# Red status of elasticsearch **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [March 5, 2019, 8:26am UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248 "2019-03-05T08:26:10Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [March 5, 2019, 8:26am UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/1 "2019-03-05T08:26:10Z")
Hello! The elastic can not create an index graylog\_58. How can I understand why the status of elastic is red? I have everything in 1 place and graylog and elastic. Where can I see the logs and find out the reason? ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/e/ec9498b34c05172fb5ef342d56891aa4d0aa2f22.png) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/954926d1ee26bf29e0d329ed6a62aadacc5376e3.png) index is open but red. Could this be due to the fact that the disk is 92% busy? ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/13e8011ef55b0c1b00f2b16e97be5c4f0f292a78.png) ---
**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\ **Post date:** [March 5, 2019, 8:41am UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/2 "2019-03-05T08:41:35Z")
> **[Disk-based shard allocation | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/disk-allocator.html)** > `cluster.routing.allocation.disk.watermark.high` > Controls the high watermark. It defaults to `90%` , meaning that Elasticsearch will attempt to relocate shards away from a node whose disk usage is above 90%. It can also be set to an absolute byte value (similarly to the low watermark) to relocate shards away from a node if it has less than the specified amount of free space. This setting affects the allocation of all shards, whether previously allocated or not. It doesn’t mention it can’t allocate more shards, but I think it would be logical. You can check the elastic log also. [http://docs.graylog.org/en/2.5/pages/configuration/file\_location.html](http://docs.graylog.org/en/2.5/pages/configuration/file_location.html) ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [March 5, 2019, 8:56am UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/3 "2019-03-05T08:56:30Z")
What is wrong in my settings? Do I need more shards? I will edit the elasticsearch.yml file now. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/2c452acf51ed93044fd3dc725290b6bfe4df3490.png) And I understand correctly that with my settings, after 35 days will the logs be deleted that are older than 35 days? ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [March 5, 2019, 9:19am UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/4 "2019-03-05T09:19:43Z")
And if I understood correctly, then this command will give you the opportunity to find the indexes until 5 GB of free space remains on the disk? ``` curl -X PUT "localhost:9200/_cluster/settings" -H 'Content-Type: application/json' -d' { "transient": { "cluster.routing.allocation.disk.watermark.high": "5gb"} } ' ``` ---
**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\ **Post date:** [March 5, 2019, 10:14am UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/5 "2019-03-05T10:14:12Z")
Do whatever you want. First I suggest to thinking. What will the result if you - decrease the index numbers - set the high watermark to 5 gb? (spend 10 minutes with this question, based on your screens, you will open a new topic at the community with elatic cluster red again OR no disk space left) - (you)r client goes wrong, and send +1 GB data every day Do a fast research for this questions: - connection between shards and indices - elasticsearch no disk space left - elasticsearch suggested shard size After you find the answers to your questions, please let us know. > [@Uporaba](#): > > And I understand correctly that with my settings, after 35 days will the logs be deleted that are older than 35 days? yes. ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [March 5, 2019, 3:14pm UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/6 "2019-03-05T15:14:37Z")
okay, he opened 58 index, and start write, but status is red :c ``` red open graylog_58 nNUHlBKLRai61sPR0NouXg 8 0 39314 0 35.1mb 35.1mb ``` ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [March 5, 2019, 3:16pm UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/7 "2019-03-05T15:16:08Z")
Lol wtf 😃 49 years ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/6/61ea57dfeea79820c7be0756ad32de03fb5cb895.png) ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [March 5, 2019, 3:32pm UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/8 "2019-03-05T15:32:19Z")
okay i writed `service elasticsearch restart` and status red was down. ---
**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\ **Post date:** [March 5, 2019, 3:32pm UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/9 "2019-03-05T15:32:20Z")
check your first picture. the status of graylog\_58 index was the same, so no changes. red means not all primary shards are available. ---
**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\ **Post date:** [March 5, 2019, 3:32pm UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/10 "2019-03-05T15:32:45Z")
maybe one of your clients sends log with epoch 0 time. ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [March 5, 2019, 3:33pm UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/11 "2019-03-05T15:33:30Z")
i know. And when i go to /var/log/ealsticsearch/graylog.log and dont find any logs ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [March 5, 2019, 3:34pm UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/12 "2019-03-05T15:34:06Z")
what **epoch** is this? ---
**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\ **Post date:** [March 5, 2019, 3:36pm UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/13 "2019-03-05T15:36:23Z")
I would like to share my best friend’s resource with you. > **[LMGTFY](http://lmgtfy.com/?q=epoch+time)** > > LMGTFY ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [March 5, 2019, 3:50pm UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/14 "2019-03-05T15:50:15Z")
Elasticsearch has changed the default behaviour to close indices on low-watermark. What means you can’t ingest any new messages. Your 92% usage of available space would mean you have hit the low-watermark limit. In graylog you should go to `System > indices > default index set` and hit `Maintenancen > Recalculate index range` once you have added more space or deleted messages to fix the knowledge of Graylog about the available data. ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [March 5, 2019, 3:59pm UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/15 "2019-03-05T15:59:17Z")
aahahh, okay, i understanded. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [March 19, 2019, 4:03pm UTC](https://community.graylog.org/t/red-status-of-elasticsearch/9248/16 "2019-03-19T16:03:14Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.