Diagnose Elasticsearch search_phase_execution_exception

search_phase_execution_exception is a wrapper around a search-phase failure. Read reason, root_cause, failed_shards, and nested caused_by details before choosing a fix. When the reason is all shards failed, no queried shard completed successfully; the exception name alone does not explain why.

Check sorts and aggregations on text fields

Sorting an analyzed text field commonly fails because fielddata is disabled:

{"sort":[{"message":"desc"}]}

If the mapping defines a suitable keyword multi-field, use it:

{"sort":[{"message.keyword":"desc"}]}

Confirm the field exists across the targeted indices. A .keyword suffix is a convention, not a feature automatically present in every mapping. For long messages, a keyword field's ignore_above setting can leave values unindexed.

Enabling fielddata on text can consume substantial heap and aggregates analyzed terms rather than original strings. A purpose-built keyword field is usually more appropriate. Adding one later does not populate existing documents; reprocess or reindex them.

Distinguish a failed query from no matches

A term query on a text field is valid, but it searches the indexed term exactly and does not analyze the query value. It often returns no results rather than raising this exception.

For full-text search:

{"query":{"match":{"message":"error"}}}

For an exact value in a mapped keyword field:

{"query":{"term":{"level.keyword":"ERROR"}}}

Actual execution failures can involve incompatible field types, invalid numeric conversions, malformed scripts, or aggregation requirements. Use the error's named field and operation to narrow the investigation.

Inspect shard availability

In Kibana Dev Tools:

GET _cluster/health
GET _cat/shards?v&h=index,shard,prirep,state,unassigned.reason
GET _cluster/allocation/explain

The allocation explanation identifies a particular unassigned shard; select the relevant shard explicitly when needed. An unassigned replica alone does not make its available primary unsearchable. Missing primary shards, unavailable nodes, and allocation restrictions can matter.

Disk watermarks are configurable and interact with node capacity and other allocation rules. Do not treat one percentage as a universal failure threshold. Fix the explanation's actual cause instead of blindly changing allocation settings.

Compare Kibana's real request

If a query works in Dev Tools but fails in Kibana, inspect Kibana's generated request, indices, time range, filters, sort, and runtime fields. Refreshing data view metadata may help stale UI information, but it cannot repair a mapping or unhealthy shard.

For memory or circuit-breaker errors, inspect aggregation cardinality, bucket counts, scripts, and fielddata usage. Reduce the expensive operation before increasing resource limits.

See Elastic's all-shards-failed troubleshooting guide.