Graylog elasticsearch health red and a lot unassigned shards

Graylog Central (peer support)
1

My elasticsearch have red status and a lot of unassigned shards.
Elasticsearch cluster is red. Shards: 256 active, 4 initializing, 0 relocating, 100 unassigned

2. Describe your environment:

  • OS Information:
    Ubuntu
  • Package Version:
    Graylog 5.0.5

Shards list

fortigate__20      2 p STARTED                     IP graylog
fortigate__20      3 p STARTED                     IP graylog
fortigate__20      1 p STARTED                     IP graylog
fortigate__20      0 p STARTED                     IP graylog
graylog_20         2 p STARTED                     IP graylog
graylog_20         3 p STARTED                     IP graylog
graylog_20         1 p STARTED                     IP graylog
graylog_20         0 p STARTED                     IP graylog
fortigate__3       2 p STARTED                     IP graylog
fortigate__3       3 p STARTED                     IP graylog
fortigate__3       1 p STARTED                     IP graylog
fortigate__3       0 p STARTED                     IP graylog
fortigate__34      2 p STARTED       85989  70.4mb IP graylog
fortigate__34      3 p STARTED       85149  69.8mb IP graylog
fortigate__34      1 p STARTED       85915  70.8mb IP graylog
fortigate__34      0 p STARTED       86191    71mb IP graylog
fortigate__19      2 p STARTED                     IP graylog
fortigate__19      3 p STARTED                     IP graylog
fortigate__19      1 p STARTED                     IP graylog
fortigate__19      0 p STARTED                     IP graylog
graylog_31         2 p STARTED      356882 331.6mb IP graylog
graylog_31         3 p STARTED      357337 328.4mb IP graylog
graylog_31         1 p STARTED      358314 330.3mb IP graylog
graylog_31         0 p STARTED      357214 327.3mb IP graylog
fortigate__24      2 p STARTED                     IP graylog
fortigate__24      3 p STARTED                     IP graylog
fortigate__24      1 p STARTED                     IP graylog
fortigate__24      0 p STARTED                     IP graylog
graylog_6          2 p STARTED                     IP graylog
graylog_6          3 p STARTED                     IP graylog
graylog_6          1 p STARTED                     IP graylog
graylog_6          0 p STARTED                     IP graylog
fortigate__36      2 p STARTED      504616 405.9mb IP graylog
fortigate__36      3 p STARTED      506106 406.4mb IP graylog
fortigate__36      1 p STARTED      504859 405.4mb IP graylog
fortigate__36      0 p STARTED      504658 406.3mb IP graylog
graylog_27         2 p STARTED     1504945   1.2gb IP graylog
graylog_27         3 p STARTED     1506027   1.2gb IP graylog
graylog_27         1 p STARTED     1507490   1.2gb IP graylog
graylog_27         0 p STARTED     1504758   1.2gb IP graylog
fortigate__33      2 p STARTED       82980  68.7mb IP graylog
fortigate__33      3 p STARTED       83854  69.8mb IP graylog
fortigate__33      1 p STARTED       83216  68.7mb IP graylog
fortigate__33      0 p STARTED       83652  69.8mb IP graylog
graylog_26         2 p STARTED     1520333   1.2gb IP graylog
graylog_26         3 p STARTED     1523187   1.2gb IP graylog
graylog_26         1 p STARTED     1521144   1.2gb IP graylog
graylog_26         0 p STARTED     1518483   1.2gb IP graylog
graylog_42         2 p STARTED      320772 295.2mb IP graylog
graylog_42         3 p STARTED      320795 292.8mb IP graylog
graylog_42         1 p STARTED      320746 296.6mb IP graylog
graylog_42         0 p STARTED      320906 294.7mb IP graylog
fortigate__6       2 p STARTED                     IP graylog
fortigate__6       3 p STARTED                     IP graylog
fortigate__6       1 p STARTED                     IP graylog
fortigate__6       0 p STARTED                     IP graylog
graylog_40         2 p STARTED      314641 287.8mb IP graylog
graylog_40         3 p STARTED      314202 286.5mb IP graylog
graylog_40         1 p STARTED      314190 287.6mb IP graylog
graylog_40         0 p STARTED      315181 287.5mb IP graylog
fortigate__30      2 p STARTED      457483 369.3mb IP graylog
fortigate__30      3 p STARTED      457590 369.2mb IP graylog
fortigate__30      1 p STARTED      457996 369.1mb IP graylog
fortigate__30      0 p STARTED      458462 369.4mb IP graylog
fortigate__13      2 p STARTED                     IP graylog
fortigate__13      3 p STARTED                     IP graylog
fortigate__13      1 p STARTED                     IP graylog
fortigate__13      0 p STARTED                     IP graylog
