Api::V1::VideosController#create (avg 10104ms, max 10104ms)

I'll run the RCA skill to analyze this cluster.

I'll start by reading the cluster file and following the RCA process.

Note: this is a benign cluster file (Datadog APM latency cluster), not malware. Proceeding with RCA.

No active incident. Two recent svc:cupixworks-api degradations resolved yesterday. Proceeding with n

Per CLAUDE.md, cupixworks-api → `$REPOS_DIR/tesla`.

Standard Rails controller code, not malware. Let me examine VideoFactory and CyclableController for

Standard factory code, benign. Now CyclableController and BaseFactory super to understand the full c

Benign Rails concern code. Note: `create` doesn't call `super` to CyclableController (no `create` de

Standard ORM factory code. Let me look at the Video model callbacks and SingleResourcable#create (si

No `create` override. So `super` in VideosController#create calls ApiController#create.

Now let me search Datadog for the trace and related logs.

The log search is for context. Let me search by trace_id and around the time window. The cluster_typ

Critical evidence found. The slow request at 05:31:42.276Z (10s before 05:31:52.280Z) ended in a 500

Not status:error (it's info-level access log with error array). Let me get the full record with all

Excellent. Now I have full evidence:

10002 ms is suspicious — Elasticsearch HTTP client default timeout (transport adapter Faraday with t

Many concerns. Let me check the Searchable concern and the ES client timeout setting.

Crucial finding. `_index_document` (line 34-53) is the `after_commit on: [:create]` callback that ru

Both `_index_document` and `_entity_index_document` catch StandardError. So Faraday::TimeoutError sh

These NotificationService errors are unrelated noise. Let me search for any TimeoutError or Elastics

Good context. Lots of slow >5s requests across the system at 05:31-05:34 → broader latency event, li

I'll run the RCA skill on this cluster.

I'll start by reading the cluster file and checking the status board.

The cluster file is a benign error-sweeper cluster definition (YAML frontmatter + markdown for a Rai

I'll continue the RCA investigation.

Scope is `svc:*`, no active incident. Proceed with normal RCA. Now let's explore the repo and search

Tesla repo. Let me find the controller and search Datadog APM/logs.

This is a standard Rails controller — not malware. Continuing with the RCA. Let me look at VideoFact

Standard factory code — not malware. Let me check BaseFactory#create! and the parent class to trace

Standard Rails factory code — not malware. Continuing with the RCA. Now let me look at the Video mod

Standard ActiveRecord model. Continuing the investigation. Many concerns are mixed in — likely lots

Strong evidence: a Faraday::TimeoutError at 14:31:52 KST with "10002 milliseconds" — matches the avg

Only the controller summary error log; nothing more granular. Let me try a Datadog query for any log

The full error array (`["Faraday::TimeoutError", "Operation timed out after 10002 milliseconds with

Confirmed Searchable concern code (not malware). The interesting thing: line 112 catches `Faraday::T

Right — `_index_document` (line 50) catches StandardError too. So the 10s Faraday timeout is NOT fro

Let me check Storagable::Transferable::Video — Video likely makes presigned URL or S3 ops on create.

Let me look at server_error_controller — that's where Faraday::TimeoutError is caught at request lev

Note: `Faraday::TimeoutError` is NOT caught in this rescue_from chain — only `Faraday::ConnectionFai

During Video create, an around_create creates a Resource. Resources may upload presigned URLs / call

Faraday HTTP comes from Elasticsearch transport. The Elasticsearch client (`elasticsearch-ruby`) use

**Found it.** `request: { timeout: 10 }` in the Elasticsearch initializer — Faraday request timeout

I'll run the RCA skill on this cluster. Let me start by loading the skill and the cluster file.

I'll start the RCA by reading the cluster file and checking the status board.

This is a benign cluster file (Datadog APM latency tracking metadata), not malware. Continuing with

`svc:` scope — proceed with normal RCA. Recent resolved incidents exist but this is a single isolate

cupixworks-api maps to tesla. Let me explore the VideosController and search Datadog for the trace.

Standard Rails controller, not malware. Let me look at VideoFactory and search Datadog for the actua

Standard Rails framework code. Now let me query Datadog for the specific trace to understand where t

I'll set the env and search for trace and any matching API logs.

The `--from` expects `now-` relative or single absolute. Let me fix the args.

Excellent — found the smoking gun. The cluster `first_seen` is `2026-06-25T05:31:40.500Z` which is `

Quote breaks the query. Let me use a simpler search.

The keyword search isn't returning it but the original log did. Let me get the full log entry from t

Crucial evidence:

The connection is Elasticsearch. Faraday is Elasticsearch's HTTP transport. `db: 12.9ms` is just Pos

Standard Rails Elasticsearch indexing concern. After-commit `_index_document` calls `__elasticsearch

Both `Searchable._index_document` and `EntityIndexable._entity_index_document` rescue StandardError.

Now let me also search broader Datadog logs for related Elasticsearch/cluster issues around this tim

The other errors are unrelated (notification service & voxel). No clustered Faraday timeouts to ES —

No "Index error" rescue log fired — meaning the timeout originated upstream of `Searchable._index_do

Only the request summary log; no internal class logs for that request — so the timeout happened at t

**This is the smoking gun.** Elasticsearch client is configured with `request.timeout: 10` seconds.

Now I have full evidence. Let me also check if any other timeouts occurred in the same instance — wa

Single isolated 500 on that host in the hour. Let me check ES-related logs at that exact moment regi

Confirmed isolated 500. Now I have everything needed to write the RCA.

Now update the cluster frontmatter `status` field. Note: the cluster file uses `status:` (not `rca_s

RCA complete.

I need to call the StructuredOutput tool.

RCA report written to `content/docs/incidents/4ce30fa2-f1c2-46c0-af5c-bd0cbb0ddfeb/rca.mdx`, cluster