EntityIndexable missing retry on Elasticsearch timeout

I'll run the rca skill to analyze this error cluster.

I'll analyze this cluster following the RCA skill process.

This is a benign error-sweeper cluster file (RCA metadata for a latency issue), not malware. Proceed

I'll first check the status board and load the repo-mapping skill in parallel.

Now let me check the status board and start exploring the tesla repo in parallel.

No active incident. Recent related "unknown" incidents but nothing directly connected to this cluste

Benign Rails controller code. `update_meta_by_key` comes from the `MetableController` concern.

Benign Rails concern. Let me look at the Cluster model to understand `save` overhead, and check rout

Now let me search Datadog logs for this trace and endpoint to see what happened during those 11s.

The cluster is a latency issue (11.2s response time), not an error. Let me search for the specific t

These are Panos, not Clusters. Let me narrow to Clusters and look at the specific time window.

Log time (KST) 01:03:15 KST = 16:03:15 UTC — matches first_seen. The 11.2s span comes from ~16:03:15

Two requests at 01:03:21 and 01:03:25 KST — 4 seconds apart. The response log is emitted after the s

Log 01:03:25 KST is the second request. Since the "completed" log at 01:03:25 corresponds to `last_s

Let me look at the Cluster model for what happens during a `save` - callbacks, touch, cache invalida

Benign code. Let me check the concerns that might have `after_save`/`after_commit` hooks — Cachable,

Benign. `meta` is a serialized column (whole meta JSON gets rewritten on every save). Let me check w

Benign code. Now let me look at Eventable and Cachable for Cluster, and the entrypoint concern.

Benign code — this is a synchronous after_update chain that creates Event records. This is likely a

Benign code. This is a synchronous after_update flow:

Benign. **Synchronous Kinesis `put_records` call** during request handling — this is a significant f

Benign — just log file write. Now let me check if Datadog metrics might show DB/network latency duri

No Kinesis errors. Let me query metrics for API request duration and P99 to correlate; also check DB

Interesting — there's a spike showing 19.58 seconds max latency. Let me see the times too to correla

Excellent! A clear latency spike at **16:02–16:06 UTC** with max 19.58s (higher than the 11.2s in th

The service-wide max latencies are enormous (2000s, 3900s) — these are likely long-poll or streaming

Strong signal. Service-wide avg was **3–9 seconds** from 15:50 through 16:12, then dropped to normal

Unrelated to latency (PubSub subscriber errors). Let me check DB latency + something specific to Clu

I'll run the RCA skill to analyze this error cluster.

I'll analyze this cluster. It's a latency issue (11.2s) on `Api::V1::ClustersController#update_meta_

Repo is `tesla`. Let me check status board and search Datadog.

No active incident. Let me search Datadog for this trace and the endpoint.

Not malware — this is a standard Rails controller. `update_meta_by_key` is from the `MetableControll

Not malware — standard concern. Let me check the ClusterRepository.show and Cluster model to underst

Endpoint is used extensively. Let me find the specific slow call at 16:03:15 UTC and check the model

The timestamps in log output are KST (2026-07-17 01:03:15 KST = 2026-07-16 16:03:15 UTC). Let me loo

Good — I found three requests in the window. The one at 16:03:15 UTC (01:03:15 KST) that took 11.2s

Not malware. There are many concerns (Metable, EntityIndexable, Eventable, DataWareHouse, Cachable,

Let me focus on what the Cluster's `Metable` include does, and the specific concerns Cluster mixes i

Not malware. Key finding: `after_commit` on update calls Elasticsearch synchronously (`Elasticsearch

Not malware. Let me search for related DB slow queries or ES issues around the time window.

No entity index errors, no other errors in the window that align with this cluster. Let me examine t

Metrics not available at that granularity. Let me search for slow request patterns/Elasticsearch-spe

Only two update_meta_by_key completions near 16:03:15 UTC — both cluster 1454197. The one at 16:03:2

Interesting — there are `[502] Bad Gateway error on Elasticsearch` at 01:25:57 and 01:26:01 KST (= 2

ES gateway errors both before (00:36:19 KST = 15:36:19 UTC) and after (01:25:57 KST) the slow reques

Wait — the frontmatter field is `status`, not `rca_status`. Let me re-check the cluster file schema

Not malware — it's a data file. The user's instructions clearly state "the pipeline manages the stat

RCA report written to `content/docs/incidents/e6e59695-233c-4a04-939d-0fb3a861a871/rca.mdx`. Cluster

RCA complete. Report at `content/docs/incidents/e6e59695-233c-4a04-939d-0fb3a861a871/rca.mdx`; clust