# Elastic search status is red

**URL:** <https://discuss.elastic.co/t/elastic-search-status-is-red/176708>\
**Category:** Elasticsearch\
**Created:** [April 12, 2019, 11:16pm UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708 "2019-04-12T23:16:30Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [April 12, 2019, 11:16pm UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/1 "2019-04-12T23:16:30Z")

</div>

My Elastic search status is red in colour. How can i trouble shoot and fix this. There is no issue accessing and using it. But I was a bit concerned .

By the way I am running it on single server. There is no cluster setup.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0a93e176946d58868be310a50b9bf38da1436409.png)

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 13, 2019, 1:44am UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/2 "2019-04-13T01:44:39Z")

</div>

You have at least one index missing at least one primary shard.

Check:

```
GET _cat/health?v
GET _cat/indices?v
```

---

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [April 13, 2019, 5:37am UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/3 "2019-04-13T05:37:26Z")

</div>

I have deleted some of the red indices still I keep getting this filebeat indices.

GET \_cat/health?v

```
epoch timestamp cluster status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1555133477 05:31:17 elasticsearch red 1 1 147 147 0 0 10 0 - 93.6%

```

GET \_cat/indices?v  
Just added red ones here.

```
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
red open filebeat-6.7.0-2019.04.05 -9qSlGtvS2uSa65VCtKgwg 3 0 1314 0 627.5kb 627.5kb
red open filebeat-6.6.2-2019.04.02 evSL5jAyTCOIfv4SxMXnbQ 3 0 147 0 289.2kb 289.2kb
red open filebeat-6.7.0-2019.04.08 nOvZYqhATB2cwewlQOkFyQ 3 0 1136 0 551.2kb 551.2kb
red open filebeat-6.6.2-2019.04.05 VzGi8TksTTCwDtOQtYQ4NA 3 0 139 0 212.5kb 212.5kb
red open filebeat-6.6.2-2019.04.04 vGPDS5KFS82gzdsAGjAnpQ 3 0 103 0 250.4kb 250.4kb
red open filebeat-6.6.2-2019.04.01 lAenK5x3S6K34KivTiQrNA 3 0 54 0 165.4kb 165.4kb
red open filebeat-6.7.0-2019.04.04 o58QYOQnROqqxhat1FBnrQ 3 0 1307 0 569.8kb 569.8kb
red open filebeat-6.6.2-2019.04.03 lgBzoNz2S6Sed8IGAZ7tGQ 3 0 157 0 273.9kb 273.9kb
red open filebeat-6.6.2-2019.04.07 djEM-YxcSay7h5f2Zw06zA 3 0 115 0 189.8kb 189.8kb
red open filebeat-6.7.0-2019.04.01 3BXQq2-EQAiVXse62aQvwQ 3 0 431 0 426kb 426kb
```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 13, 2019, 6:12am UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/4 "2019-04-13T06:12:03Z")

</div>

You probably have too many shards per node.

May I suggest you look at the following resources about sizing:

[https://www.elastic.co/elasticon/conf/2016/sf/quantitative-cluster-sizing](https://www.elastic.co/elasticon/conf/2016/sf/quantitative-cluster-sizing)

> **[How many shards should I have in my Elasticsearch cluster?
	  	 | Elastic](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster)**
>
> Elasticsearch is a very versatile platform, that supports a variety of use cases, and provides great flexibility around data organisation and replication strategies. This flexibility can however somet...

https://www.slideshare.net/slideshow/embed_code/key/vR0XKDq4TGa77z

And [https://www.elastic.co/webinars/using-rally-to-get-your-elasticsearch-cluster-size-right](https://www.elastic.co/webinars/using-rally-to-get-your-elasticsearch-cluster-size-right)

---

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [April 13, 2019, 6:45am UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/5 "2019-04-13T06:45:08Z")

</div>

HI @dadoonet

I have seen this link earlier. It only refers to a cluster in elastic search. In my case I do not have a cluster I'm running ES on a single node. Currently I have a default indices per day as default. To reduce the shard size probably I need to move to weekly index. Not sure if that helps.