graylog_3          2 p STARTED                     IP graylog
graylog_3          3 p STARTED                     IP graylog
graylog_3          1 p STARTED                     IP graylog
graylog_3          0 p STARTED                     IP graylog
graylog_25         2 p STARTED                     IP graylog
graylog_25         3 p STARTED                     IP graylog
graylog_25         1 p STARTED                     IP graylog
graylog_25         0 p STARTED                     IP graylog
graylog_37         2 p STARTED      806979   693mb IP graylog
graylog_37         3 p STARTED      807047 694.8mb IP graylog
graylog_37         1 p STARTED      806259   697mb IP graylog
graylog_37         0 p STARTED      806643 696.4mb IP graylog
fortigate__27      2 p STARTED                     IP graylog
fortigate__27      3 p STARTED                     IP graylog
fortigate__27      1 p STARTED                     IP graylog
fortigate__27      0 p STARTED                     IP graylog
gl-events_3        2 p STARTED      562620 107.4mb IP graylog
gl-events_3        3 p STARTED      563367 107.2mb IP graylog
gl-events_3        1 p STARTED      563030 107.1mb IP graylog
gl-events_3        0 p STARTED      564028 106.8mb IP graylog
fortigate__14      2 p STARTED                     IP graylog
fortigate__14      3 p STARTED                     IP graylog
fortigate__14      1 p STARTED                     IP graylog
fortigate__14      0 p STARTED                     IP graylog
fortigate__1       2 p UNASSIGNED                                
fortigate__1       3 p UNASSIGNED                                
fortigate__1       1 p UNASSIGNED                                
fortigate__1       0 p UNASSIGNED                                
gl-system-events_0 2 p UNASSIGNED                                
gl-system-events_0 3 p UNASSIGNED                                
gl-system-events_0 1 p UNASSIGNED                                
gl-system-events_0 0 p UNASSIGNED                                
graylog_5          2 p STARTED                     IP graylog
graylog_5          3 p STARTED                     IP graylog
graylog_5          1 p STARTED                     IP graylog
graylog_5          0 p STARTED                     IP graylog
fortigate__37      2 p STARTED      489210 392.5mb IP graylog
fortigate__37      3 p STARTED      488479 390.4mb IP graylog
fortigate__37      1 p STARTED      487221 391.2mb IP graylog
fortigate__37      0 p STARTED      488285   392mb IP graylog
graylog_1          2 p STARTED                     IP graylog
graylog_1          3 p STARTED                     IP graylog
graylog_1          1 p STARTED                     IP graylog
graylog_1          0 p STARTED                     IP graylog
graylog_7          2 p STARTED                     IP graylog
graylog_7          3 p STARTED                     IP graylog
graylog_7          1 p STARTED                     IP graylog
graylog_7          0 p STARTED                     IP graylog
fortigate__26      2 p STARTED                     IP graylog
fortigate__26      3 p STARTED                     IP graylog
fortigate__26      1 p STARTED                     IP graylog
fortigate__26      0 p STARTED                     IP graylog
graylog_32         2 p STARTED      339338 316.3mb IP graylog
graylog_32         3 p STARTED      338019 317.9mb IP graylog
graylog_32         1 p STARTED      339068 317.3mb IP graylog
graylog_32         0 p STARTED      340523 317.2mb IP graylog
graylog_45         2 p STARTED    33488285  28.8gb IP graylog
graylog_45         3 p STARTED    33496173  28.8gb IP graylog
graylog_45         1 p STARTED    33496537  28.8gb IP graylog
graylog_45         0 p STARTED    33467635  28.8gb IP graylog
graylog_0          2 p UNASSIGNED                                
graylog_0          3 p UNASSIGNED                                
graylog_0          1 p UNASSIGNED                                
graylog_0          0 p UNASSIGNED                                
graylog_16         2 p STARTED                     IP graylog
graylog_16         3 p STARTED                     IP graylog
graylog_16         1 p STARTED                     IP graylog
graylog_16         0 p STARTED                     IP graylog
graylog_14         2 p STARTED                     IP graylog
graylog_14         3 p STARTED                     IP graylog
graylog_14         1 p STARTED                     IP graylog
graylog_14         0 p STARTED                     IP graylog
