# Unable to execute search Exception: org.elasticsearch.action.search.SearchPhaseExecutionException **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [February 7, 2019, 10:13am UTC](https://community.graylog.org/t/unable-to-execute-search-exception-org-elasticsearch-action-search-searchphaseexecutionexception/8739 "2019-02-07T10:13:07Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![abhishek](https://avatars.discourse-cdn.com/v4/letter/a/7ba0ec/32.png) [@abhishek](https://community.graylog.org/u/abhishek)\ **Post date:** [February 7, 2019, 10:13am UTC](https://community.graylog.org/t/unable-to-execute-search-exception-org-elasticsearch-action-search-searchphaseexecutionexception/8739/1 "2019-02-07T10:13:07Z")
Hi, When i opened my dashboard , there was this sudden occurence of elastic search error. Error Message: Unable to execute search Exception: `org.elasticsearch.action.search.SearchPhaseExecutionException` Not sure what exactly is this as this was not faced earlier . Can I please get a help on this, as this is a blockage and i am not able to see the logs. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [February 7, 2019, 10:41am UTC](https://community.graylog.org/t/unable-to-execute-search-exception-org-elasticsearch-action-search-searchphaseexecutionexception/8739/2 "2019-02-07T10:41:19Z")
what is the last action that is performend on the setup before this error occured? ---
**Author:** ![abhishek](https://avatars.discourse-cdn.com/v4/letter/a/7ba0ec/32.png) [@abhishek](https://community.graylog.org/u/abhishek)\ **Post date:** [February 7, 2019, 10:49am UTC](https://community.graylog.org/t/unable-to-execute-search-exception-org-elasticsearch-action-search-searchphaseexecutionexception/8739/3 "2019-02-07T10:49:36Z")
I had set up long time ago to read my logs of application using filebeat. There was no recent update on my set up. NOt sure exactly how to debug this issue. ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [February 7, 2019, 11:20am UTC](https://community.graylog.org/t/unable-to-execute-search-exception-org-elasticsearch-action-search-searchphaseexecutionexception/8739/4 "2019-02-07T11:20:10Z")
Well, the biggest question I have is: does the rest of Graylog still work? Is it just the one Dashboard broken? Or do you mean the actual Graylog interface (after logging in) when you say “dashboard”? Graylog offers some useful status information under **System** in the main menubar. Under **Overview** you can see the current health of your ElasticSearch cluster. ---
**Author:** ![abhishek](https://avatars.discourse-cdn.com/v4/letter/a/7ba0ec/32.png) [@abhishek](https://community.graylog.org/u/abhishek)\ **Post date:** [February 7, 2019, 11:57am UTC](https://community.graylog.org/t/unable-to-execute-search-exception-org-elasticsearch-action-search-searchphaseexecutionexception/8739/5 "2019-02-07T11:57:34Z")
> [@Totally\_Not\_A\_Robot](#): > > Graylog offers some useful status information under **System** in Hi , Yes i meant after logging in, the interface what we get is the dashboard. Under that when i checked the status it shows that: ## Elasticsearch cluster **Elasticsearch cluster is red.** Shards: 0 active, 0 initializing, 0 relocating, 4 unassigned, [What does this mean?](http://docs.graylog.org/en/2.1/pages/configuration/elasticsearch.html#cluster-status-explained) ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [February 7, 2019, 12:25pm UTC](https://community.graylog.org/t/unable-to-execute-search-exception-org-elasticsearch-action-search-searchphaseexecutionexception/8739/6 "2019-02-07T12:25:19Z")
It means your ElasticSearch cluster is hosed. Dead. It has ceased to be. ![](https://cdck-file-uploads-us1.s3.dualstack.us-west-2.amazonaws.com/flex016/uploads/graylog/original/2X/6/62a7f62f207c47cba18708f4a2caa728b42f946e.gif) Time for you to start digging! You’ll need to figure out how your infrastructure is built up… Which Elastic server(s) does your Graylog expect to talk to? Where are they located? Why is Elastic “missing”? Who changed something, when why where and how? These things usually don’t go tits-up without reason. ---
**Author:** ![abhishek](https://avatars.discourse-cdn.com/v4/letter/a/7ba0ec/32.png) [@abhishek](https://community.graylog.org/u/abhishek)\ **Post date:** [February 7, 2019, 12:27pm UTC](https://community.graylog.org/t/unable-to-execute-search-exception-org-elasticsearch-action-search-searchphaseexecutionexception/8739/7 "2019-02-07T12:27:55Z")
sorry like it is gone. ? but why what happened we didn’t touch anything in the configuration. Any way to recover and get the things working normally back? ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [February 7, 2019, 12:34pm UTC](https://community.graylog.org/t/unable-to-execute-search-exception-org-elasticsearch-action-search-searchphaseexecutionexception/8739/8 "2019-02-07T12:34:12Z")
There are always ways to bring a system back. I will repeat, literally, what I just said: > Time for you to start digging! You’ll need to figure out how your infrastructure is built up… Which Elastic server(s) does your Graylog expect to talk to? Where are they located? Why is Elastic “missing”? Who changed something, when why where and how? These things usually don’t go tits-up without reason. You will need to understand the design and configuration of your environment. You’ll need to understand the parts that make up the Graylog stack and what the respective parts do. You’ll also need to figure out how to troubleshoot the individual components, because Graylog _proper_ is the only product supported on these forums. MongoDB and ElasticSearch are products from different companies; we can _help_ you with them, but not _support_ them. ---
**Author:** ![abhishek](https://avatars.discourse-cdn.com/v4/letter/a/7ba0ec/32.png) [@abhishek](https://community.graylog.org/u/abhishek)\ **Post date:** [February 12, 2019, 12:17pm UTC](https://community.graylog.org/t/unable-to-execute-search-exception-org-elasticsearch-action-search-searchphaseexecutionexception/8739/9 "2019-02-12T12:17:51Z")
can you please let me know the support link for elastic search. if you know ---
**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\ **Post date:** [February 12, 2019, 2:44pm UTC](https://community.graylog.org/t/unable-to-execute-search-exception-org-elasticsearch-action-search-searchphaseexecutionexception/8739/10 "2019-02-12T14:44:24Z")
//last time when I saw similar (search problem after a search 🙂 ) the ES dies in OOM ---
**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\ **Post date:** [February 12, 2019, 2:48pm UTC](https://community.graylog.org/t/unable-to-execute-search-exception-org-elasticsearch-action-search-searchphaseexecutionexception/8739/11 "2019-02-12T14:48:44Z")
I usually start with google. It is a fantastic tool for debugging. //but I prefer to understand the tings, instead of post my error message in a community. If you read graylog’s and elasticsearch’s log, the error was listed in it. (I’m sure…) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [February 26, 2019, 2:48pm UTC](https://community.graylog.org/t/unable-to-execute-search-exception-org-elasticsearch-action-search-searchphaseexecutionexception/8739/12 "2019-02-26T14:48:45Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.