# ES going down?
**URL:** https://discuss.elastic.co/t/es-going-down/21186
**Category:** Elasticsearch
**Created:** [December 10, 2014, 1:21pm UTC](https://discuss.elastic.co/t/es-going-down/21186 "2014-12-10T13:21:03Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Siddharth\_Trikha](https://discuss.elastic.co/u/Siddharth_Trikha)
#### Post date: [December 10, 2014, 1:21pm UTC](https://discuss.elastic.co/t/es-going-down/21186/1 "2014-12-10T13:21:03Z")
I am testing my ELK stack on a setup as follows:
Logs of multiple servers of 1week are placed centrally on a server by
rsyslog. So I have ~1week logs of placed in file structure like:
_Server-name/logdate/logname.log_
I counted number of log lines in all the files to know the count of number
of events (documents) that will go in ES which came out to be:
Size: 22177095 (~2 Crore) events
\*TESTCASE:\*Net _Data size to be read_ by logstash: 2.23 GB
No\_Of\_Files: 2379
openjdk version "1.8.0\_20"
64bit RED HAT Server
RAM: 32GB
ES heap: 4GB
Hard Disk: 600GB
I have only 1 node in my cluster. 5 shards 1 replica.
_Result:_
ES Stopped automatically after ~4hours.
From Kibana I can see out ~2crore log lines 1crore were read after that ES
stopped.
I check ES logs it just shows
_[2014-12-10 16:28:36,732][INFO][node] [Dr. Marla
Jameson] stopping ...[2014-12-10 16:28:37,346][INFO
][node] [Dr. Marla Jameson] stopped[2014-12-10
16:28:37,347][INFO][node] [Dr. Marla Jameson] closing
...[2014-12-10 16:28:37,381][INFO][node] [Dr. Marla
Jameson] closed_
But _no error message_.
And logstash logs:
_og4j, [2014-12-10T13:52:09.854] INFO: org.elasticsearch.discovery.zen:
[logstash-XXXX-18286-6068] master\_left
[[Toxin][zNiBpLdOTVG6uiyK\_Pg9WA][XXXX][inet[/xx.xx.xx.x:9301]]], reason
[transport disconnected (with verified connect)]log4j,
[2014-12-10T13:52:09.859] WARN: org.elasticsearch.discovery.zen:
[logstash-XXXX-18286-6068] master\_left and no other node elected to become
master, current nodes:
{[logstash-XXXX-18286-6068][RIlLo2hKQ0WvAGYnyTr9vQ][XXXX][inet[/xx.xx.xx.xx9300]]{data=false,
client=true},}log4j, [2014-12-10T13:52:09.860] INFO:
org.elasticsearch.cluster.service: [logstash-XXXX-18286-6068] removed
{[Toxin][zNiBpLdOTVG6uiyK\_Pg9WA][XXXX][inet[/xx.xx.xx.xx:9301]],}, reason:
zen-disco-master\_failed
([Toxin][zNiBpLdOTVG6uiyK\_Pg9WA][XXXX][inet[/xx.xx.xx.xx:9301]])_
Then when I restart ES and logstash, then again it reads logs from where it
left but then again ES goes down after ~1hour.
Is there a limit to size of an index?
When I do du -sh \* on my index:
640M 0
643M 1
640M 2
642M 3
634M 4
8.0K \_state
\*Why is ES going down without any error message?? \*How to solve this??
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/8dc7a449-7968-4a82-b367-a094893440b6%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8dc7a449-7968-4a82-b367-a094893440b6%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 10, 2014, 1:34pm UTC](https://discuss.elastic.co/t/es-going-down/21186/2 "2014-12-10T13:34:53Z")
If ES isn't crashing then something is stopping the process.
Are you using monit or anything like that?