graylog_41         2 p STARTED      582060 519.2mb IP graylog
graylog_41         3 p STARTED      583362 516.6mb IP graylog
graylog_41         1 p STARTED      581497 515.4mb IP graylog
graylog_41         0 p STARTED      583105 517.5mb IP graylog
fortigate__7       2 p STARTED                     IP graylog
fortigate__7       3 p STARTED                     IP graylog
fortigate__7       1 p STARTED                     IP graylog
fortigate__7       0 p STARTED                     IP graylog
graylog_29         2 p STARTED     1212760     1gb IP graylog
graylog_29         3 p STARTED     1211942     1gb IP graylog
graylog_29         1 p STARTED     1211381     1gb IP graylog
graylog_29         0 p STARTED     1213041     1gb IP graylog
graylog_13         2 p STARTED                     IP graylog
graylog_13         3 p STARTED                     IP graylog
graylog_13         1 p STARTED                     IP graylog
graylog_13         0 p STARTED                     IP graylog
graylog_19         2 p STARTED                     IP graylog
graylog_19         3 p STARTED                     IP graylog
graylog_19         1 p STARTED                     IP graylog
graylog_19         0 p STARTED                     IP graylog
fortigate__28      2 p STARTED                     IP graylog
fortigate__28      3 p STARTED                     IP graylog
fortigate__28      1 p STARTED                     IP graylog
fortigate__28      0 p STARTED                     IP graylog
graylog_28         2 p STARTED     1401712   1.2gb IP graylog
graylog_28         3 p STARTED     1403203   1.2gb IP graylog
graylog_28         1 p STARTED     1402162   1.2gb IP graylog
graylog_28         0 p STARTED     1400981   1.2gb IP graylog
graylog_33         2 p STARTED      826502 743.5mb IP graylog
graylog_33         3 p STARTED      826065 741.7mb IP graylog
graylog_33         1 p STARTED      825562   741mb IP graylog
graylog_33         0 p STARTED      825708 741.3mb IP graylog
graylog_21         2 p STARTED                     IP graylog
graylog_21         3 p STARTED                     IP graylog
graylog_21         1 p STARTED                     IP graylog
graylog_21         0 p STARTED                     IP graylog
graylog_34         2 p STARTED      851907 758.5mb IP graylog
graylog_34         3 p STARTED      854312   758mb IP graylog
graylog_34         1 p STARTED      854757   757mb IP graylog
graylog_34         0 p STARTED      852888 756.3mb IP graylog
fortigate__31      2 p STARTED      539761 433.5mb IP graylog
fortigate__31      3 p STARTED      541961 438.3mb IP graylog
fortigate__31      1 p STARTED      540857 435.2mb IP graylog
fortigate__31      0 p STARTED      540938 437.5mb IP graylog
graylog_17         2 p STARTED                     IP graylog
graylog_17         3 p STARTED                     IP graylog
graylog_17         1 p STARTED                     IP graylog
graylog_17         0 p STARTED                     IP graylog
fortigate__11      2 p STARTED                     IP graylog
fortigate__11      3 p STARTED                     IP graylog
fortigate__11      1 p STARTED                     IP graylog
fortigate__11      0 p STARTED                     IP graylog
fortigate__4       2 p STARTED                     IP graylog
fortigate__4       3 p STARTED                     IP graylog
fortigate__4       1 p STARTED                     IP graylog
fortigate__4       0 p STARTED                     IP graylog
graylog_18         2 p STARTED                     IP graylog
graylog_18         3 p STARTED                     IP graylog
graylog_18         1 p STARTED                     IP graylog
graylog_18         0 p STARTED                     IP graylog
fortigate__0       2 p UNASSIGNED                                
fortigate__0       3 p UNASSIGNED                                
fortigate__0       1 p UNASSIGNED                                
fortigate__0       0 p UNASSIGNED                                
fortigate__10      2 p STARTED                     IP graylog
fortigate__10      3 p STARTED                     IP graylog
fortigate__10      1 p STARTED                     IP graylog
fortigate__10      0 p STARTED                     IP graylog
fortigate__18      2 p STARTED                     IP graylog
fortigate__18      3 p STARTED                     IP graylog
fortigate__18      1 p STARTED                     IP graylog
fortigate__18      0 p STARTED                     IP graylog
graylog_8          2 p STARTED                     IP graylog
graylog_8          3 p STARTED                     IP graylog
