# Buffer Process 100% couldn't point deflector to a new index
**URL:** https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096
**Category:** Graylog Central (peer support)
**Created:** [March 14, 2023, 11:02pm UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096 "2023-03-14T23:02:16Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@vanilsonSantos](https://community.graylog.org/u/vanilsonSantos)
#### Post date: [March 14, 2023, 11:02pm UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096/1 "2023-03-14T23:02:16Z")
Hi,
I had a disk full and a expended my lvm. But now i have a Buffer process 100% and some error on logs of graylogs. and i dont have a messages on the search tab.
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [March 14, 2023, 11:26pm UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096/2 "2023-03-14T23:26:51Z")
Hello @vanilsonSantos
How many message you have in the journal, resources (i.e., CPU,etc…) will depend on how long it take to ingest those back logs. While those are at 100% you wont be able to search for a few until the system is finished.
What Errors are shown in Elasticsearch logs? Did you check the cluster health of Elasticsearch?
```auto
curl -XGET localhost:9200/_cluster/health?pretty
```
if you have CPU cores to spare you can increase the thread count processor\_buffer & output\_buffer settings in Graylog configuration file. but if those settings are to high youll run into issues.
You could also try to manually rotate you index set on the Web UI.
EDIT: Just a thought, you mentioned the Disk was full. I would make sure Elasticsearch is not in read mode.
---
### Author:  [@vanilsonSantos](https://community.graylog.org/u/vanilsonSantos)
#### Post date: [March 15, 2023, 9:38pm UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096/3 "2023-03-15T21:38:16Z")
Hi @gsmith,
Thnaks for your answer.
Elsaticsearch health
Elsaticsearch logs
Journal
How can i see de CPU ?
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [March 15, 2023, 9:53pm UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096/5 "2023-03-15T21:53:59Z")
Hey @vanilsonSantos
Yep,
thats a lot of logs you have in the journal, I had with 12 cores and 12 GB RAM it took me 4 hours to clean out the journal similar to that size. Your Process\_buffer would be your heavy hitter, that would need the most of your CPU and if this is on One node and depending on your reasources this may take some time to clean up. rebooting your system will only delay the process. If the Journal doesnt go down in few hours OR is getting worse I would look into add more resources and adjusting you Graylog Configuration file to accommodate that amount of logs.
> [@vanilsonSantos](#):
>
> How can i see de CPU ?
If your refering to you Graylog Server CPU I would imagine you can use TOP or HTOP command.
If your refering to increasing buffer count then it would be in this section:
```auto
processbuffer_processors = 5
outputbuffer_processors = 3
```
If you do dont forget to restart GL service.
I see that was yesterday, does it still look like that today?
---
### Author:  [@vanilsonSantos](https://community.graylog.org/u/vanilsonSantos)
#### Post date: [March 15, 2023, 10:34pm UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096/6 "2023-03-15T22:34:32Z")
Yes it is still.
I alredy have this configuration.
---
### Author:  [@vanilsonSantos](https://community.graylog.org/u/vanilsonSantos)
#### Post date: [March 16, 2023, 11:37am UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096/7 "2023-03-16T11:37:21Z")
Hi
Can i clean the process buffer and Output buffer or Journal ?
If yes How can i clean ?
Thanks
---
### Author:  [@joe.gross](https://community.graylog.org/u/joe.gross)
#### Post date: [March 16, 2023, 1:08pm UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096/8 "2023-03-16T13:08:41Z")
When the disk fills up, it goes into read only mode to protect itself. Did you issue the command to return it to read-write?
---
### Author:  [@vanilsonSantos](https://community.graylog.org/u/vanilsonSantos)
#### Post date: [March 16, 2023, 2:11pm UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096/9 "2023-03-16T14:11:37Z")
Hi @joe.gross ,
Not yet.
What is the command to put on read-white ?
---
### Author:  [@tmacgbay](https://community.graylog.org/u/tmacgbay)
#### Post date: [March 16, 2023, 8:13pm UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096/10 "2023-03-16T20:13:18Z")
not sure what version you have but likely something like this:
```auto
curl -X PUT "localhost:9200//_settings?pretty" -H 'Content-Type: application/json' -d'
{
"index.blocks.read_only_allow_delete": null }'
```
---
### Author:  [@joe.gross](https://community.graylog.org/u/joe.gross)
#### Post date: [March 16, 2023, 9:34pm UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096/11 "2023-03-16T21:34:04Z")
Thanks @tmacgbay, it took me a while to get back to this. That should set it back to read-write.
@vanilsonSantos, be sure to set your retention settings to prevent it from filling up again.
Rotation strategy should be set to Time based at a period of one day (P1D). Then set your retention settings to keep up to your max retention in days. So max 30 or 60 or 90 indices gets you 30, 60, or 90 days of retention in Opensearch.
Be sure you know how much storage you have and how many days you can keep. Set it to keep only enough indices that you don’t go above 75% of total disk capacity.
---
### Author:  [@vanilsonSantos](https://community.graylog.org/u/vanilsonSantos)
#### Post date: [March 19, 2023, 11:17pm UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096/12 "2023-03-19T23:17:30Z")
Hi @tmacgbay,
Thanks its working now.
Thanks every one.
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [March 20, 2023, 9:25pm UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096/13 "2023-03-20T21:25:50Z")
Hey @vanilsonSantos
What was the solution?
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [April 3, 2023, 9:26pm UTC](https://community.graylog.org/t/buffer-process-100-couldnt-point-deflector-to-a-new-index/28096/14 "2023-04-03T21:26:12Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.