# I can not login elastic **URL:** \ **Category:** Elasticsearch\ **Created:** [December 1, 2023, 4:54pm UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450 "2023-12-01T16:54:07Z")\ **Posts on this page:** 14\ **Page:** 2
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 10, 2023, 10:59pm UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/21 "2023-12-10T22:59:54Z")
> [@miladmohabati](#): > > Active: failed (Result: exit-code) since Sun 2023-12-10 09:21:53 Elasticsearch is not running > [@miladmohabati](#): > > java.base/java.nio.file.Files.createTempDirectory(Files.java:1017) There is no room in `/tmp` directory either You are going to need to clean up space in `/tmp` and other places otherwise elasticsearch is not going to run. ---
**Author:** ![miladmohabati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miladmohabati/32/128573_2.png) [@miladmohabati](https://discuss.elastic.co/u/miladmohabati)\ **Post date:** [December 11, 2023, 10:14am UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/24 "2023-12-11T10:14:21Z")
> [@miladmohabati](#): > > all logs in directory > Which of these should I remove? > > _ **root@srvelk:/var/lib/elasticsearch/indices# ls** _ > 09byaX0KQBqbln3AiMbhnw DOHzjbOnRpagkU6D6qPfTg jLIF61xpTRieUynHu-YCMw NgSJGkuTQCCUiKJbYvO9ig QYGZ0U0\_TjGgwiu5dETE5Q Wrgp26bbTlGTo6vYO3EOCQ > 48n18llpS2WyrQxyvCoywA GLd0Hpj1QTKXjixqdHjBqA \_keXg-3VQQewZwf07HWbaA O3LIsFtTQrqaj0spzHushA r8oGIwF-Rb-OEIHNuEPmcg W-wiCs-7ToaRr9KjOjC0Iw > 74wFVcAUQ-KCz66WKjLRmw GX8XNJOVSxmU7b115yFBdA lzSS14E1RKGA9lytBFUjXQ oe2borCxQ520NlD6Ok-Y2w SbjXxyw9Q2u\_WedT563dCw XTeuNnW1RECTf797ioMpoQ > A7Y5ZlG7QheXryHgK0fQpA iJ252YZ3Ty-ZWbx8MQihmA mduXWrTPSbeBzjVIGxFjlw OoAsfZ4NQGWUTPRNXt1klw sbPOoLn0QTax0nOFPAHPbQ Z6HqHHx7THeiV6lWF7wx0A > cNreQz6FQMygOhE2TnN3Uw ioJFg9NKTQCXMoayh3UaLg MoPXfnKTTbyV5YZI-QfVfw qmzZHzuwQj2DBaZWq8fplA TPlyNvgTTU64B4mAG6cn0g > D1OThSkmTx2\_Gg782Sb4Qg j3Cb75X3ToGjliv06Gzwdg NAS42JsdQbqhUTnzI6dvcw QuwLdRSZTbWrw9icoF4LhA wGU1lhc3ReGtaCQMYNKdkw all logs in directory Which of these should I remove? _ **root@srvelk:/var/lib/elasticsearch/indices# ls** _ 09byaX0KQBqbln3AiMbhnw DOHzjbOnRpagkU6D6qPfTg jLIF61xpTRieUynHu-YCMw NgSJGkuTQCCUiKJbYvO9ig QYGZ0U0\_TjGgwiu5dETE5Q Wrgp26bbTlGTo6vYO3EOCQ 48n18llpS2WyrQxyvCoywA GLd0Hpj1QTKXjixqdHjBqA \_keXg-3VQQewZwf07HWbaA O3LIsFtTQrqaj0spzHushA r8oGIwF-Rb-OEIHNuEPmcg W-wiCs-7ToaRr9KjOjC0Iw 74wFVcAUQ-KCz66WKjLRmw GX8XNJOVSxmU7b115yFBdA lzSS14E1RKGA9lytBFUjXQ oe2borCxQ520NlD6Ok-Y2w SbjXxyw9Q2u\_WedT563dCw XTeuNnW1RECTf797ioMpoQ A7Y5ZlG7QheXryHgK0fQpA iJ252YZ3Ty-ZWbx8MQihmA mduXWrTPSbeBzjVIGxFjlw OoAsfZ4NQGWUTPRNXt1klw sbPOoLn0QTax0nOFPAHPbQ Z6HqHHx7THeiV6lWF7wx0A cNreQz6FQMygOhE2TnN3Uw ioJFg9NKTQCXMoayh3UaLg MoPXfnKTTbyV5YZI-QfVfw qmzZHzuwQj2DBaZWq8fplA TPlyNvgTTU64B4mAG6cn0g D1OThSkmTx2\_Gg782Sb4Qg j3Cb75X3ToGjliv06Gzwdg NAS42JsdQbqhUTnzI6dvcw QuwLdRSZTbWrw9icoF4LhA wGU1lhc3ReGtaCQMYNKdkw ---
**Author:** ![miladmohabati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miladmohabati/32/128573_2.png) [@miladmohabati](https://discuss.elastic.co/u/miladmohabati)\ **Post date:** [December 11, 2023, 10:18am UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/25 "2023-12-11T10:18:41Z")
du -h / | sort -rh | head -10 du: cannot access '/proc/1382/task/1382/fd/4': No such file or directory du: cannot access '/proc/1382/task/1382/fdinfo/4': No such file or directory du: cannot access '/proc/1382/fd/3': No such file or directory du: cannot access '/proc/1382/fdinfo/3': No such file or directory 94G / 83G /var 82G /var/lib/elasticsearch/indices 82G /var/lib/elasticsearch 82G /var/lib 81G /var/lib/elasticsearch/indices/A7Y5ZlG7QheXryHgK0fQpA/0/index 81G /var/lib/elasticsearch/indices/A7Y5ZlG7QheXryHgK0fQpA/0 81G /var/lib/elasticsearch/indices/A7Y5ZlG7QheXryHgK0fQpA 4.9G /usr 2.7G /usr/share ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 11, 2023, 3:23pm UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/26 "2023-12-11T15:23:10Z")