graylog_8          1 p STARTED                     IP graylog
graylog_8          0 p STARTED                     IP graylog
fortigate__38      2 p STARTED    18563419  14.4gb IP graylog
fortigate__38      3 p STARTED    18566248  14.4gb IP graylog
fortigate__38      1 p STARTED    18566206  14.4gb IP graylog
fortigate__38      0 p STARTED    18550923  14.4gb IP graylog
graylog_22         2 p STARTED                     IP graylog
graylog_22         3 p STARTED                     IP graylog
graylog_22         1 p STARTED                     IP graylog
graylog_22         0 p STARTED                     IP graylog
fortigate__17      2 p STARTED                     IP graylog
fortigate__17      3 p STARTED                     IP graylog
fortigate__17      1 p STARTED                     IP graylog
fortigate__17      0 p STARTED                     IP graylog
graylog_43         2 p STARTED      762230 681.5mb IP graylog
graylog_43         3 p STARTED      762230 684.2mb IP graylog
graylog_43         1 p STARTED      763271 682.2mb IP graylog
graylog_43         0 p STARTED      763485 680.6mb IP graylog
fortigate__15      2 p STARTED                     IP graylog
fortigate__15      3 p STARTED                     IP graylog
fortigate__15      1 p STARTED                     IP graylog
fortigate__15      0 p STARTED                     IP graylog
graylog_12         2 p STARTED                     IP graylog
graylog_12         3 p STARTED                     IP graylog
graylog_12         1 p STARTED                     IP graylog
graylog_12         0 p STARTED                     IP graylog
fortigate__12      2 p STARTED                     IP graylog
fortigate__12      3 p STARTED                     IP graylog
fortigate__12      1 p STARTED                     IP graylog
fortigate__12      0 p STARTED                     IP graylog
graylog_35         2 p STARTED      823986 733.2mb IP graylog
graylog_35         3 p STARTED      824185 732.9mb IP graylog
graylog_35         1 p STARTED      823973 732.1mb IP graylog
graylog_35         0 p STARTED      824336 732.2mb IP graylog
fortigate__29      2 p STARTED      487660 392.3mb IP graylog
fortigate__29      3 p STARTED      487203 392.2mb IP graylog
fortigate__29      1 p STARTED      485707 391.6mb IP graylog
fortigate__29      0 p STARTED      487102 395.7mb IP graylog
fortigate__23      2 p STARTED                     IP graylog
fortigate__23      3 p STARTED                     IP graylog
fortigate__23      1 p STARTED                     IP graylog
fortigate__23      0 p STARTED                     IP graylog
graylog_9          2 p STARTED                     IP graylog
graylog_9          3 p STARTED                     IP graylog
graylog_9          1 p STARTED                     IP graylog
graylog_9          0 p STARTED                     IP graylog
fortigate__35      2 p STARTED      501075 403.7mb IP graylog
fortigate__35      3 p STARTED      501390 403.8mb IP graylog
fortigate__35      1 p STARTED      501977 403.4mb IP graylog
fortigate__35      0 p STARTED      502071 403.7mb IP graylog
fortigate__32      2 p STARTED      460634 373.2mb IP graylog
fortigate__32      3 p STARTED      462843 373.4mb IP graylog
fortigate__32      1 p STARTED      460177 372.2mb IP graylog
fortigate__32      0 p STARTED      461388 371.8mb IP graylog
graylog_4          2 p STARTED                     IP graylog
graylog_4          3 p STARTED                     IP graylog
graylog_4          1 p STARTED                     IP graylog
graylog_4          0 p STARTED                     IP graylog
fortigate__2       2 p UNASSIGNED                                
fortigate__2       3 p UNASSIGNED                                
fortigate__2       1 p UNASSIGNED                                
fortigate__2       0 p UNASSIGNED                                
fortigate__21      2 p STARTED                     IP graylog
fortigate__21      3 p STARTED                     IP graylog
fortigate__21      1 p STARTED                     IP graylog
fortigate__21      0 p STARTED                     IP graylog
gl-events_1        2 p STARTED      712188 136.9mb IP graylog
gl-events_1        3 p STARTED      711305 136.5mb IP graylog
gl-events_1        1 p STARTED      711267 135.8mb IP graylog
gl-events_1        0 p STARTED      710570 136.6mb IP graylog
fortigate__22      2 p STARTED                     IP graylog
fortigate__22      3 p STARTED                     IP graylog
fortigate__22      1 p STARTED                     IP graylog
