# No Output to ElasticSearch **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** sidecar, winlogbeat\ **Created:** [March 11, 2021, 4:32pm UTC](https://community.graylog.org/t/no-output-to-elasticsearch/19085 "2021-03-11T16:32:46Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![poisedforflight](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/poisedforflight/32/6729_2.png) [@poisedforflight](https://community.graylog.org/u/poisedforflight)\ **Post date:** [March 11, 2021, 4:32pm UTC](https://community.graylog.org/t/no-output-to-elasticsearch/19085/1 "2021-03-11T16:32:46Z")
I am using the Graylog 3.3.x and recently had the storage fill up. I was receiving this error in Graylog: ‘Journal utilization is too high and may go over the limit soon. Please verify that your Elasticsearch cluster is healthy and fast enough. You may also want to review your Graylog journal settings and set a higher limit.’ I grew the storage and it shows as available if I run a df-h. However, nothing is showing up on my input for my WinLogBeat input and nothing is showing as Output to ElasticSearch. I have stopped the services and deleted the journal file as I saw recommended in several posts but it did not correct the issue. Does anyone have any advice on how to further troubleshoot? It would be GREATLY appreciated. PS - this is what was showing in ElasticSearch logs earlier: [https://i.imgur.com/0QGXGtm.png](https://i.imgur.com/0QGXGtm.png) This is the latest entries: [https://i.imgur.com/wsy0h9E.png](https://i.imgur.com/wsy0h9E.png) ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [March 11, 2021, 5:16pm UTC](https://community.graylog.org/t/no-output-to-elasticsearch/19085/2 "2021-03-11T17:16:52Z")
Hi @poisedforflight This problem is related to your disk utilization in the Elasticsearch cluster. Journal is a machanism in Graylog to temporally store you data when ES cannot for some reason. In your case in particular, your ES Cluster isn’t receiving data to be indexed due to disk utilization. If you have spare space in your filesystem you can [change settings about the watermark in Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/7.11/modules-cluster.html#disk-based-shard-allocation). Otherwise you should consider move those data to another node with more space. Based on your Graylog version, I think you can work with [Elasticsearch ILM](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-lifecycle-management.html) to migrate data between nodes in order to avoid this problem. P.S.: If you’re considering migrate Graylog to v4 ILM is not an option, and you shold take a look [at this post](https://community.graylog.org/t/graylog-rewriting-index-template-in-elasticsearch/18901) to know how to proceed. ---
**Author:** ![poisedforflight](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/poisedforflight/32/6729_2.png) [@poisedforflight](https://community.graylog.org/u/poisedforflight)\ **Post date:** [March 11, 2021, 7:49pm UTC](https://community.graylog.org/t/no-output-to-elasticsearch/19085/3 "2021-03-11T19:49:46Z")
Thank you for your reply. I realize that was my initial issue but I currently have over 200GB of free space after the addition I made today. I am still not outputting any logs though. ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [March 11, 2021, 10:05pm UTC](https://community.graylog.org/t/no-output-to-elasticsearch/19085/4 "2021-03-11T22:05:15Z")
@poisedforflight my pleasure! can we pass over a little checklist? - Your free additional space was properlly recognized by the Operational System? - If so, is this the same filesystem that Elasticsearch is writing data? - I saw once Elasticsearch losing itself to write new data to the index. After you guarantee the two steps above are OK, can you try to restart your Elastichsearch and see if new data starts being indexed? ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [March 12, 2021, 1:47am UTC](https://community.graylog.org/t/no-output-to-elasticsearch/19085/5 "2021-03-12T01:47:32Z")
@poisedforflight > [@poisedforflight](#): > > Please verify that your Elasticsearch cluster is healthy and fast enough. Whats the status of your elasticsearch by chance? > curl -XGET [http://localhost:9200/\_cluster/health?pretty=true](http://localhost:9200/_cluster/health?pretty=true) > [@poisedforflight](#): > > I realize that was my initial issue but I currently have over 200GB of free space after the addition I made today. I am still not outputting any logs though How is your Input buffer, Process buffer and Output buffer? ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [March 26, 2021, 1:48am UTC](https://community.graylog.org/t/no-output-to-elasticsearch/19085/6 "2021-03-26T01:48:09Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.