From d104c4164de24f58b34d274a9f067c8dfe63e9b8 Mon Sep 17 00:00:00 2001
From: royy92 <164633440+royy92@users.noreply.github.com>
Date: Sun, 12 Apr 2026 02:52:20 +0300
Subject: [PATCH] docs: add indexer-connector bulk indexing failure
 troubleshooting section

---
 .../wazuh-dashboard/troubleshooting.rst       | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/source/user-manual/wazuh-dashboard/troubleshooting.rst b/source/user-manual/wazuh-dashboard/troubleshooting.rst
index 6ec8b8d512..126421470f 100644
--- a/source/user-manual/wazuh-dashboard/troubleshooting.rst
+++ b/source/user-manual/wazuh-dashboard/troubleshooting.rst
@@ -287,3 +287,29 @@ Check the following log files:
 .. note::
 
    The Wazuh indexer uses the ``/var/log`` folder to store logs by default.
+
+
+Indexer-connector bulk indexing failures
+-----------------------------------------
+
+When the indexer-connector processes a bulk indexing operation, individual
+documents may fail even when the server returns a general success response.
+These failures are logged in ``/var/ossec/logs/ossec.log``.
+
+To check for bulk indexing failures, run:
+
+.. code-block:: console
+
+   # cat /var/ossec/logs/ossec.log | grep -i "Indexing failure"
+
+A failure log entry looks like:
+
+.. code-block:: none
+
+   ERROR: Indexing failure for index operation (status 400): document missing field
+
+To check for version conflicts that were automatically handled:
+
+.. code-block:: console
+
+   # cat /var/ossec/logs/ossec.log | grep -i "version conflict"