Troubleshooting

This section provides solutions to common questions and problems, and processing and performance guidance.

Common problems

This section describes common problems you might encounter.

No data is indexed

If no data shows up, first make sure that your APM components are properly connected.

Are the URL and API key correct?

Double check that the intake URL and API key are correct in your APM agent configuration. Reference the relevant APM agent documentation for details on how to set these configuration variables.

To create a new API key, see Create a new API key.

If you see requests coming through the managed intake service but they are not accepted (a response code other than 202), see managed intake service response codes to narrow down the possible causes.

Are there instrumentation gaps?

APM agents provide auto-instrumentation for many popular frameworks and libraries. If the APM agent is not auto-instrumenting something that you were expecting, data won't be sent to Elastic. Reference the relevant APM agent documentation for details on what is automatically instrumented.

Data is indexed but doesn't appear in the Applications UI

Elastic APM relies on default index mappings, data streams, and pipelines to query and display data. If your APM data isn't showing up in the Applications UI, but is elsewhere in Elastic, like Discover, you've likely made a change that overwrote a default. If you've manually changed a data stream, index template, or index pipeline, please verify you are not interfering with the default APM setup.

Field limit exceeded

When adding too many distinct tag keys on a transaction or span, you risk creating a mapping explosion.

For example, you should avoid that user-specified data, like URL parameters, is used as a tag key. Likewise, using the current timestamp or a user ID as a tag key is not a good idea. However, tag values with a high cardinality are not a problem. Just try to keep the number of distinct tag keys at a minimum.

The symptom of a mapping explosion is that transactions and spans are not indexed anymore after a certain time. Usually, on the next day, the spans and transactions will be indexed again because a new index is created each day. But as soon as the field limit is reached, indexing stops again.

Common response codes

HTTP 400: Data decoding error / Data validation error

The most likely cause for this error is using an incompatible version of an APM agent. See minimum supported APM agent versions to verify compatibility.

HTTP 400: Event too large

APM agents communicate with the Managed intake service by sending events in an HTTP request. Each event is sent as its own line in the HTTP request body. If events are too large, you can reduce the size of the events that your APM agents send by: enabling span compression or reducing collected stack trace information.

HTTP 401: Invalid token

The API key is invalid.

For additional help with other APM components, see the links below. Elastic Agent and each APM agent has its own troubleshooting guide:

Elastic Support

We offer a support experience unlike any other. Our team of professionals 'speak human and code' and love making your day. Learn more about subscriptions.

On this page

Article navigation