Elasticsearch stopped and can't start again

Here is log:

Apr 28 08:07:19 scw-fcc8a8 elasticsearch[3388]: 2020-04-28 08:07:18,907 main ERROR Null object returned for RollingFile in Appenders.
Apr 28 08:07:19 scw-fcc8a8 elasticsearch[3388]: 2020-04-28 08:07:18,907 main ERROR Null object returned for RollingFile in Appenders.
Apr 28 08:07:19 scw-fcc8a8 elasticsearch[3388]: 2020-04-28 08:07:18,908 main ERROR Null object returned for RollingFile in Appenders.
Apr 28 08:07:19 scw-fcc8a8 elasticsearch[3388]: 2020-04-28 08:07:18,908 main ERROR Unable to locate appender "rolling" for logger config "root"
Apr 28 08:07:19 scw-fcc8a8 elasticsearch[3388]: 2020-04-28 08:07:18,909 main ERROR Unable to locate appender "index_indexing_slowlog_rolling" for logger config "index.indexing.slowlog.index"
Apr 28 08:07:19 scw-fcc8a8 elasticsearch[3388]: 2020-04-28 08:07:18,909 main ERROR Unable to locate appender "index_search_slowlog_rolling" for logger config "index.search.slowlog"
Apr 28 08:07:19 scw-fcc8a8 elasticsearch[3388]: 2020-04-28 08:07:18,909 main ERROR Unable to locate appender "deprecation_rolling" for logger config "org.elasticsearch.deprecation"
Apr 28 08:07:19 scw-fcc8a8 systemd[1]: elasticsearch.service: Main process exited, code=exited, status=1/FAILURE
Apr 28 08:07:19 scw-fcc8a8 systemd[1]: elasticsearch.service: Unit entered failed state.
Apr 28 08:07:19 scw-fcc8a8 systemd[1]: elasticsearch.service: Failed with result 'exit-code'.

It is a single node 8GB RAM, 4GB heap size.
Before it is stopped it had a 90 indices, 3 shards each. So it can be too much. How can I recover it?

Could you share elasticsearch logs?

With 4gb of HEAP, I'd not put more than 80 shards. Here you have 270 shards which is probably too much.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.