# Indicies turn yellow from specific date - only 1% of Data is shown in Kibana **URL:** \ **Category:** Elasticsearch\ **Created:** [September 21, 2020, 1:12pm UTC](https://discuss.elastic.co/t/indicies-turn-yellow-from-specific-date-only-1-of-data-is-shown-in-kibana/249364 "2020-09-21T13:12:16Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Post date:** [September 21, 2020, 1:12pm UTC](https://discuss.elastic.co/t/indicies-turn-yellow-from-specific-date-only-1-of-data-is-shown-in-kibana/249364/1 "2020-09-21T13:12:17Z")
Hello Community ## first of all - some infos about the cluster i'm using: 3 Nodes - 1 Master - 2 Data Nodes (All of them running CentOS 7) Kibana Version 7.8 Elasticsearch Version 7.8 Logstash Version 7.8 Filebeat Version 7.8 The cluster has been working just fine for around 1 year. After my holidays - i noticed that the data which is visualized in Kibana was just about 1% of the usual income. We get around 5 million Logs a day - now it's roughly 50.000. So i knew something was off. I checked with the Network team first - but the firewalls were still sending all the logs. There are no errors in the elasticsearch log itsself. So i checked the indicies - and i noticed that every single index (there are 4 different indicies) turned yellow from the 25th of August. There are no indicators to why this happens. I checked the storage on the servers - which is at 45% capacity. I don't know what to check/do anymore - can anyone help? Thanks in advance ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 21, 2020, 9:30pm UTC](https://discuss.elastic.co/t/indicies-turn-yellow-from-specific-date-only-1-of-data-is-shown-in-kibana/249364/2 "2020-09-21T21:30:09Z")
What is the output from the `GET /_cluster/stats?human&pretty` API? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 21, 2020, 9:46pm UTC](https://discuss.elastic.co/t/indicies-turn-yellow-from-specific-date-only-1-of-data-is-shown-in-kibana/249364/3 "2020-09-21T21:46:22Z")
I suspect your disk might be over 85% full, [which would cause replica shards to not be allocated](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/modules-cluster.html#disk-based-shard-allocation). What is your retention period? Are you deleting old data? ---
**Author:** ![Moritz\_Kiesewetter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moritz_kiesewetter/32/51243_2.png) [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Post date:** [September 22, 2020, 7:21am UTC](https://discuss.elastic.co/t/indicies-turn-yellow-from-specific-date-only-1-of-data-is-shown-in-kibana/249364/4 "2020-09-22T07:21:31Z")
@warkolm @Christian_Dahlqvist Sorry for not replying fast enough. I did some research and @Christian_Dahlqvist was right - there were plenty of new devices delivering Logs to the cluster - which ended up taking up 99% of storage space. I've now set up a more strict lifecycle policy and we're down to 70% again - with all indicies being green. Thanks for the fast replys guys! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 20, 2020, 7:21am UTC](https://discuss.elastic.co/t/indicies-turn-yellow-from-specific-date-only-1-of-data-is-shown-in-kibana/249364/5 "2020-10-20T07:21:33Z")
Closed on October 20, 2020, 7:21am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.