I have also added lifecycle management to delete indices after 10 days for metric data. But looks like its not working. I have added indices to these life cycle policies but I shows a 0 linked indices.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/a/ea01efcbf4ddf0ab10ba72cc116a99a95b5c7469.png)

I am also planning to use rollover indices. Haven't tried yet.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 13, 2019, 8:36am UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/6 "2019-04-13T08:36:47Z")

</div>

You do have a cluster. A cluster with onde node is a cluster.

> [@syedsfayaz](#):
>
> To reduce the shard size probably I need to move to weekly index. Not sure if that helps.

It will. And also change the number of shards to 1 will be a great win.

---

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [April 14, 2019, 4:49pm UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/7 "2019-04-14T16:49:15Z")

</div>

@dadoonet

Can you please tell me where I can set this limitation. I was looking at this page but its not clear should it be done in elasticsearch.yml or run from dev tool.

[https://www.elastic.co/guide/en/elasticsearch/reference/current/allocation-total-shards.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/allocation-total-shards.html)

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 14, 2019, 6:44pm UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/8 "2019-04-14T18:44:46Z")

</div>

It's an index setting. See [https://www.elastic.co/guide/en/elasticsearch/reference/7.0/indices-create-index.html#create-index-settings](https://www.elastic.co/guide/en/elasticsearch/reference/7.0/indices-create-index.html#create-index-settings)

---

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [April 14, 2019, 11:52pm UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/9 "2019-04-14T23:52:55Z")

</div>

I was looking at one of my indices which is red in status. I can see number of active shards as 1. Does it mean it has only one shard?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/a/4ac839e04fe604b502d05312ba39201d09e749b6.png)

What does the primaries indicate? I see this in common for indices which are red in color.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/9/d9c5ab5a246969ce419711e91574533dffb02969.png)

---

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [April 14, 2019, 11:59pm UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/10 "2019-04-14T23:59:18Z")

</div>

when I try to run this code snippet I get error. So where can i modify the index settings.

```
PUT filebeat-6.7.0-2019.04.01
{
    "settings" : {
        "number_of_shards" : 1,
        "number_of_replicas" : 0
    }
}

{
  "error": {
    "root_cause": [
      {
        "type": "resource_already_exists_exception",
        "reason": "index [filebeat-6.7.0-2019.04.01/3BXQq2-EQAiVXse62aQvwQ] already exists",
        "index_uuid": "3BXQq2-EQAiVXse62aQvwQ",
        "index": "filebeat-6.7.0-2019.04.01"
      }
    ],
    "type": "resource_already_exists_exception",
    "reason": "index [filebeat-6.7.0-2019.04.01/3BXQq2-EQAiVXse62aQvwQ] already exists",
    "index_uuid": "3BXQq2-EQAiVXse62aQvwQ",
    "index": "filebeat-6.7.0-2019.04.01"
  },
  "status": 400
}
```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 15, 2019, 3:24am UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/11 "2019-04-15T03:24:50Z")

</div>

You can't modify the number of primary shards for an existing index.  
Because you have only one node, no replicas, indices in RED are not complete and functional anymore. You should delete them.  
For the existing green/yellow ones you can use the shrink API to reduce the number of shards.

---

<div class="post-metadata">

**Author:** ![syedsfayaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syedsfayaz/32/46657_2.png) [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Post date:** [April 15, 2019, 3:28am UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/12 "2019-04-15T03:28:48Z")

</div>

Thanks for your reply. Is there a setting in Elastic search or Filebeat where I can define these settings before an index is created. Since I have daily indices being created I can limit the number of shards for those indices in future.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 15, 2019, 6:32am UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/13 "2019-04-15T06:32:16Z")

</div>

This is what index templates are made for.  
And filebeat has such a setting as well.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2019, 6:32am UTC](https://discuss.elastic.co/t/elastic-search-status-is-red/176708/14 "2019-05-13T06:32:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.