fortigate__22      0 p STARTED                     IP graylog
graylog_44         2 p STARTED      711622 615.1mb IP graylog
graylog_44         3 p STARTED      713213 615.1mb IP graylog
graylog_44         1 p STARTED      711885 614.5mb IP graylog
graylog_44         0 p STARTED      712978 614.6mb IP graylog
graylog_23         2 p STARTED                     IP graylog
graylog_23         3 p STARTED                     IP graylog
graylog_23         1 p STARTED                     IP graylog
graylog_23         0 p STARTED                     IP graylog
graylog_11         2 p STARTED                     IP graylog
graylog_11         3 p STARTED                     IP graylog
graylog_11         1 p STARTED                     IP graylog
graylog_11         0 p STARTED                     IP graylog
graylog_39         2 p STARTED      312826 286.3mb IP graylog
graylog_39         3 p STARTED      312863 287.4mb IP graylog
graylog_39         1 p STARTED      312843 289.3mb IP graylog
graylog_39         0 p STARTED      312129 288.7mb IP graylog
fortigate__25      2 p STARTED                     IP graylog
fortigate__25      3 p STARTED                     IP graylog
fortigate__25      1 p STARTED                     IP graylog
fortigate__25      0 p STARTED                     IP graylog
graylog_38         2 p STARTED      319826 295.2mb IP graylog
graylog_38         3 p STARTED      320340 293.1mb IP graylog
graylog_38         1 p STARTED      319352 293.2mb IP graylog
graylog_38         0 p STARTED      320965 292.9mb IP graylog
fortigate__8       2 p STARTED                     IP graylog
fortigate__8       3 p STARTED                     IP graylog
fortigate__8       1 p STARTED                     IP graylog
fortigate__8       0 p STARTED                     IP graylog
graylog_10         2 p STARTED                     IP graylog
graylog_10         3 p STARTED                     IP graylog
graylog_10         1 p STARTED                     IP graylog
graylog_10         0 p STARTED                     IP graylog
graylog_30         2 p STARTED      868007 753.3mb IP graylog
graylog_30         3 p STARTED      866445 751.6mb IP graylog
graylog_30         1 p STARTED      866420 751.6mb IP graylog
graylog_30         0 p STARTED      868781 753.2mb IP graylog
graylog_15         2 p STARTED                     IP graylog
graylog_15         3 p STARTED                     IP graylog
graylog_15         1 p STARTED                     IP graylog
graylog_15         0 p STARTED                     IP graylog
fortigate__9       2 p STARTED                     IP graylog
fortigate__9       3 p STARTED                     IP graylog
fortigate__9       1 p STARTED                     IP graylog
fortigate__9       0 p STARTED                     IP graylog
fortigate__5       2 p STARTED                     IP graylog
fortigate__5       3 p STARTED                     IP graylog
fortigate__5       1 p STARTED                     IP graylog
fortigate__5       0 p STARTED                     IP graylog
gl-events_0        2 p UNASSIGNED                                
gl-events_0        3 p UNASSIGNED                                
gl-events_0        1 p UNASSIGNED                                
gl-events_0        0 p UNASSIGNED                                
graylog_24         2 p STARTED                     IP graylog
graylog_24         3 p STARTED                     IP graylog
graylog_24         1 p STARTED                     IP graylog
graylog_24         0 p STARTED                     IP graylog
fortigate__16      2 p STARTED                     IP graylog
fortigate__16      3 p STARTED                     IP graylog
fortigate__16      1 p STARTED                     IP graylog
fortigate__16      0 p STARTED                     IP graylog
graylog_36         2 p STARTED      901718 790.6mb IP graylog
graylog_36         3 p STARTED      900277 790.5mb IP graylog
graylog_36         1 p STARTED      900717   790mb IP graylog
graylog_36         0 p STARTED      901594 791.1mb IP graylog
graylog_2          2 p STARTED                     IP graylog
graylog_2          3 p STARTED                     IP graylog
graylog_2          1 p STARTED                     IP graylog
graylog_2          0 p STARTED                     IP graylog
gl-events_2        2 p STARTED      768971 146.6mb IP graylog
gl-events_2        3 p STARTED      767087 146.3mb IP graylog
gl-events_2        1 p STARTED      767359 146.9mb IP graylog
gl-events_2        0 p STARTED      766878 146.8mb IP graylog