On 10 December 2014 at 14:21, Siddharth Trikha [siddharthtrikha9@gmail.com](mailto:siddharthtrikha9@gmail.com)
wrote:
> I am testing my ELK stack on a setup as follows:
>
> Logs of multiple servers of 1week are placed centrally on a server by
> rsyslog. So I have ~1week logs of placed in file structure like:
>
> _Server-name/logdate/logname.log_
> I counted number of log lines in all the files to know the count of number
> of events (documents) that will go in ES which came out to be:
>
> Size: 22177095 (~2 Crore) events
>
> \*TESTCASE:\*Net _Data size to be read_ by logstash: 2.23 GB
> No\_Of\_Files: 2379
>
> openjdk version "1.8.0\_20"
> 64bit RED HAT Server
> RAM: 32GB
> ES heap: 4GB
> Hard Disk: 600GB
>
> I have only 1 node in my cluster. 5 shards 1 replica.
> _Result:_
>
> ES Stopped automatically after ~4hours.
> From Kibana I can see out ~2crore log lines 1crore were read after that ES
> stopped.
>
> I check ES logs it just shows
>
> _[2014-12-10 16:28:36,732][INFO][node] [Dr. Marla
> Jameson] stopping ...[2014-12-10 16:28:37,346][INFO
> ][node] [Dr. Marla Jameson] stopped[2014-12-10
> 16:28:37,347][INFO][node] [Dr. Marla Jameson] closing
> ...[2014-12-10 16:28:37,381][INFO][node] [Dr. Marla
> Jameson] closed_
> But _no error message_.
>
> And logstash logs:
>
> _og4j, [2014-12-10T13:52:09.854] INFO: org.elasticsearch.discovery.zen:
> [logstash-XXXX-18286-6068] master\_left
> [[Toxin][zNiBpLdOTVG6uiyK\_Pg9WA][XXXX][inet[/xx.xx.xx.x:9301]]], reason
> [transport disconnected (with verified connect)]log4j,
> [2014-12-10T13:52:09.859] WARN: org.elasticsearch.discovery.zen:
> [logstash-XXXX-18286-6068] master\_left and no other node elected to become
> master, current nodes:
> {[logstash-XXXX-18286-6068][RIlLo2hKQ0WvAGYnyTr9vQ][XXXX][inet[/xx.xx.xx.xx9300]]{data=false,
> client=true},}log4j, [2014-12-10T13:52:09.860] INFO:
> org.elasticsearch.cluster.service: [logstash-XXXX-18286-6068] removed
> {[Toxin][zNiBpLdOTVG6uiyK\_Pg9WA][XXXX][inet[/xx.xx.xx.xx:9301]],}, reason:
> zen-disco-master\_failed
> ([Toxin][zNiBpLdOTVG6uiyK\_Pg9WA][XXXX][inet[/xx.xx.xx.xx:9301]])_
>
> Then when I restart ES and logstash, then again it reads logs from where
> it left but then again ES goes down after ~1hour.
>
> Is there a limit to size of an index?
> When I do du -sh \* on my index:
>
> 640M 0
> 643M 1
> 640M 2
> 642M 3
> 634M 4
> 8.0K \_state
>
> \*Why is ES going down without any error message?? \*How to solve this??
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/8dc7a449-7968-4a82-b367-a094893440b6%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8dc7a449-7968-4a82-b367-a094893440b6%40googlegroups.com)
> [https://groups.google.com/d/msgid/elasticsearch/8dc7a449-7968-4a82-b367-a094893440b6%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/8dc7a449-7968-4a82-b367-a094893440b6%40googlegroups.com?utm_medium=email&utm_source=footer)
> .
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X9ENHyZKAg1B\_WMX%2B8D3Vo3-rugAhrxPW2BLa8muBW%2BCw%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X9ENHyZKAg1B_WMX%2B8D3Vo3-rugAhrxPW2BLa8muBW%2BCw%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:44am UTC](https://discuss.elastic.co/t/es-going-down/21186/3 "2017-07-06T00:44:29Z")