OpenSearch Error - 400 Rejected by OpenSearch

Question

I have fluentd configured to send logs to opensearch.
This worked fine until now. I did not change anything in the fluentd configuration or opensearch.
No logs are coming in, and fluentd logs this error: 
[warn]: #0 dump an error event: error_class=Fluent::Plugin::OpenSearchErrorHandler::OpenSearchError error="400 - Rejected by OpenSearch" location=nil

What is the cause of the error?

Accepted Answer

Managed to solve this.
By default opensearch (and also elasticsearch) plugins log the whole error only if log_level is set to debug.
Once I changes the log_level, the errors came with more info about the problem:
[warn]: #0 fluent/log.rb:381:warn: dump an error event: error_class=Fluent::Plugin::OpenSearchErrorHandler::OpenSearchError error="400 - Rejected by OpenSearch [error type]: illegal_argument_exception [reason]: 'Validation Failed: 1: this action would add [15] total shards, but this cluster currently has [2997]/[3000] maximum shards open;'"

So to conclude, error "OpenSearchError error="400 - Rejected by OpenSearch" can be for many reasons, and to see more details just  change the log level to debug.

OpenSearch Error - 400 Rejected by OpenSearch

相關內容