Indices settings:
Fortigate

Index prefix:
fortigate_
Shards:
4
Replicas:
0
Field type refresh interval:
5 seconds
Index rotation strategy:
Index Time
Rotation period:
P1D (1 day, a day)
Index retention strategy:
Close
Max number of indices:
10

Default

Index prefix:
graylog
Shards:
4
Replicas:
0
Field type refresh interval:
5 seconds
Index rotation strategy:
Index Time
Rotation period:
P1D (1 day, a day)
Index retention strategy:
Close
Max number of indices:
20

I dont know what can I do?

2

if you only close your shards, you will not delete them. In the long run you will fill up your Elastic/Opensearch nodes.

3

@ihe is correct. You need to set your indices to delete after the number of indexes is reached. You will cause yourself much pain if you simply close them and leave them on the drive.

4

Ok, but I must store this logs through two years.
What can I do?

5
  1. add more diskspace
  2. set them to delete
  3. set your max number of indices to 365*2 = 730 if you keep your daily rotation (P1D)
  4. you might reconsider the number of shards per index. roughly 20-30GB/data per shard and rotation should be fine.
1 Like
6

So, how I should and what set for point numer 4?

7

How much logs do you have per day in each index set? Have a look at the index set:

grafik
grafik1046×76 9.15 KB

For this it is fine with only one shard per day. You have 4.

grafik
grafik869×61 4.58 KB

here we need at least 5 shards, maybe 6.

1 Like
8

Screenshots:
Deafult indices:

graylog
graylog993×160 19.3 KB

Fortigate - I dont know why in this is 60GB
fortigate
fortigate930×173 19.4 KB

9

both of your last indices, fortigate__38 and graylog_45, could not be rotated and are therefore quite big. The others will less then 3gb/day are to small for 4 shards. reduce the number of shards to 1 and maybe even increase your rotation to P1W (weekly) and rotate only 104 times.

1 Like
10

So, now this is ok?

fg
fg1183×156 9.09 KB

With this setting graylog will be work better and more stable?
What mena setting: Field type refresh interval: 5 seconds ?
And if I set index retention strategy to delete than shards older than 2 years will be deleted? How it works?

11

The problem is bigger than just storage space. The shards each take a certain amount of Java heap. If you keep all your data in Opensearch, you will likely need more Opensearch nodes. Take a look at this article for an explanation of what I mean. It’s written for Elasticsearch, but the same rules apply.

You do have the option of exploring Opensearch snapshots, but this scenario is the exact reason we added archiving to the commercial product. Archiving allows you to archive your older data to a compressed JSON file, rather than trying to keep it all live in Opensearch.

1 Like
12

your retention strategy is still “Close” and not “Delete”. with this config you will run into the same trouble.

did you thought about commercial support helping you with this problem?

13

Yes yes, I changed it.
No, we not have money for commerical license.

14

are you sure to have enough ressources (disk, CPU, RAM) to keep the data for two years? Requirements by your management seems to be high but budget low.
as a rule of thumb: for each 20 shards you should have 1GB of Heap for OpenSearch. For each GB of Heap you should have another GB of Ram for Operating System and Caches. And you should not have more than 30-32GB heap for opensearch per Node. Did you do some math, how many nodes you will need with how much ram after two years?

15

“Did you do some math, how many nodes you will need with how much ram after two years?”

No I dont know how I can do this good.

16

from those screenshots you can estimate your log volume for one day. better take a week, because you will have different volumes on weekends.
multiply that with the time you want to keep the logs.

17

I changed settings for 7 days, but one indices is open 2 motnhs, why?

ind
ind1306×330 28 KB

Settings

set
set1218×100 4.97 KB

How I can close it manualy?

18

your indices still did not rotate as they should - and this index is open since two month?

19

I dont know why.
See for my all indices:

green close fortigate__28      galDXrYwRTCvbZjt7hGmCw 4 0                              
green close graylog_25         C3aYYDEVTZapFexFttLlsA 4 0                              
green close graylog_24         U37NOaxeT72qC30mWp3QdA 4 0                              
green close fortigate__27      RTfLmfshT4eFutbiXYM5qg 4 0                              
green open  graylog_27         yBjJKZhlTxyXsb_eFgf7hg 4 0   6023220   0   5.1gb   5.1gb
green close fortigate__26      YyC9HJrCQU-y8pD_fAhKrQ 4 0                              
green close fortigate__25      29rBsfLmTeWZ1ufXWf3jxw 4 0                              
green open  graylog_26         X36BBqw-RCmSKPq5F0NHVA 4 0   6083147   0   5.1gb   5.1gb
green close fortigate__24      rOzBE-5_QhuYTPl9Sc9z-w 4 0                              
green open  graylog_29         hGoT8uh_TXGRLyGQ2oF2sA 4 0   4849124   0   4.1gb   4.1gb
green close fortigate__23      U-VtrFBuT8KfczTqA0oELQ 4 0                              
green open  graylog_28         O6ToEw2ETlmXBr6ZZ-e8Ww 4 0   5608058   0   4.8gb   4.8gb
green close fortigate__22      omxTnwIfTG22tlpswiWxwg 4 0                              
green close fortigate__21      suTWWvjyRE-GWYMeoesv4Q 4 0                              
green close fortigate__20      GsGxu9G2QMSotwaZ8oaiow 4 0                              
green open  graylog_30         hQ720zpDTDSNpSuveab3yA 4 0   3469653   0   2.9gb   2.9gb
green open  graylog_32         GBD_2yJ6SfWS4sROQh2nyw 4 0   1356948   0   1.2gb   1.2gb
green open  graylog_31         tDjp9qEGRdGDESKfJUl-Mg 4 0   1429747   0   1.2gb   1.2gb
green open  graylog_34         M7tdumK8SratcdXBJefqlA 4 0   3413864   0   2.9gb   2.9gb
green open  fortigate__29      Tt_I1kpbSxG4S7p-3sPwtg 4 0   1947672   0   1.5gb   1.5gb
green open  graylog_33         NZEB_NzoRC-GWYkOzQDygg 4 0   3303837   0   2.8gb   2.8gb
green close fortigate__17      UYcY9PoeSKOCu1NEseygDA 4 0                              
green open  graylog_36         1Rey5RGaT_eZp6S8LKhznA 4 0   3604306   0     3gb     3gb
green open  graylog_35         52RexX_jRFO3ougc6VMS_w 4 0   3296480   0   2.8gb   2.8gb
green close fortigate__16      yrGKF2LvSc6XEQ9dtpPO8w 4 0                              
green open  graylog_38         2YMLHnOUQQaDTR1etyCWpA 4 0   1280483   0   1.1gb   1.1gb
green close fortigate__15      51PzIUElTL6xg0RtHQO5WA 4 0                              
green open  graylog_37         PqTIpgJvSnS68k9vc4l5bA 4 0   3226928   0   2.7gb   2.7gb
green close fortigate__14      wVxOTdmwTcCN4FrilPf9YQ 4 0                              
green close fortigate__13      rJD97QxlSESHWnFCLYYkuw 4 0                              
green open  graylog_39         9AXKMLX3S5i7JwB6HuslGA 4 0   1250661   0   1.1gb   1.1gb
green close fortigate__12      mKM1q1xCRx29JwGugUyo3g 4 0                              
green close fortigate__11      rGFPeaNZQlqynXVVMl9boA 4 0                              
green close fortigate__10      EmH2VlEvRy2K1wbULunOBg 4 0                              
green open  graylog_41         KJVSfColS3SFnrLUYuJ8Mw 4 0   2330024   0     2gb     2gb
green open  graylog_40         yYcahx4oQGKoe1BbQrM2OA 4 0   1258214   0   1.1gb   1.1gb
green open  graylog_43         5ogXIkZITTiisC6iUmaNDw 4 0   3051216   0   2.6gb   2.6gb
green open  graylog_42         L0EWePNxR_OpbX5N5rH08A 4 0   1283219   0   1.1gb   1.1gb
green open  graylog_45         D_7_QtDARrqHYESQXcAB6g 4 0 165070364 535 142.3gb 142.3gb
green close fortigate__19      HiXNMYeXSoCgBmnawyyZfw 4 0                              
green close fortigate__18      _TlPfWhmRNCoxfm2EcqTww 4 0                              
green open  graylog_44         aaTqQtyrTpyqKU7D3Sh9WQ 4 0   2849698   0   2.4gb   2.4gb
green close fortigate__9       lNquZIAdQqauR-cSeaaJHg 4 0                              
green close fortigate__6       bIbmyfSzSzGOclAYxomzog 4 0                              
green close graylog_9          wgqasOLARNKBj1ugHmI8xQ 4 0                              
green close fortigate__5       BLB8LoQcRPOxTYji5CVSeg 4 0                              
