# Cluster currently has \[1000\]/\[1000\] maximum normal shards open **URL:** \ **Category:** Elasticsearch\ **Tags:** ilm-index-lifecycle-management\ **Created:** [March 6, 2024, 10:42am UTC](https://discuss.elastic.co/t/cluster-currently-has-1000-1000-maximum-normal-shards-open/354830 "2024-03-06T10:42:12Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![diselkgd7](https://avatars.discourse-cdn.com/v4/letter/d/da6949/32.png) [@diselkgd7](https://discuss.elastic.co/u/diselkgd7)\ **Post date:** [March 6, 2024, 10:42am UTC](https://discuss.elastic.co/t/cluster-currently-has-1000-1000-maximum-normal-shards-open/354830/1 "2024-03-06T10:42:12Z")
I have what is like a Newbee question, I hope it makes sense how I explain it. I noticed that logs are not being ingested by my 1 node cluster and logstash complains about the maximum normal shards open - can you help me identify what I am doing wrong please. The output I have configured for logstash is directing the logs to this index ```auto index => "vmware_esxi-%{+YYYY.MM.dd}" ``` and I can see in kibana that the indices are being created and kept open what I've setup in terms of indexes is this: index template with Index pattern "vmware\_esxi-\*" ```auto { "index": { "lifecycle": { "name": "pci_1y" }, "number_of_shards": "1", "number_of_replicas": "1" } } ``` the index for yesterday is about 25.71gb and "GET /vmware\_esxi-2024.03.05" is ```auto { "vmware_esxi-2024.03.05": { "aliases": {}, "mappings": { "properties": { ... } }, "settings": { "index": { "routing": { "allocation": { "include": { "_tier_preference": "data_content" } } }, "number_of_shards": "1", "provided_name": "vmware_esxi-2024.03.05", "creation_date": "1709596800288", "number_of_replicas": "1", "uuid": "d1J6jTidS2Sp-FsycSKTCw", "version": { "created": "8060299" } } } } } ``` the ilm policy is this (obtained via "GET \_ilm/policy/pci\_1y") - if it says "indices": does that mean this is not applying to any indices? ```auto { "pci_1y": { "policy": { "phases": { "warm": { "min_age": "30d", "actions": { "set_priority": { "priority": 50 } } }, "cold": { "min_age": "90d", "actions": { "set_priority": { "priority": 0 } } }, "hot": { "min_age": "0ms", "actions": { "set_priority": { "priority": 100 }, "rollover": { "max_primary_shard_size": "50gb", "max_age": "30d" } } }, "delete": { "min_age": "365d", "actions": { "delete": { "delete_searchable_snapshot": true } } } } }, "in_use_by": { "indices": [], "data_streams": [], "composable_templates": [ "vmware_esxi" ] } } } ``` ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 6, 2024, 12:20pm UTC](https://discuss.elastic.co/t/cluster-currently-has-1000-1000-maximum-normal-shards-open/354830/2 "2024-03-06T12:20:05Z")
What is the output of: ```auto GET / GET /_cat/nodes?v GET /_cat/health?v GET /_cat/indices?v ``` If some outputs are too big, please share them on [gist.github.com](http://gist.github.com) and link them here. ---
**Author:** ![diselkgd7](https://avatars.discourse-cdn.com/v4/letter/d/da6949/32.png) [@diselkgd7](https://discuss.elastic.co/u/diselkgd7)\ **Post date:** [March 6, 2024, 10:40pm UTC](https://discuss.elastic.co/t/cluster-currently-has-1000-1000-maximum-normal-shards-open/354830/3 "2024-03-06T22:40:25Z")
Thanks, this is the output requested: GET / ```auto { "name": "pnl0000vspr4306", "cluster_name": "elasticsearch", "cluster_uuid": "ejYdH5t2QqWZ3hkF0hIquQ", "version": { "number": "8.6.2", "build_flavor": "default", "build_type": "rpm", "build_hash": "2d58d0f136141f03239816a4e360a8d17b6d8f29", "build_date": "2023-02-13T09:35:20.314882762Z", "build_snapshot": false, "lucene_version": "9.4.2", "minimum_wire_compatibility_version": "7.17.0", "minimum_index_compatibility_version": "7.0.0" }, "tagline": "You Know, for Search" } ``` GET /\_cat/nodes?v ```auto ip heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name 10.6.11.104 64 97 70 7.85 6.91 6.17 cdfhilmrstw * pnl0000vspr4306 ``` GET /\_cat/health?v ```auto epoch timestamp cluster status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent 1709764255 22:30:55 elasticsearch yellow 1 1 530 530 0 0 431 0 - 55.2% ``` GET /\_cat/indices?v > ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 15, 2024, 8:53pm UTC](https://discuss.elastic.co/t/cluster-currently-has-1000-1000-maximum-normal-shards-open/354830/4 "2024-03-15T20:53:35Z")
Thanks. Could you share the logstash logs? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 16, 2024, 9:38am UTC](https://discuss.elastic.co/t/cluster-currently-has-1000-1000-maximum-normal-shards-open/354830/5 "2024-03-16T09:38:03Z")
> [@diselkgd7](#): > > I noticed that logs are not being ingested by my 1 node cluster and logstash complains about the maximum normal shards open > [@diselkgd7](#): > > `"number_of_replicas": "1"` If you have a single node cluster you can not have any replicas. You therefore need to set this to `0` in your template and also change the number of replicas to `0` for all existing indices using the [update index settings API](https://www.elastic.co/guide/en/elasticsearch/reference/8.12/indices-update-settings.html). Even though Elasticsearch can never allocate these replica shards, they still count towards the maximum number of shards. > [@diselkgd7](#): > > `index => "vmware_esxi-%{+YYYY.MM.dd}"` > [@diselkgd7](#): > > ```auto > "hot": { > "min_age": "0ms", > "actions": { > "set_priority": { > "priority": 100 > }, > "rollover": { > "max_primary_shard_size": "50gb", > "max_age": "30d" > } > } > > ``` The index pattern you have configured indicates that you are not using rollover, but you still have rollover configured in your ILM policy. I think you need to fix this as I do not see how this policy could be working. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 16, 2024, 9:51am UTC](https://discuss.elastic.co/t/cluster-currently-has-1000-1000-maximum-normal-shards-open/354830/6 "2024-03-16T09:51:38Z")
> [@Christian\_Dahlqvist](#): > > Even though Elasticsearch can never allocate these replica shards, they still count towards the maximum number of shards. Things I learned! 😅 I was not expecting that but this makes sense. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 13, 2024, 9:52am UTC](https://discuss.elastic.co/t/cluster-currently-has-1000-1000-maximum-normal-shards-open/354830/7 "2024-04-13T09:52:01Z")
Closed on April 13, 2024, 9:52am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.