# Elasticsearch gets shut down automatically **URL:** \ **Category:** Elasticsearch\ **Created:** [July 14, 2017, 5:27am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114 "2017-07-14T05:27:46Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![utkgarg](https://avatars.discourse-cdn.com/v4/letter/u/e19b73/32.png) [@utkgarg](https://discuss.elastic.co/u/utkgarg)\ **Post date:** [July 14, 2017, 5:27am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/1 "2017-07-14T05:27:46Z")
I am running elasticsearch on a 2GB RAM server. But sometimes the elasticsearch server automatically gets shuts down. How can I sort this problem? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 14, 2017, 7:59am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/2 "2017-07-14T07:59:55Z")
What does your node configuration look like? Is there anything in the logs? Which version of Elasticsearch are you using? What operating system? ---
**Author:** ![utkgarg](https://avatars.discourse-cdn.com/v4/letter/u/e19b73/32.png) [@utkgarg](https://discuss.elastic.co/u/utkgarg)\ **Post date:** [July 14, 2017, 9:04am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/3 "2017-07-14T09:04:40Z")
I am using Elasticsearch 1.7.5 on Ubuntu 16.04.2. I have not enabled logging manually. Is there any pre-enabled logging system? How can I check the logs if there is? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 14, 2017, 9:19am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/4 "2017-07-14T09:19:18Z")
The location of the log directory will depend on how you installed it, but should be specified in the elasticsearch.yml file. How much data do you have in the cluster? How many indices and shards? What is the heap size set to? ---
**Author:** ![utkgarg](https://avatars.discourse-cdn.com/v4/letter/u/e19b73/32.png) [@utkgarg](https://discuss.elastic.co/u/utkgarg)\ **Post date:** [July 14, 2017, 9:22am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/5 "2017-07-14T09:22:33Z")
Everything is set to default. I have not created clusters manually. I am using elasticsearch in a Django project for indexing with django-haystack as front-end for querying in the indexes. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 14, 2017, 9:24am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/6 "2017-07-14T09:24:43Z")
How much data do you have in the cluster? How many indices and shards? You can check this with the [cat indices API](https://www.elastic.co/guide/en/elasticsearch/reference/1.7/cat-indices.html) and [cat nodes API](https://www.elastic.co/guide/en/elasticsearch/reference/1.7/cat-nodes.html). ---
**Author:** ![utkgarg](https://avatars.discourse-cdn.com/v4/letter/u/e19b73/32.png) [@utkgarg](https://discuss.elastic.co/u/utkgarg)\ **Post date:** [July 14, 2017, 9:35am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/7 "2017-07-14T09:35:17Z")
I get the following single row when I run the command `curl -XGET 'localhost:9200/_cat/indices/'` : `yellow open haystack 5 1 3693 26 19.1mb 19.1mb` ---
**Author:** ![utkgarg](https://avatars.discourse-cdn.com/v4/letter/u/e19b73/32.png) [@utkgarg](https://discuss.elastic.co/u/utkgarg)\ **Post date:** [July 14, 2017, 9:37am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/8 "2017-07-14T09:37:58Z")
And the following row when I run `curl -XGET 'localhost:9200/_cat/nodes/` : ``` Thakurani 127.0.1.1 12 86 0.02 d * Zero-G ``` ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 14, 2017, 10:57am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/9 "2017-07-14T10:57:49Z")
That does not look like a lot of data that would cause an OOM, even given the small heap. You need to have a look in the logs around the times it went down to see if there are any clues. ---