> [@miladmohabati](#): > > root@srvelk:/var/lib/elasticsearch/indices > [@miladmohabati](#): > > Which of these should I remove? Those are not logs... those are the actual elastic data. If you remove _ **ANY** _ directory or files in `/var/lib/elasticsearch/indices`, **you will lose data AND make Elasticsearch unusable.** Those are not Logs they are Data. Something is unusual... going on as Elastic is reporting ~13GB But your `du` is reporting 81GB I do not have an explanation for that perhaps there was an old Elasticsearch or there is Corrupt Data I do not have an answer. If you want to fix this, you are going to need to find room somewhere else so that Elastic will start, then use the [DELETE API](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete.html) to remove Indices... Or can you expand that filesystem? ---
**Author:** ![miladmohabati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miladmohabati/32/128573_2.png) [@miladmohabati](https://discuss.elastic.co/u/miladmohabati)\ **Post date:** [December 11, 2023, 4:18pm UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/27 "2023-12-11T16:18:19Z")
> [@stephenb](#): > > If you remove _ **ANY** _ directory or files in `/var/lib/elasticsearch/indices`, **you will lose data AND make Elasticsearch unusable.** Those are not Logs they are Data. ok > [@stephenb](#): > > If you want to fix this, you are going to need to find room somewhere else so that Elastic will start, then use the [DELETE API](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete.html) to remove Indices... I don't know where the filebeat logs are stored > [@stephenb](#): > > Or can you expand that filesystem? No I can not. can you help me thanks my friend ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 11, 2023, 4:31pm UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/28 "2023-12-11T16:31:27Z")
> [@miladmohabati](#): > > I don't know where the filebeat logs are stored Sorry confused... not sure what filebeat has to do with this you can look in `/var/log` and the below directories.. and perhaps clean logs out of that or in the subdirectories ---
**Author:** ![miladmohabati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miladmohabati/32/128573_2.png) [@miladmohabati](https://discuss.elastic.co/u/miladmohabati)\ **Post date:** [December 14, 2023, 8:50pm UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/29 "2023-12-14T20:50:03Z")
How can the logs be deleted automatically after a week? logs net flow ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 14, 2023, 9:11pm UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/30 "2023-12-14T21:11:59Z")
Hi @miladmohabati > [@miladmohabati](#): > > How can the logs be deleted automatically after a week? What logs? Are you talking about the Elasticsearch Application Logs in /var/log/elasticsearch? Otherwise, I can not help with the other logs.. those are up to your system admin. ---
**Author:** ![miladmohabati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miladmohabati/32/128573_2.png) [@miladmohabati](https://discuss.elastic.co/u/miladmohabati)\ **Post date:** [December 24, 2023, 11:10am UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/32 "2023-12-24T11:10:32Z")
> [@stephenb](#): > > What logs? hi Stephen I install new server and after one week can not login \>\> We couldn't log you in. Please try again. ```auto curl -k -u elastic "https://localhost:9200/_cat/nodes/?v&h=name,du,dt,dup,hp,hc,rm,rp,r" Enter host password for user 'elastic': name du dt dup hp hc rm rp r srvelk 91.2gb 95.8gb 95.12 33 2.6gb 15.6gb 96 cdfhilmrstw root@srvelk:~# curl -k -u elastic "https://localhost:9200/_cat/indices/*?v&s=pri.store.size:desc" Enter host password for user 'elastic': health status index uuid pri rep docs.count docs.deleted store.size pri.store.size dataset.size yellow open .ds-filebeat-8.11.1-2023.12.16-000002 r4R7sGkZRPaCy4osrYAHxA 1 1 96630319 0 50gb 50gb 50gb yellow open .ds-filebeat-8.11.1-2023.12.22-000003 5MaGlovySI-mU6ALskruoQ 1 1 27327097 0 14gb 14gb 14gb yellow open .ds-filebeat-8.11.1-2023.11.16-000001 A7Y5ZlG7QheXryHgK0fQpA 1 1 22298154 0 12gb 12gb 12gb green open .internal.alerts-observability.logs.alerts-default-000001 W-wiCs-7ToaRr9KjOjC0Iw 1 0 0 0 249b 249b 249b green open .internal.alerts-observability.uptime.alerts-default-000001 NAS42JsdQbqhUTnzI6dvcw 1 0 0 0 249b 249b 249b green open .internal.alerts-ml.anomaly-detection.alerts-default-000001 oe2borCxQ520NlD6Ok-Y2w 1 0 0 0 249b 249b 249b green open .internal.alerts-observability.slo.alerts-default-000001 r8oGIwF-Rb-OEIHNuEPmcg 1 0 0 0 249b 249b 249b green open .internal.alerts-observability.apm.alerts-default-000001 Wrgp26bbTlGTo6vYO3EOCQ 1 0 0 0 249b 249b 249b green open .internal.alerts-observability.metrics.alerts-default-000001 iJ252YZ3Ty-ZWbx8MQihmA 1 0 0 0 249b 249b 249b green open .kibana-observability-ai-assistant-conversations-000001 SbjXxyw9Q2u_WedT563dCw 1 0 0 0 249b 249b 249b yellow open mikrotik a8eN4AFqTQicmAwB9qHmbg 1 1 0 0 249b 249b 249b green open .internal.alerts-observability.threshold.alerts-default-000001 jLIF61xpTRieUynHu-YCMw 1 0 0 0 249b 249b 249b green open .internal.alerts-security.alerts-default-000001 OoAsfZ4NQGWUTPRNXt1klw 1 0 0 0 249b 249b 249b green open .kibana-observability-ai-assistant-kb-000001 wGU1lhc3ReGtaCQMYNKdkw 1 0 0 0 249b 249b 249b green open .internal.alerts-stack.alerts-default-000001 XTeuNnW1RECTf797ioMpoQ 1 0 0 0 249b 249b 249b ``` ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 24, 2023, 6:28pm UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/33 "2023-12-24T18:28:05Z")
@miladmohabati It looks like you are ingesting data from filebeat into the cluster.... The data seems to be filling up pretty fast so even if you clean up you are going to back in the same state / issues soon. It looks like you will only be able to keep perhaps 7-10 days of data... There are 2 Basic things that you are going to do. 1. Clean up some space by deleting some indices 2. Then, Set up an Index Lifecycle Management to automatically clean up the indices. So First, you can DELETE a couple of those indices BUT **WARNING if you DELETE the indices the DATA is Lost forever unless you have another backup of the data** This command would free up about 12GB of data ```auto curl -X DELETE -k -u elastic "https://localhost:9200/.ds-filebeat-8.11.1-2023.11.16-000001" ``` This Command will DELETE up another 50GB Data, BUT again you will lose all the data between 2023.12.16 and 2023.12.22 **WARNING if you DELETE the indices the DATA is Lost forever unless you have another backup of the data** ```auto curl -X DELETE -k -u elastic "https://localhost:9200/.ds-filebeat-8.11.1-2023.12.16-000002" ``` After you do that... you should be able to log in unless there are other issues with your kibana etc... ' If you get logged into Kibana Kibana -\> Stack Management -\> Index Lifecycle Policy - Filebeat Set to rollover in 1 day, Delete after 10 Days : Save ![Screenshot 2023-12-24 at 10.26.39 AM](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1a84d39507b5402cd56a5b6a2f5eb32c082de4b0.png) ![Screenshot 2023-12-24 at 10.25.33 AM](https://us1.discourse-cdn.com/elastic/original/3X/6/1/61e0629129e084b5ad19b7d0ba4a14bef91f1364.png) ![Screenshot 2023-12-24 at 10.25.41 AM](https://us1.discourse-cdn.com/elastic/original/3X/8/8/8877a9e79c45f51bf90b7846ab731a3b9f8b7210.png) ---
**Author:** ![miladmohabati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miladmohabati/32/128573_2.png) [@miladmohabati](https://discuss.elastic.co/u/miladmohabati)\ **Post date:** [December 25, 2023, 8:04am UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/34 "2023-12-25T08:04:58Z")
> [@stephenb](#): > > After you do that... you should be able to log in unless there are other issues with your kibana etc... ' > > If you get logged into Kibana > > Kibana -\> Stack Management -\> Index Lifecycle Policy - Filebeat > > Set to rollover in 1 day, Delete after 10 Days : Save oh Stephen .... thanks my friend 😍 🙏 You helped me a lot Thank you very much 🙏 🙏 🙏 🙏 🥰 ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 25, 2023, 2:57pm UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/35 "2023-12-25T14:57:23Z")
Hi @miladmohabati your welcome Can you login in now? ---
**Author:** ![miladmohabati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miladmohabati/32/128573_2.png) [@miladmohabati](https://discuss.elastic.co/u/miladmohabati)\ **Post date:** [December 25, 2023, 8:10pm UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/36 "2023-12-25T20:10:10Z")
> [@stephenb](#): > > Can you login in now? yes my friend thanks so much 👍 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 22, 2024, 8:10pm UTC](https://discuss.elastic.co/t/i-can-not-login-elastic/348450/37 "2024-01-22T20:10:40Z")
Closed on January 22, 2024, 8:10pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/i-can-not-login-elastic/348450.md?page=1)