isNodeDying() == false) {
logger.error(
() -> format("[%s] failed to stop associated datafeed [%s] after job failure"; jobId; runningDatafeedId);
e
