troubleshoot-elasticsearch

Diagnose Elasticsearch failure archetypes using Netdata MCP health signals.

1|Updated Apr 17, 2026
One-click install
npx skills add https://github.com/netdata/skills --skill troubleshoot-elasticsearch
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: troubleshoot-elasticsearch
Source: https://github.com/netdata/skills/tree/main/skills/troubleshoot-elasticsearch
Command: npx skills add https://github.com/netdata/skills --skill troubleshoot-elasticsearch

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Elasticsearch incidents often cascade from specific resource or configuration failure archetypes, but generic checks miss the true cause and lead to slow, incorrect remediation.

Core Features & Use Cases

  • Structured triage for Elasticsearch failure archetypes: Covers heap pressure death spirals, shard overallocation, disk watermark cascades, mapping explosions, merge storms, and master instability.
  • Netdata + MCP signal-driven diagnosis: Queries Netdata via MCP for Elasticsearch health signals and follows the Netdata operator playbook diagnostic tree.
  • Remediation validation: Re-runs the same MCP verification queries to confirm signals return to expected ranges and flags when the fix does not hold.

Use case: an on-call engineer is paged by a Netdata alert for a specific Elasticsearch node and needs a reliable, step-by-step path to determine whether the incident is driven by heap pressure, shard bloat, disk watermarks, mapping growth, indexing/merge backlog, or master overwhelm.

Quick Start

Use the troubleshoot-elasticsearch skill to diagnose my Elasticsearch incident using Netdata MCP signals and recommend the most likely remediation.

Frequently Asked Questions about troubleshoot-elasticsearch

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I troubleshoot Elasticsearch heap pressure death spirals?

Diagnose Elasticsearch heap pressure death spirals by querying Netdata via MCP for heap health signals and routing the incident through the operator playbook diagnostic tree to identify the failure archetype and recommend remediation.

What causes Elasticsearch disk watermark cascades and shard overallocation?

Elasticsearch disk watermark cascades and shard overallocation stem from specific resource or configuration failure archetypes. Structured triage identifies whether the incident is driven by shard bloat, disk watermarks, mapping explosions, or master instability.

Does Netdata work with MCP for Elasticsearch incident diagnosis?

Yes, Netdata works with MCP for Elasticsearch incident diagnosis by querying Netdata contexts for health signals and applying anomaly-to-rulefile triage. The operator playbook diagnostic tree maps the signals to specific failure archetypes like merge storms or mapping explosion.

How do I verify Elasticsearch remediation after applying a fix?

Verify Elasticsearch remediation by re-running the same MCP verification queries over Netdata contexts to confirm signals return to expected ranges. The process flags when the remediation does not hold and the fix requires further action.

Can I diagnose Elasticsearch mapping explosions and merge storms using Netdata?

Yes, you can diagnose Elasticsearch mapping explosions and merge storms using Netdata by identifying the dominant health archetype and applying structured triage to recommend the most likely remediation for these specific indexing backlogs.

Elasticsearch master instability troubleshooting not working with generic checks?

Generic checks miss the true cause of Elasticsearch master instability because incidents cascade from specific failure archetypes. Netdata's operator playbook provides a reliable, step-by-step diagnostic path to determine the exact overwhelm trigger.