### Author:  [@deepakkumardubey](https://community.graylog.org/u/deepakkumardubey)
#### Post date: [June 23, 2021, 11:25am UTC](https://community.graylog.org/t/elasticsearch-disconnecting-frequently/20274/1 "2021-06-23T11:25:06Z")
Hello Friends,
My elasticsearch disconnecting with Graylog frequently after 3 or 4 days. I am getting below error, can you please let me know what could be the cause of these errors.
Failed to index message: index=\ id=
error=\<{“type”:“unavailable\_shards\_exception”,“reason”:"[is02\_1y\_2][1] primary shard is not active Timeout: [1m],
request: [BulkShardRequest [[is02\_1y\_2][1]] containing [47] requests]"}\>
ERROR: org.graylog2.shared.buffers.processors.DecodingProcessor - Error processing message RawMessage{
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [June 23, 2021, 11:17pm UTC](https://community.graylog.org/t/elasticsearch-disconnecting-frequently/20274/2 "2021-06-23T23:17:43Z")
Hello,
Maybe I can help.
There are a couple commands you can excute to find out what, why, and how to solve this issue.
Check Elasticsearch Health it should state “Green”.
`curl -XGET http://localhost:9200/_cluster/health?pretty=true`
The following command would indicate that there might be something wrong with the shards.(Look for Unassigned shards/Errors)
`curl -XGET http://localhost:9200/_cat/shards | more`
If errors were found from the previous command, the following commmand will find out why those error/s occured.
`curl -XGET http://localhost:9200/_cluster/allocation/explain?pretty`
I looks like you Primary Shards are not active which tell me there might be something wrong with your elasticsearch. If you execute the above commands in order you might be able to identify or get close on whats going on in your setup.
Hope that helps
---
### Author:  [@deepakkumardubey](https://community.graylog.org/u/deepakkumardubey)
#### Post date: [June 24, 2021, 6:52am UTC](https://community.graylog.org/t/elasticsearch-disconnecting-frequently/20274/3 "2021-06-24T06:52:20Z")
Hi gsmit,
Below commands executed , output are given below. please guide me to resolve this.
curl -XGET [http://localhost:9200/\_cluster/health?pretty=true](http://localhost:9200/_cluster/health?pretty=true)
“cluster\_name” : “docker-cluster”,
“status” : “green”,
“timed\_out” : false,
“number\_of\_nodes” : 1,
“number\_of\_data\_nodes” : 1,
“active\_primary\_shards” : 104,
“active\_shards” : 104,
“relocating\_shards” : 0,
“initializing\_shards” : 0,
“unassigned\_shards” : 0,
“delayed\_unassigned\_shards” : 0,
“number\_of\_pending\_tasks” : 0,
“number\_of\_in\_flight\_fetch” : 0,
“task\_max\_waiting\_in\_queue\_millis” : 0,
“active\_shards\_percent\_as\_number” : 100.0
curl -XGET [http://localhost:9200/\_cat/shards](http://localhost:9200/_cat/shards) | more
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 7592 100 7592 0 0 3602 0 0:00:02 0:00:02 --:–:-- 3601
graylog\_2 2 p STARTED 4998396 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 1 p STARTED 5001780 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 3 p STARTED 5000565 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 0 p STARTED 5000048 1.6gb 127.0.0.1 EnbqQkG
jirafrk-accesslogs-full\_0 2 p STARTED 733480 287.6mb 127.0.0.1 EnbqQkG
