Failure to AES wrap the DEK ” + dekId + ” – How to solve this Elasticsearch error

Opster Team

March-22, Version: 1.7-8.0

Before you begin reading this guide, we recommend you try running the Elasticsearch Error Check-Up which analyzes 2 JSON files to detect many configuration errors.

To easily locate the root cause and resolve this issue try AutoOps for Elasticsearch & OpenSearch. It diagnoses problems by analyzing hundreds of metrics collected by a lightweight agent and offers guidance for resolving them.

This guide will help you check for common problems that cause the log ” Failure to AES wrap the DEK ” + dekId + ” ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: repositories, plugin.

Log Context

Log “Failure to AES wrap the DEK [” + dekId + “]”classname  is We extracted the following from Elasticsearch source code for those seeking an in-depth context :

 } catch (GeneralSecurityException e) {
 // throw unchecked ElasticsearchException; IOExceptions are interpreted differently and can move the repository in the
 // corrupted state
 throw new RepositoryException(repositoryName; "Failure to AES wrap the DEK [" + dekId + "]"; e);
 logger.trace("Repository [{}] successfully wrapped DEK [{}]"; repositoryName; dekId);
 dekBlobContainer.writeBlobAtomic(kek.v1(); new BytesArray(encryptedDEKBytes); true);
 logger.debug("Repository [{}] successfully stored DEK [{}] under path {} {}"; repositoryName; dekId; dekBlobPath; kek.v1());


Watch product tour

Try AutoOps to find & fix Elasticsearch problems

Analyze Your Cluster
Skip to content