# ElasticSearch on Yellow status && "unassigned\_shards" : 985 **URL:** \ **Category:** Elasticsearch\ **Created:** [April 17, 2019, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252 "2019-04-17T09:27:11Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![Zanruin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zanruin/32/44301_2.png) [@Zanruin](https://discuss.elastic.co/u/Zanruin)\ **Post date:** [April 17, 2019, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/1 "2019-04-17T09:27:11Z")
Hey guys, I configured an ELK stack server (CentOS), I configured winlogbeat in one windows with the default parameter. After I started streaming the logs to the ELK server, the server got stuck. I guess the reason its too much logs sent to the ELK server. I runned the command: `curl -XGET 'localhost:9200/_cluster/health?pretty'` the Output: `"cluster_name" : "elasticsearch", "status" : "yellow", "timed_out" : false, "number_of_nodes" : 1, "number_of_data_nodes" : 1, "active_primary_shards" : 1007, "active_shards" : 1007, "relocating_shards" : 0, "initializing_shards" : 0, "unassigned_shards" : 985, "delayed_unassigned_shards" : 0, "number_of_pending_tasks" : 0, "number_of_in_flight_fetch" : 0, "task_max_waiting_in_queue_millis" : 0, "active_shards_percent_as_number" : 50.55220883534136` There is a lot of unassigned\_shards, Is it possible that make the problem? Do anyone have a dummy configuration to set the .yml in my windows server? ---
**Author:** ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)\ **Post date:** [April 17, 2019, 9:37am UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/2 "2019-04-17T09:37:03Z")
I think the problem is not the amount of logs but the amount of replicas assigned when the index are created. Because you have only one data node, you cannot have replicas because primary and replicas cannot be in the same node. Therefore you have all those unassigned shards. I believe you need to change the template settings in winlogbeat so index are created without replicas: [https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-template.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-template.html) ---
**Author:** ![Zanruin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zanruin/32/44301_2.png) [@Zanruin](https://discuss.elastic.co/u/Zanruin)\ **Post date:** [April 17, 2019, 10:48am UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/3 "2019-04-17T10:48:31Z")
Thank you, Ignacio. The changes I need to do is in the ELK stack? ---
**Author:** ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)\ **Post date:** [April 17, 2019, 10:49am UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/4 "2019-04-17T10:49:23Z")
I think they need to be done on the winlogbeat. See the link above. ---
**Author:** ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)\ **Post date:** [April 17, 2019, 10:52am UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/5 "2019-04-17T10:52:25Z")
Of course, if you want to change the setting in existing indices you need to do it in elasticsearch using the following API: [https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-update-settings.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-update-settings.html) ---
**Author:** ![Zanruin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zanruin/32/44301_2.png) [@Zanruin](https://discuss.elastic.co/u/Zanruin)\ **Post date:** [April 17, 2019, 12:54pm UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/6 "2019-04-17T12:54:37Z")
It didnt help me at all, when i start the service Elastic search i get logs. ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/c/9c6c473f9d630284b69116df26d353f7fa26d540.png) what can i do? ---
**Author:** ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)\ **Post date:** [April 17, 2019, 1:10pm UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/7 "2019-04-17T13:10:55Z")
Sorry to hear that, could you provide more information about what you have done so we can get a better picture? It would be good if you share how your index looks like, using the indices API. For example" ```auto GET ``` ---
**Author:** ![Zanruin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zanruin/32/44301_2.png) [@Zanruin](https://discuss.elastic.co/u/Zanruin)\ **Post date:** [April 17, 2019, 1:28pm UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/8 "2019-04-17T13:28:42Z")
Im sorry for being annoying. How am i suppose to do that? From the LinuxServer or from kibana? ---
**Author:** ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)\ **Post date:** [April 17, 2019, 1:31pm UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/9 "2019-04-17T13:31:46Z")
From Kibana, if you want to do it from a LinuxServer you would need to do it using CURL: ```auto curl -X GET "your-host:your-port/your-index" ``` for example: ```auto curl -X GET "localhost:9200/apm-telemetry" ``` ---
**Author:** ![Zanruin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zanruin/32/44301_2.png) [@Zanruin](https://discuss.elastic.co/u/Zanruin)\ **Post date:** [April 17, 2019, 1:40pm UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/10 "2019-04-17T13:40:27Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/b/1/b1f9da306da39988b42c5e140e1f19e6dfa74fa9.png) its a really long output. Anyways, Im still testing this ELK server. Maybe the best way to delete everything... ---
**Author:** ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)\ **Post date:** [April 17, 2019, 1:46pm UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/11 "2019-04-17T13:46:52Z")
If you are testing I would try to start again making sure that the following setting in winlogbeat.yml is set to 0: ```auto index.number_of_replicas: 0 ``` If you only have a node, it does not make sense to have replicas. ---
**Author:** ![Zanruin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zanruin/32/44301_2.png) [@Zanruin](https://discuss.elastic.co/u/Zanruin)\ **Post date:** [April 17, 2019, 1:50pm UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/12 "2019-04-17T13:50:34Z")
there is a way to clear all indexes and make it from scratch? ---
**Author:** ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)\ **Post date:** [April 17, 2019, 1:56pm UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/13 "2019-04-17T13:56:45Z")
You can do it using a wildcard: ```auto curl -X DELETE "localhost:9200/*" ``` Note that this will delete the Kibana index so you will need to restart it again so the index is recreated. ---
**Author:** ![Zanruin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zanruin/32/44301_2.png) [@Zanruin](https://discuss.elastic.co/u/Zanruin)\ **Post date:** [April 18, 2019, 6:09am UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/14 "2019-04-18T06:09:08Z")
That will remove all the indexes and all the shards? Do you think my elk will go back to life? ---
**Author:** ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)\ **Post date:** [April 18, 2019, 7:04am UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/15 "2019-04-18T07:04:27Z")
Yes, that should remove all data from the cluster. ---
**Author:** ![Zanruin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zanruin/32/44301_2.png) [@Zanruin](https://discuss.elastic.co/u/Zanruin)\ **Post date:** [April 21, 2019, 10:21am UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/16 "2019-04-21T10:21:08Z")
Thanks for the help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 19, 2019, 10:26am UTC](https://discuss.elastic.co/t/elasticsearch-on-yellow-status-unassigned-shards-985/177252/17 "2019-05-19T10:26:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.