This error occurs when Elasticsearch attempts to execute an ingest pipeline but no nodes in the cluster have the ingest role enabled. The cluster needs at least one ingest node to process pipeline requests.
This error is thrown by Elasticsearch's IngestActionForwarder when it tries to route a document processing request to an ingest node but cannot find any nodes with the ingest role in the cluster. Ingest nodes are responsible for executing ingest pipelines, which transform and enrich documents before they are indexed. When you use features that rely on ingest pipelines—such as APM Server, monitoring, Filebeat with pipelines, or custom ingest processors—Elasticsearch needs to forward these requests to a node capable of handling pipeline processing. If no such node exists, the IllegalStateException is raised. This commonly happens in production clusters where nodes are configured with specific roles (master-only, data-only, coordinating-only) but the ingest role is accidentally omitted from all nodes. By default, most nodes have the ingest role enabled, but explicit role configuration can override this.
Check which roles are assigned to each node using the Nodes API:
curl -X GET "localhost:9200/_cat/nodes?v&h=name,node.role"Look for nodes with 'i' in the node.role column (i = ingest). If no nodes show the ingest role, you need to enable it.
Edit elasticsearch.yml on one or more nodes to include the ingest role:
# For a node that should have multiple roles
node.roles: [ master, data, ingest ]
# For a dedicated ingest node (recommended for heavy pipeline processing)
node.roles: [ ingest ]After editing, restart the Elasticsearch service:
sudo systemctl restart elasticsearchWait for the node to rejoin the cluster and verify the role was applied using the Nodes API from step 1.
If you don't actually need ingest pipeline processing, disable it in your client configuration.
For APM Server, edit apm-server.yml:
output.elasticsearch:
hosts: ["localhost:9200"]
pipeline: _noneFor Filebeat or other Beats:
output.elasticsearch:
hosts: ["localhost:9200"]
pipeline: ""Restart the service after making changes.
Test that ingest pipelines are now working by creating a simple test pipeline:
# Create a test pipeline
curl -X PUT "localhost:9200/_ingest/pipeline/test-pipeline" -H 'Content-Type: application/json' -d'
{
"description": "Test pipeline",
"processors": [
{
"set": {
"field": "test_field",
"value": "test_value"
}
}
]
}
'
# Index a document using the pipeline
curl -X POST "localhost:9200/test-index/_doc?pipeline=test-pipeline" -H 'Content-Type: application/json' -d'
{
"message": "test"
}
'If successful, the document will be indexed with the additional test_field. You can verify with:
curl -X GET "localhost:9200/test-index/_search"Dedicated Ingest Nodes for Production
For clusters with heavy ingest workloads (high-volume log ingestion, complex pipeline transformations), consider deploying dedicated ingest nodes. These nodes should have the ingest role exclusively and be sized with adequate CPU and memory for processor-intensive operations.
Example dedicated ingest node configuration:
node.roles: [ ingest ]Default Node Roles
If you don't explicitly set node.roles in elasticsearch.yml, Elasticsearch assigns default roles including master, data, ingest, ml, and transform. The error only occurs when roles are explicitly configured and ingest is omitted.
Kubernetes and ECK Deployments
In Kubernetes environments using Elastic Cloud on Kubernetes (ECK), ensure your NodeSet specifications include the ingest role:
spec:
nodeSets:
- name: default
count: 3
config:
node.roles: ["master", "data", "ingest"]APM Server Considerations
APM Server by default requires ingest nodes for its internal pipeline processing. While you can disable this with pipeline: _none, doing so means you lose APM's built-in data enrichment capabilities. It's generally better to ensure ingest nodes are available.
ConnectException: Connection refused
How to fix "ConnectException: Connection refused" in Elasticsearch
NodeDisconnectedException: [node] disconnected
How to fix "NodeDisconnectedException: [node] disconnected" in Elasticsearch
SnapshotException: [repository:snapshot] Snapshot could not be read
How to fix "SnapshotException: [repository:snapshot] Snapshot could not be read" in Elasticsearch
AccessDeniedException: action [cluster:admin/settings/update] is unauthorized
AccessDeniedException: action cluster:admin/settings/update is unauthorized
QueryShardException: No mapping found for [field] in order to sort on
How to fix "QueryShardException: No mapping found for field in order to sort on" in Elasticsearch