Before you begin reading this guide, we recommend you run Elasticsearch Error Check-Up which analyzes 2 JSON files to detect many errors.
Briefly, this error message indicates that a connection is being closed. The reason for this could be due to a deliberate action or a problem with the Elasticsearch instance. To resolve the issue, the reason for the connection being closed should be determined and addressed accordingly.
To easily locate the root cause and resolve this issue try AutoOps for Elasticsearch & OpenSearch. It diagnoses problems by analyzing hundreds of metrics collected by a lightweight agent and offers guidance for resolving them.
This guide will help you check for common problems that cause the log ” closing connection ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: version.
Overview
A version corresponds to the Elasticsearch built-in tracking system that tracks the changes in each document’s update. When a document is indexed for the first time, it is assigned a version 1 using _version key. When the same document gets a subsequent update, the _version is incremented by 1 with every index, update or delete API call.
What it is used for
A version is used to handle the concurrency issues in Elasticsearch which come into play during simultaneous accessing of an index by multiple users. Elasticsearch handles this issue with an optimistic locking concept using the _version parameter to avoid letting multiple users edit the same document at the same time and protects users from generating incorrect data.
Notes
You cannot see the history of the document using _version. That means Elasticsearch does not use _version to keep a track of original changes that had been performed on the document. For example, if a document has been updated 10 times, it’s _version would be marked by Elasticsearch as 11, but you cannot go back and see what version 5 of the document looked like. This has to be implemented independently.
Common problems
If optimistic locking is not implemented while making updates to a document, Elasticsearch may return a conflict error with the 409 status code, which means that multiple users are trying to update the same version of the document at the same time.
POST /ratings/123?version=50
{
"name": "Joker",
"rating": 50
}
Log Context
Log “{}; [{}]; closing connection” classname is TcpTransport.java.
We extracted the following from Elasticsearch source code for those seeking an in-depth context :
if (channel.isOpen()) {
BytesArray message = new BytesArray(e.getMessage().getBytes(StandardCharsets.UTF_8));
outboundHandler.sendBytes(channel; message; ActionListener.wrap(() -> CloseableChannel.closeChannel(channel)));
}
} else if (e instanceof StreamCorruptedException) {
logger.warn(() -> new ParameterizedMessage("{}; [{}]; closing connection"; e.getMessage(); channel));
CloseableChannel.closeChannel(channel);
} else {
logger.warn(() -> new ParameterizedMessage("exception caught on transport layer [{}]; closing connection"; channel); e);
// close the channel; which will cause a node to be disconnected if relevant
CloseableChannel.closeChannel(channel);