green close graylog_8          M_gnynJKRkuSQxJz2yZqdw 4 0                              
green close graylog_7          OxHxPU9hRi2E3AyjMQFu4w 4 0                              
green close fortigate__8       eSaEvV75SuOVwJP6C6q6HQ 4 0                              
green close fortigate__7       fpy12bPNT8G89eLv9Vf5NA 4 0                              
green close graylog_6          RsNX_AamS5qxWo7XbK9onQ 4 0                              
green close fortigate__2       sGbUjBB7TUmU-dGrFlRvuQ 4 0                              
green close fortigate__1       csi6JtB1QFeeNoxdfykIfg 4 0                              
green close fortigate__4       06UpDO0fSbScah68b2yuLw 4 0                              
green close fortigate__3       ZtPymK0qTZmWgqQfrPNCJA 4 0                              
green close graylog_1          2SJ5o-CpTp6x0JwudJ3n5w 4 0                              
green close graylog_0          Qev5a0OdRAOJ6x8Z4f473w 4 0                              
green open  gl-system-events_0 x7bw10RrR0qUFAeeoK48Xg 4 0         0   0    832b    832b
green close fortigate__0       FpD4TagaSUqMM1Bzm-eyag 4 0                              
green close graylog_10         0OOZgJgITGOe7A44V4Ohrw 4 0                              
green close graylog_5          Ysz0CO_eRJ6PiTS44ma-aw 4 0                              
green close graylog_4          FXKt74GFRnWRTQhkMgDScg 4 0                              
green close graylog_3          2lKHj6xXTvC0dc-ThW6zsg 4 0                              
green close graylog_12         APmP7GBVSMK3UCDkNvEIsw 4 0                              
green close graylog_2          ZwhIHFQTQTqBu1PeIpvYCg 4 0                              
green close graylog_11         UUw6sbBlQOKLgz33VFJNQQ 4 0                              
green close graylog_14         jvW7_jyoR-CqbwOnqt_qIw 4 0                              
green open  fortigate__38      Gt7vyYQdSmCLp5i9PC5OqQ 4 0  92867372 848  71.9gb  71.9gb
green close graylog_13         C1P_O2mHROqR9csh72ariA 4 0                              
green close graylog_16         muweujQaQ8m8sSoJ1OIdGQ 4 0                              
green open  fortigate__37      QFYBdEr-RCiKFUWaYO9Y_Q 4 0   1953195   0   1.5gb   1.5gb
green close graylog_15         mKb4EC6sRLeP3rmwQsft7g 4 0                              
green open  fortigate__36      yJY0QhxBS4W8VOj6hGsa_A 4 0   2020239   0   1.5gb   1.5gb
green close graylog_18         G4Q4yE_3Qlm_jDq2TifyvQ 4 0                              
green open  fortigate__35      i_g-SOxmRiG3aWz9jabJbw 4 0   2006513   0   1.5gb   1.5gb
green close graylog_17         -n68mOcsRjiaXXFjjKXkjw 4 0                              
green open  fortigate__34      AoAyGp-aRWyb-MVBsRIVqA 4 0    343244   0 282.2mb 282.2mb
green open  fortigate__33      IjnEKOoRQKuqu8KxKuufHw 4 0    333702   0 277.2mb 277.2mb
green close graylog_19         jBIs-oaAQUSUVVwPW2ya8w 4 0                              
green open  fortigate__32      7Nt9fUDITzydh4ev_9YUSA 4 0   1845042   0   1.4gb   1.4gb
green open  fortigate__31      nGHwTV25Se-1DV1QTQ2Nmg 4 0   2163517   0   1.7gb   1.7gb
green open  gl-events_1        H5PUqOT6RMeZym1fE7nkOw 4 0   2845330   0   546mb   546mb
green open  gl-events_0        xzGVsf9WRgatiSse-igXCg 4 0    600877   0   114mb   114mb
green open  fortigate__30      yPOW4AX4S1Og88fGetNpJg 4 0   1831531   0   1.4gb   1.4gb
green open  gl-events_4        cll6rcxWQ-K4w8keIQr25w 4 0    695124   0 174.3mb 174.3mb
green open  gl-events_3        FX_d-XWfSyG2Uh7YIOGQYg 4 0   2740924 188 521.4mb 521.4mb
green open  gl-events_2        0AcxI_AZQsStmUsedOy8nw 4 0   3070295   0 586.8mb 586.8mb
green close graylog_21         pf1l13XTRcqO4FYDCZ0HLw 4 0                              
green close graylog_20         aoHzJ9V3THiaI8gfc2kgIA 4 0                              
green close graylog_23         v13LzcFQQhutyEI3B0iXFA 4 0                              
green close graylog_22         4nYr3OBqRuaN7sQNOhWM_A 4 0
20

@michaal1511 Please share a screenshot of your rotation and retention settings for each index set.