Kibana status RED if number of indexes > 1500

[popthink]

Env.
ELK : 5.3.0
OS : Ubuntu 16.04 x64

If number of Indice exceeds about 1500 indices then Kibana shows 'ElasticSearch Plugin status RED'.

I've searched about this topic... but couldn't find any similar thread.

I'm sure that too many indice count cause the error.

Because it worked properly after I deleted the indices.

.. How can I handle this? Is there any options or... something?

[bhavyarm]

Hi,

Is it possible for you to copy and paste a screenshot of the error here? Kibana can handle very large index patterns. Also when you say indices here - are you talking about 1500 index patterns or 1500 fields in one index pattern?

Thanks,
Bhavya

[popthink]

Hi.

I'm talking about number of indexes. not patterns and fields.

The system create two index(database, name pattern as "indexpatter_jobid_modulename") every hour.

Kibana show the result of the name pattern, "indexpattern_*".

If the system operates enough to create 1500+++ indexes then, Kibana turns to red.

Without any message except "ElasticSearch Plugin is red".

I'll post the screenshot if it is occurred again.

Thank you

[whoami]

mark

[Christian_Dahlqvist]

Having lots of small shards and indices can be very inefficient in Elasticsearch as every shard comes with overhead. What is your average shard size? Why are you creating hourly indices in the first place? How many nodes does your cluster have? What its the specification of these nodes? It could be that your cluster is simply not powerful enough to deal with that many shards and indices.