# Index problem after using curator

**URL:** https://discuss.elastic.co/t/index-problem-after-using-curator/273827
**Category:** Elasticsearch
**Tags:** curator
**Created:** [May 24, 2021, 1:14pm UTC](https://discuss.elastic.co/t/index-problem-after-using-curator/273827 "2021-05-24T13:14:13Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Weathmious](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weathmious/32/70916_2.png) [@Weathmious](https://discuss.elastic.co/u/Weathmious)
#### Post date: [May 24, 2021, 1:14pm UTC](https://discuss.elastic.co/t/index-problem-after-using-curator/273827/1 "2021-05-24T13:14:13Z")

</div>

Hello,  
I use a graylog server, with elasticsearch and kibana installed on it. I recently used curator to send indexes to aws S3, then to delete them, in order to save space on my server.  
All of this works fine, but I have an error message that now appears on graylog and kibana, as it does not find indexes that are deleted

![graylog](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a1ee130c0401db7bfbf3764f48461f06f3662e15.png)

 ![kibana](https://us1.discourse-cdn.com/elastic/original/3X/f/9/f991b605ee61e49bc4d226cc4b4e2769bf28c811.png)

Do you know how to fix this problem? Thank you

---

<div class="post-metadata">

### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [May 24, 2021, 2:25pm UTC](https://discuss.elastic.co/t/index-problem-after-using-curator/273827/2 "2021-05-24T14:25:48Z")

</div>

A cluster in the `red` state means that one or more primary shards is considered to be missing. That's what the "unassigned" means. Curator typically cannot cause a red state without something else having gone wrong—it uses the Elasticsearch APIs to delete, snapshot, allocate, etc., and those behaviors do not of themselves cause a shard to appear unassigned. This does not mean that I am categorically stating that there is no correlation between you having run Curator and having this state. Just because it shouldn't happen doesn't mean it didn't happen.

To correct a `red` state, you must remove the index with the unassigned shard. You can run:

```auto
GET /_cat/indices?v

```

and it will show you where your indices are, and what state they are in:

```auto
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open .monitoring-beats-7-2021.04.14 kqoWIZ84TVKXwuFBihHvNQ 1 1 96900 0 124.1mb 62mb
...

```

Note that the first column shows the index state. You need only find the one that is `red`, and then delete that index name:

```auto
DELETE /some-index-name

```

**NOTE:** Don't just jump in and delete it if the `red` index is a system index, but this seems highly unlikely as you'd have many other problems than a shard failed message. A system index is one that starts with a period, like `.security` or the like. A `.monitoring-*` index is not a system index, but is merely monitoring data and are generally safe to delete.

---

<div class="post-metadata">

### Author: ![Weathmious](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weathmious/32/70916_2.png) [@Weathmious](https://discuss.elastic.co/u/Weathmious)
#### Post date: [May 28, 2021, 1:51pm UTC](https://discuss.elastic.co/t/index-problem-after-using-curator/273827/3 "2021-05-28T13:51:52Z")

</div>

Hello @theuntergeek ,  
It worked for me, thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 25, 2021, 1:52pm UTC](https://discuss.elastic.co/t/index-problem-after-using-curator/273827/4 "2021-06-25T13:52:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