**Author:** ![utkgarg](https://avatars.discourse-cdn.com/v4/letter/u/e19b73/32.png) [@utkgarg](https://discuss.elastic.co/u/utkgarg)\ **Post date:** [July 14, 2017, 11:06am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/10 "2017-07-14T11:06:55Z")
I am posting the contents of the log file on one of the days the server got shut down. Can you please check through the log if there is a hint. > [2017-07-13 07:14:07,304][INFO][node] [Taurus] version[1.7.5], pid[973], build[00f95f4/2016-02-02T09:55:30Z] > [2017-07-13 07:14:07,306][INFO][node] [Taurus] initializing ... > [2017-07-13 07:14:07,404][INFO][plugins] [Taurus] loaded , sites > [2017-07-13 07:14:07,455][INFO][env] [Taurus] using [1] data paths, mounts [[/ (/dev/vda1)]], net usable\_space [23.1gb], net total\_space [39.2gb], types [ext4] > [2017-07-13 07:14:10,193][INFO][node] [Taurus] initialized > [2017-07-13 07:14:10,193][INFO][node] [Taurus] starting ... > [2017-07-13 07:14:10,369][INFO][transport] [Taurus] bound\_address {inet[/127.0.0.1:9300]}, publish\_address {inet[localhost/127.0.0.1:9300]} > [2017-07-13 07:14:10,401][INFO][discovery] [Taurus] elasticsearch/W9-u8JbdRxe1rTXMpoeimA > [2017-07-13 07:14:14,204][INFO][cluster.service] [Taurus] new\_master [Taurus][W9-u8JbdRxe1rTXMpoeimA][Thakurani][inet[localhost/127.0.0.1:9300]], reason: zen-disco-join (elected\_as\_master) > [2017-07-13 07:14:14,263][INFO][http] [Taurus] bound\_address {inet[/127.0.0.1:9200]}, publish\_address {inet[localhost/127.0.0.1:9200]} > [2017-07-13 07:14:14,264][INFO][node] [Taurus] started > [2017-07-13 07:14:14,373][INFO][gateway] [Taurus] recovered [1] indices into cluster\_state > [2017-07-13 07:14:22,917][INFO][node] [Taurus] stopping ... > [2017-07-13 07:14:23,007][INFO][node] [Taurus] stopped > [2017-07-13 07:14:23,007][INFO][node] [Taurus] closing ... > [2017-07-13 07:14:23,012][INFO][node] [Taurus] closed > [2017-07-13 07:14:23,755][INFO][node] [Suicide] version[1.7.5], pid[1050], build[00f95f4/2016-02-02T09:55:30Z] > [2017-07-13 07:14:23,756][INFO][node] [Suicide] initializing ... > [2017-07-13 07:14:23,851][INFO][plugins] [Suicide] loaded , sites > [2017-07-13 07:14:23,894][INFO][env] [Suicide] using [1] data paths, mounts [[/ (/dev/vda1)]], net usable\_space [23.1gb], net total\_space [39.2gb], types [ext4] > [2017-07-13 07:14:26,490][INFO][node] [Suicide] initialized > [2017-07-13 07:14:26,491][INFO][node] [Suicide] starting ... > [2017-07-13 07:14:26,744][INFO][transport] [Suicide] bound\_address {inet[/127.0.0.1:9300]}, publish\_address {inet[localhost/127.0.0.1:9300]} > [2017-07-13 07:14:26,761][INFO][discovery] [Suicide] elasticsearch/XXx72m\_LS3acX1jDDRZlyA > [2017-07-13 07:14:30,536][INFO][cluster.service] [Suicide] new\_master [Suicide][XXx72m\_LS3acX1jDDRZlyA][Thakurani][inet[localhost/127.0.0.1:9300]], reason: zen-disco-join (elected\_as\_master) > [2017-07-13 07:14:30,567][INFO][http] [Suicide] bound\_address {inet[/127.0.0.1:9200]}, publish\_address {inet[localhost/127.0.0.1:9200]} > [2017-07-13 07:14:30,568][INFO][node] [Suicide] started > [2017-07-13 07:14:30,616][INFO][gateway] [Suicide] recovered [1] indices into cluster\_state > [2017-07-13 07:14:57,212][INFO][node] [Suicide] stopping ... > [2017-07-13 07:14:57,309][INFO][node] [Suicide] stopped > [2017-07-13 07:14:57,310][INFO][node] [Suicide] closing ... > [2017-07-13 07:14:57,318][INFO][node] [Suicide] closed > [2017-07-13 07:14:57,947][INFO][node] [Michael Twoyoungmen] version[1.7.5], pid[1138], build[00f95f4/2016-02-02T09:55:30Z] > [2017-07-13 07:14:57,948][INFO][node] [Michael Twoyoungmen] initializing ... > [2017-07-13 07:14:58,030][INFO][plugins] [Michael Twoyoungmen] loaded , sites > [2017-07-13 07:14:58,071][INFO][env] [Michael Twoyoungmen] using [1] data paths, mounts [[/ (/dev/vda1)]], net usable\_space [23.1gb], net total\_space [39.2gb], types [ext4] > [2017-07-13 07:15:00,925][INFO][node] [Michael Twoyoungmen] initialized > [2017-07-13 07:15:00,926][INFO][node] [Michael Twoyoungmen] starting ... > [2017-07-13 07:15:01,158][INFO][transport] [Michael Twoyoungmen] bound\_address {inet[/127.0.0.1:9300]}, publish\_address {inet[localhost/127.0.0.1:9300]} > [2017-07-13 07:15:01,176][INFO][discovery] [Michael Twoyoungmen] elasticsearch/Lw\_Y9BlrTa6wmCJYKBO7-w > [2017-07-13 07:15:04,962][INFO][cluster.service] [Michael Twoyoungmen] new\_master [Michael Twoyoungmen][Lw\_Y9BlrTa6wmCJYKBO7-w][Thakurani][inet[localhost/127.0.0.1:9300]], reason: zen-disco-join (elected\_as\_master) > [2017-07-13 07:15:04,989][INFO][http] [Michael Twoyoungmen] bound\_address {inet[/127.0.0.1:9200]}, publish\_address {inet[localhost/127.0.0.1:9200]} > [2017-07-13 07:15:04,990][INFO][node] [Michael Twoyoungmen] started > [2017-07-13 07:15:05,107][INFO][gateway] [Michael Twoyoungmen] recovered [1] indices into cluster\_state ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 14, 2017, 11:12am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/11 "2017-07-14T11:12:26Z")
There are no errors or anything indicating a crash, so it looks like it may have been deliberately restarted, but I can not tell for sure. ---
**Author:** ![utkgarg](https://avatars.discourse-cdn.com/v4/letter/u/e19b73/32.png) [@utkgarg](https://discuss.elastic.co/u/utkgarg)\ **Post date:** [July 14, 2017, 11:15am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/12 "2017-07-14T11:15:24Z")
There are a few rows with the word [Suicide]. Do these rows give a hint to the problem? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 14, 2017, 11:16am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/13 "2017-07-14T11:16:52Z")
No, that is the name of the node, which gets randomly assigned on startup in Elasticsearch 1.7. ---
**Author:** ![utkgarg](https://avatars.discourse-cdn.com/v4/letter/u/e19b73/32.png) [@utkgarg](https://discuss.elastic.co/u/utkgarg)\ **Post date:** [July 14, 2017, 11:18am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/14 "2017-07-14T11:18:19Z")
Okay. Can increasing the RAM size from 2 GB to more be of help? The server is not dedicated to Elasticsearch only. We are running a full website on the server with elasticsearch as a service. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 14, 2017, 11:23am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/15 "2017-07-14T11:23:13Z")
I don't see any indication that memory in Elasticsearch is a problem. If other applications share the host, their memory usage may have had an impact and cause d the OS to shut down the node. You may need to look for that kind of information in the system logs. ---
**Author:** ![utkgarg](https://avatars.discourse-cdn.com/v4/letter/u/e19b73/32.png) [@utkgarg](https://discuss.elastic.co/u/utkgarg)\ **Post date:** [July 14, 2017, 11:25am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/16 "2017-07-14T11:25:17Z")
Okay. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 14, 2017, 11:29am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/17 "2017-07-14T11:29:28Z")
Given the low amount of data in the cluster, you might also be able to reduce the heap Elasticsearch uses from 1GB (believe this is the default) to 512MB. ---
**Author:** ![utkgarg](https://avatars.discourse-cdn.com/v4/letter/u/e19b73/32.png) [@utkgarg](https://discuss.elastic.co/u/utkgarg)\ **Post date:** [July 14, 2017, 11:35am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/18 "2017-07-14T11:35:47Z")
Okay ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 11, 2017, 11:36am UTC](https://discuss.elastic.co/t/elasticsearch-gets-shut-down-automatically/93114/19 "2017-08-11T11:36:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.