jirafrk-accesslogs-full\_0 1 p STARTED 733458 287.4mb 127.0.0.1 EnbqQkG
jirafrk-accesslogs-full\_0 3 p STARTED 733589 287.8mb 127.0.0.1 EnbqQkG
jirafrk-accesslogs-full\_0 0 p STARTED 733537 288.4mb 127.0.0.1 EnbqQkG
gl-system-events\_1 0 p STARTED 0 261b 127.0.0.1 EnbqQkG
graylog\_3 2 p STARTED 4998643 1.7gb 127.0.0.1 EnbqQkG
graylog\_3 3 p STARTED 5001765 1.7gb 127.0.0.1 EnbqQkG
graylog\_3 1 p STARTED 5000417 1.7gb 127.0.0.1 EnbqQkG
graylog\_3 0 p STARTED 4999778 1.7gb 127.0.0.1 EnbqQkG
graylog\_4 2 p STARTED 4999639 1.6gb 127.0.0.1 EnbqQkG
graylog\_4 3 p STARTED 4997910 1.6gb 127.0.0.1 EnbqQkG
graylog\_4 1 p STARTED 5000901 1.6gb 127.0.0.1 EnbqQkG
graylog\_4 0 p STARTED 5001689 1.6gb 127.0.0.1 EnbqQkG
graylog\_5 2 p STARTED 5003550 1.6gb 127.0.0.1 EnbqQkG
graylog\_5 3 p STARTED 5000695 1.6gb 127.0.0.1 EnbqQkG
graylog\_5 1 p STARTED 4997803 1.6gb 127.0.0.1 EnbqQkG
graylog\_5 0 p STARTED 4998362 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 2 p STARTED 4997543 1.5gb 127.0.0.1 EnbqQkG
graylog\_2 1 p STARTED 5001344 1.5gb 127.0.0.1 EnbqQkG
graylog\_2 3 p STARTED 5001422 1.5gb 127.0.0.1 EnbqQkG
graylog\_2 0 p STARTED 4999975 1.5gb 127.0.0.1 EnbqQkG
graylog\_2 2 p STARTED 5000135 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 1 p STARTED 5000403 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 3 p STARTED 4998487 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 0 p STARTED 5001279 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 2 p STARTED 4997481 1.7gb 127.0.0.1 EnbqQkG
graylog\_2 1 p STARTED 5000845 1.7gb 127.0.0.1 EnbqQkG
graylog\_2 3 p STARTED 5002438 1.7gb 127.0.0.1 EnbqQkG
graylog\_2 0 p STARTED 4999489 1.7gb 127.0.0.1 EnbqQkG
graylog\_2 2 p STARTED 5000666 1.8gb 127.0.0.1 EnbqQkG
graylog\_2 1 p STARTED 4999378 1.8gb 127.0.0.1 EnbqQkG
graylog\_2 3 p STARTED 5002349 1.8gb 127.0.0.1 EnbqQkG
graylog\_2 0 p STARTED 4998137 1.8gb 127.0.0.1 EnbqQkG
graylog\_2 2 p STARTED 4998782 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 3 p STARTED 5001989 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 1 p STARTED 5001502 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 0 p STARTED 4998343 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 2 p STARTED 4999259 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 1 p STARTED 4998403 1.6gb 127.0.0.1 EnbqQkG
graylog\_2 3 p STARTED 5003535 1.6gb 127.0.0.1 EnbqQkG
curl -XGET [http://localhost:9200/\_cluster/allocation/explain?pretty](http://localhost:9200/_cluster/allocation/explain?pretty)
{
“error” : {
“root\_cause” : [
{
“type” : “illegal\_argument\_exception”,
“reason” : “unable to find any unassigned shards to explain [ClusterAllocationExplainRequest[useAnyUnassignedShard=true,includeYesDecisions?=false]”
}
],
“type” : “illegal\_argument\_exception”,
“reason” : “unable to find any unassigned shards to explain [ClusterAllocationExplainRequest[useAnyUnassignedShard=true,includeYesDecisions?=false]”
},
“status” : 400
}
---
### Author:  [@deepakkumardubey](https://community.graylog.org/u/deepakkumardubey)
#### Post date: [June 24, 2021, 10:55am UTC](https://community.graylog.org/t/elasticsearch-disconnecting-frequently/20274/4 "2021-06-24T10:55:47Z")
Hi gsmith,
Waiting for your revert, please let me know in case of other details required.
