Elasticsearch Rejected Search Requests in OpenSearch – Causes and Solutions

By Opster Team

Updated: Apr 11, 2023

| 1 min read

In addition to reading this guide, we recommend you run the Elasticsearch Health Check-Up. It will detect issues and improve your Elasticsearch performance by analyzing your shard sizes, threadpools, memory, snapshots, disk watermarks and more.

The Elasticsearch Check-Up is free and requires no installation.

Before you begin reading this guide, we recommend you try running the OpenSearch Error Check-Up which analyzes 2 JSON files to detect many configuration errors.

To improve your search requests in OpenSearch, we recommend you  try AutoOps for OpenSearch. It diagnoses problems in your deployment by analyzing hundreds of metrics collected by a lightweight agent and offers guidance for resolving them.

Rejected Search Requests

There are a number of reasons why a search request can be rejected by the cluster. These reasons generally break down into 2 main groups: 

  1. Performance / workload related issues
  2. Mapping or syntax related issues

Performance / workload related issues

These are some of the issues that could cause search requests to be rejected:

  • 403 Request throttled due to too many requests
  • 400 Circuit Breaker Errors
  • 400 Queue Full Errors

As a general rule, you should look at monitoring data to find out why the OpenSearch cluster is unable to keep up with the current workload. Bear in mind that the root cause of these errors may be something completely different from the specific request that was sent.  

In this case, it may be possible to simply re-try the command at a later time when the cluster is not so busy.

How to fix it

For request throttled errors, see: https://opster.com/guides/opensearch/opensearch-basics/high-cpu/

For circuit breaker errors, see: https://opster.com/guides/opensearch/opensearch-basics/opensearch-circuit-breakers/

For queue rejection errors see:

Mapping or syntax related issues

One of the issues that could cause search requests to be rejected is:

  • 400 Parsing Exception

This issue occurs due to the specific request being sent, and is not retryable.

How to fix it

This is usually the result of incorrect structure or terminology in your query. In particular you should check which version of OpenSearch you are using and check whether the query syntax is correct for that version.

How helpful was this guide?

We are sorry that this post was not useful for you!

Let us improve this post!

Tell us how we can improve this post?

Analyze your cluster & get personalized recommendations

Skip to content