Logstash type disappeared from Elasticsearch

Elastic Stack Elasticsearch
1

Something happened around 0700 EST today where suddenly one of our data types dropped off our Kibana graphs. I am trying to figure out how to troubleshoot it and have some ideas.

First, redis-cli monitor shows events landing in redis. However, the file DB is filling up and is 10-30 GB depending upon the server. I am not sure how to see what is in the redis db.

Second, logstash does appear to be sending events and the missing type is configured (it worked until this morning).

I restarted everything (redis, logstash, elasticsearch and all shippers) and waited for the 2014-01-30 index. It is still not appearing. I do think the events are landing in ES based upon the traffic volume, but are somehow no longer searchable. How would I confirm that?

How do I determine the most recent event for that type using a curl query against ES? If the last event is many hours old, how do I get ES to tell me why it is failing?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/df0babe9-fc91-442c-8320-813b37f00156%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

Not sure what happened, but to answer your question about getting the most
recent event (just substitute with the right logstash index name below):

curl
"http://localhost:9200/logstash-YYYY.MM.DD/_search?size=1&sort=@timestamp:desc&pretty"

I would also check the ES logs directory to see if there is anything there
that will show possible cause of a problem within ES.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/34ee6a06-45b6-4a7e-90a0-55b616bd5412%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

I think this had something to do with the Marvel beta code. ES came back
up properly with the index once I uninstalled the marvel beta plugin and
cleaned the ES config file.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/544e0298-41c1-4e36-a472-04ff5c352d0b%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.