# Logstash monitoring index is yellow in cluster

**URL:** <https://discuss.elastic.co/t/logstash-monitoring-index-is-yellow-in-cluster/160336>\
**Category:** Logstash\
**Created:** [December 11, 2018, 9:49am UTC](https://discuss.elastic.co/t/logstash-monitoring-index-is-yellow-in-cluster/160336 "2018-12-11T09:49:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Post date:** [December 11, 2018, 9:49am UTC](https://discuss.elastic.co/t/logstash-monitoring-index-is-yellow-in-cluster/160336/1 "2018-12-11T09:49:31Z")

</div>

I'm using Elastic stack 6.5.2.

I have currently two identical production indexes:

- 1x ES, 1x KB, 1LS (all Win based - single server)
- 2x ES, 1x KB 0LS (CentOS based - 2x server)  
This is because we are slowly moving to a Linux cluster. Now I've made a special server to just run LS.  
After setting the xPack url in LS to my Linux based ES it crated a Logstash\* index.  
But this one is only based on one node and the state in Kibana is yellow.

If I print `GET .monitoring-logstash-6-2018.12.11/_settings` I get:

```auto
{
  ".monitoring-logstash-6-2018.12.11" : {
    "settings" : {
      "index" : {
        "codec" : "best_compression",
        "number_of_shards" : "1",
        "auto_expand_replicas" : "0-1",
        "provided_name" : ".monitoring-logstash-6-2018.12.11",
        "format" : "6",
        "creation_date" : "1544519609697",
        "number_of_replicas" : "1",
        "uuid" : "w2AnP5NYRLeP31eDHHBlOg",
        "version" : {
          "created" : "6050299"
        }
      }
    }
  }
}

```

Can anyone advise me further? I don't understand why is this happening, because I'm just using it out of the box.  
All 24 FB are green.

---

<div class="post-metadata">

**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Post date:** [December 11, 2018, 12:25pm UTC](https://discuss.elastic.co/t/logstash-monitoring-index-is-yellow-in-cluster/160336/2 "2018-12-11T12:25:46Z")

</div>

Now I see in Indices listing that `.monitoring-logstash-6-2018.12.11` has an `Unassigned shard`.

If this helps any further.

---

<div class="post-metadata">

**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Post date:** [December 11, 2018, 12:52pm UTC](https://discuss.elastic.co/t/logstash-monitoring-index-is-yellow-in-cluster/160336/3 "2018-12-11T12:52:23Z")

</div>

Solved it with:

```auto
GET /_cluster/allocation/explain

```

It said I'm more then 85% full on disk.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 8, 2019, 12:52pm UTC](https://discuss.elastic.co/t/logstash-monitoring-index-is-yellow-in-cluster/160336/4 "2019-01-08T12:52:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.