Troubleshoot Elasticsearch index_not_found_exception

index_not_found_exception means the requested target could not be resolved as required by the operation. Start by checking the name and the cluster you reached. Creating an empty index immediately can hide a naming error or occupy a name intended for an alias or data stream.

Inspect the target

In Kibana Dev Tools, inspect the indices visible to your account and resolve the intended name:

GET _cat/indices?v
GET /_resolve/index/logs-write?expand_wildcards=all

The resolve API distinguishes indices, aliases, and data streams. An empty index listing alone does not prove that no data exists: permissions, hidden resources, wildcard expansion, or a connection to the wrong environment can change what you see. Use HTTPS and the required authentication when connecting outside a local test setup.

Check names and lifecycle

Common causes include a misspelled alias, an incorrect date suffix, or an application building daily names in the wrong time zone. Index names must be lowercase. Prefer a deliberate read alias, data stream, or scoped wildcard such as logs-* over constructing individual daily names in application code.

Also check whether an upstream shipper stopped writing, index auto-creation is restricted, or retention deleted the historical index. A node or shard availability problem generally needs a different investigation; do not interpret every missing result as a missing index.

Create an ordinary index only when intended

After confirming the mapping, template, lifecycle, and target design, an ordinary test index can be created explicitly:

PUT my_index
{
  "settings": { "number_of_shards": 1, "number_of_replicas": 1 }
}

Do not use this to repair a missing rollover alias or data stream. Fix its provisioning or write path instead. A single-node test cluster cannot allocate the replica in this example until another suitable node is available.

Prevent recurrence

Use controlled auto-creation rules rather than allowing every mistyped name to become a new index. Save stable query targets in application configuration, and check retention before promising access to old data. If the actual response is index_closed_exception, investigate a closed index separately.

References: resolve index API and create index API.

Related: Fix a 413 request-body error (Chinese) and Fix npm EACCES errors.