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [June 25, 2021, 4:53am UTC](https://community.graylog.org/t/elasticsearch-disconnecting-frequently/20274/5 "2021-06-25T04:53:25Z")
Hello,
I’m sorry for the delay, I’ve been working on learning more with Elasticsearch, which is taking all my time.
Thank you for the added details, it seems to look good so far.
Would you be able to show you Elasticsearch file ( elasticsearch.yml) and Graylog confgiuration file ( server.conf).
Simple command to make it easy to read these files when you post it. May something like this.
`grep -v "^#\|^$" /etc/graylog/server/server.conf`
and
`grep -v "^#\|^$" /etc/elasticsearch/elasticsearch.yml`
---
### Author:  [@deepakkumardubey](https://community.graylog.org/u/deepakkumardubey)
#### Post date: [June 25, 2021, 12:04pm UTC](https://community.graylog.org/t/elasticsearch-disconnecting-frequently/20274/6 "2021-06-25T12:04:18Z")
Thank you for your response.
As below command s are executed, output mentioned below.
grep -v “^#|^$” /usr/graylog/server/server.conf
[main]
no-auto-default=\*
ignore-carrier=\*
grep -v “^#|^$” /etc/elasticsearch/elasticsearch.yml
cluster.name: “docker-cluster”
network.host: 0.0.0.0
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [June 25, 2021, 11:51pm UTC](https://community.graylog.org/t/elasticsearch-disconnecting-frequently/20274/7 "2021-06-25T23:51:47Z")
Hello,
> [@deepakkumardubey](#):
>
> [main]
> no-auto-default=\*
> ignore-carrier=\*
What type of installation do you have? Your files do not look familiar nor correct.
EDIT: I show an example of my Graylog/Elasticsearch config files here.
> [@When open saved dashboard gives "loading!" 4.0.8](https://community.graylog.org/t/when-open-saved-dashboard-gives-loading-4-0-8/20170/9):
>
> @Siddik Hello This will tell you where all your default files are located. [Default file locations — Graylog 4.0.0 documentation](https://docs.graylog.org/en/4.0/pages/configuration/file_location.html). Just out of curiousity, when you made changes to the files, did you restart your service? This is one of my Lab Graylog servers config file. I have 12 cores so my config file was adjusted.
>
> > **Graylog**
> >
> > [root@graylog graylog\_user]# grep -v "^#\|^$" /etc/graylog/server/server.conf is\_master = true node\_id\_file = /etc/graylog/server/node-id password\_secret =som…
---
### Author:  [@deepakkumardubey](https://community.graylog.org/u/deepakkumardubey)
#### Post date: [June 27, 2021, 6:10am UTC](https://community.graylog.org/t/elasticsearch-disconnecting-frequently/20274/8 "2021-06-27T06:10:46Z")
[main]
> no-auto-default=\*
> ignore-carrier=\*
> [/quote]
What type of installation do you have? Your files do not look familiar nor correct : It’s running as a container.
Yes, I have created containers by using the docker-compose file.
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [June 28, 2021, 9:46pm UTC](https://community.graylog.org/t/elasticsearch-disconnecting-frequently/20274/9 "2021-06-28T21:46:51Z")
> [@deepakkumardubey](#):
>
> containers
I thought this was a package installment. I dont think I’ll be able to help you since I’m really not familiar with Docker installment. Maybe someone here could help you better.
Sorry I can not be more help.
---
### Author:  [@aaronsachs](https://community.graylog.org/u/aaronsachs)
#### Post date: [July 9, 2021, 1:55am UTC](https://community.graylog.org/t/elasticsearch-disconnecting-frequently/20274/10 "2021-07-09T01:55:28Z")
Did you already post your Docker-compose file? If not, that would be helpful.
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [July 23, 2021, 1:56am UTC](https://community.graylog.org/t/elasticsearch-disconnecting-frequently/20274/11 "2021-07-23T01:56:22Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.