elastic/elasticsearch · error · IllegalArgumentException

Cannot create past TSDB backing index for system data stream

Error message

Cannot create past TSDB backing index for system data stream [{}]

What it means

Thrown by validateDataStream when the data stream exists but isSystem() returns true. System data streams are managed internally by Elasticsearch and do not allow user-initiated past TSDB backing index creation; their lifecycle is controlled by the owning feature.

Source

Thrown at modules/data-streams/src/main/java/org/elasticsearch/datastreams/action/TransportPastTimeSeriesIndexCreationAction.java:525

        }
    }

    record CoveredTimeWindow(long start, long end) {

        CoveredTimeWindow(Instant start, Instant end) {
            this(start.toEpochMilli(), end.toEpochMilli());
        }
    }

    private static void validateDataStream(String dataStreamName, DataStream dataStream, ProjectMetadata project) {
        if (dataStream == null) {
            throw new ResourceNotFoundException("Data stream [" + dataStreamName + "] not found");
        }
        if (dataStream.isReplicated()) {
            throw new IllegalArgumentException("Cannot create past TSDB backing index for replicated data stream [" + dataStreamName + "]");
        }
        if (dataStream.isSystem()) {
            throw new IllegalArgumentException("Cannot create past TSDB backing index for system data stream [" + dataStreamName + "]");
        }

        if (IndexMode.isTsdb(dataStream.getIndexMode()) == false) {
            throw new IllegalArgumentException(
                "Cannot create past TSDB backing index for data stream ["
                    + dataStreamName
                    + "] with mode ["
                    + dataStream.getIndexMode()
                    + "], it needs to be a time series data stream."
            );
        }
        Index writeIndex = dataStream.getWriteIndex();
        IndexMetadata writeIndexMetadata = writeIndex == null ? null : project.index(writeIndex);
        if (writeIndexMetadata == null || IndexMode.isTsdb(writeIndexMetadata.getIndexMode()) == false) {
            throw new IllegalStateException(
                "Cannot create past TSDB backing index for data stream ["
                    + dataStreamName
                    + "] because it requires to have yet at least one time series backing index. Please rollover first."

View on GitHub (pinned to db6a809a66)

Solutions

1. Exclude system data streams from past TSDB index creation requests.
2. If backfill into that data is genuinely required, use the user-facing ingest APIs the owning feature provides rather than the low-level past-index-creation action.

if (dataStream.isSystem()) {
  throw new IllegalArgumentException("Cannot create past TSDB backing index for system data stream");
}

When it happens

Trigger: Calling the past TSDB index creation API on a system data stream (e.g. logs-* or metrics-* system streams created by Elastic features). The check runs after the replicated check.

Common situations: Bulk backfill job that targets a wildcard catching system streams; user mistakenly treating a system stream as a normal one.

Related errors

• Cannot create past TSDB backing index for data stream [{}] b
• Data stream [{}] not found
• Cannot create past TSDB backing index for replicated data st
• backing index [%s] in tsdb mode doesn't have the [%s] index
• Cannot add dynamic templates that define dimension fields on

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/6e6fd08a47562922. Report an issue: GitHub.