Hi,
When i opened my dashboard , there was this sudden occurence of elastic search error.
Error Message:
Unable to execute search
Exception:
org.elasticsearch.action.search.SearchPhaseExecutionException
Not sure what exactly is this as this was not faced earlier . Can I please get a help on this, as this is a blockage and i am not able to see the logs.
what is the last action that is performend on the setup before this error occured?
I had set up long time ago to read my logs of application using filebeat. There was no recent update on my set up. NOt sure exactly how to debug this issue.
Well, the biggest question I have is: does the rest of Graylog still work? Is it just the one Dashboard broken? Or do you mean the actual Graylog interface (after logging in) when you say “dashboard”?
Graylog offers some useful status information under System in the main menubar. Under Overview you can see the current health of your ElasticSearch cluster.
Hi ,
Yes i meant after logging in, the interface what we get is the dashboard.
Under that when i checked the status it shows that:
Elasticsearch cluster is red. Shards: 0 active, 0 initializing, 0 relocating, 4 unassigned, What does this mean?
It means your ElasticSearch cluster is hosed. Dead. It has ceased to be.
Time for you to start digging! You’ll need to figure out how your infrastructure is built up… Which Elastic server(s) does your Graylog expect to talk to? Where are they located? Why is Elastic “missing”? Who changed something, when why where and how? These things usually don’t go tits-up without reason.
sorry like it is gone. ? but why what happened we didn’t touch anything in the configuration. Any way to recover and get the things working normally back?
There are always ways to bring a system back. I will repeat, literally, what I just said:
Time for you to start digging! You’ll need to figure out how your infrastructure is built up… Which Elastic server(s) does your Graylog expect to talk to? Where are they located? Why is Elastic “missing”? Who changed something, when why where and how? These things usually don’t go tits-up without reason.
You will need to understand the design and configuration of your environment. You’ll need to understand the parts that make up the Graylog stack and what the respective parts do. You’ll also need to figure out how to troubleshoot the individual components, because Graylog proper is the only product supported on these forums. MongoDB and ElasticSearch are products from different companies; we can help you with them, but not support them.
I usually start with google.
It is a fantastic tool for debugging.
//but I prefer to understand the tings, instead of post my error message in a community.
If you read graylog’s and elasticsearch’s log, the error was listed in it. (I’m sure…)
) the ES dies in OOM