# Elasticsearch crash **URL:** \ **Category:** Elasticsearch\ **Created:** [March 19, 2018, 4:29pm UTC](https://discuss.elastic.co/t/elasticsearch-crash/124606 "2018-03-19T16:29:16Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [March 19, 2018, 4:29pm UTC](https://discuss.elastic.co/t/elasticsearch-crash/124606/1 "2018-03-19T16:29:16Z")
So it appears my Elasticsearch node crashed due to lucene memory issues. I have increased the memory and restarted Elasticsearch, but my logs are no longer showing in Kibana though they are in Elasticsearch. It looks like the old logs are in /var/lib/elasticsearch/nodes/0/... while the new logs are in .../nodes/1/... is there a way to fix this or have kibana look in both node areas for data? Thanks ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 19, 2018, 4:41pm UTC](https://discuss.elastic.co/t/elasticsearch-crash/124606/2 "2018-03-19T16:41:21Z")
It means that you probably started a new node on the machine while the other node was still running (or something made elasticsearch think that it was still running). Are you using an old version of elasticsearch by any chance? ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [March 19, 2018, 4:45pm UTC](https://discuss.elastic.co/t/elasticsearch-crash/124606/3 "2018-03-19T16:45:01Z")
I am using 2.4, boss's orders lol I went into kibana and seen an error stating it couldn't connect to elasticsearch or something like that. So I checked on the elasticsearch service and seen that it was running, so I attempted to restart it. It seemed to hang during the restart so I stopped the restart process and checked out the logs. That's when I found out the lucene memory issue. I force stopped elasticsearch and restarted it, but then all the old logs were not visible any longer, but were still under the /nodes/0/ directory while the new ones went to /nodes/1/. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 19, 2018, 5:05pm UTC](https://discuss.elastic.co/t/elasticsearch-crash/124606/4 "2018-03-19T17:05:46Z")
It went there because when you start 2 nodes on the same machine each node needs to write in his own directory. Version 5+ prevents that from happening. ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [March 19, 2018, 5:23pm UTC](https://discuss.elastic.co/t/elasticsearch-crash/124606/5 "2018-03-19T17:23:07Z")
Ah. So I could fix this by just moving the stuff in /node/0/ to /node/1/ correct or how should I go about seeing all the data again? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 19, 2018, 5:56pm UTC](https://discuss.elastic.co/t/elasticsearch-crash/124606/6 "2018-03-19T17:56:28Z")
If you do that (remove data 0 and rename data 1 as data 0) you will get back data that has been indexed recently but you will miss all the data that lived in data 0. You can't merge both dirs. I'd recommend reindexing what you indexed in data 1. ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [March 19, 2018, 7:07pm UTC](https://discuss.elastic.co/t/elasticsearch-crash/124606/7 "2018-03-19T19:07:24Z")
So you are saying my only option is to reindex the data from 0 to 1 if I want to keep my old data, correct? What about all the data in Kibana that is also missing like the dashboards and such? Is there a way to get that over too? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 16, 2018, 7:07pm UTC](https://discuss.elastic.co/t/elasticsearch-crash/124606/8 "2018-04-16T19:07:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.