# My winlogbeat indicies RED **URL:** \ **Category:** Elasticsearch\ **Created:** [October 10, 2018, 6:29am UTC](https://discuss.elastic.co/t/my-winlogbeat-indicies-red/151758 "2018-10-10T06:29:35Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Serhiy\_H\_V](https://avatars.discourse-cdn.com/v4/letter/s/76d3ee/32.png) [@Serhiy\_H\_V](https://discuss.elastic.co/u/Serhiy_H_V)\ **Post date:** [October 10, 2018, 6:29am UTC](https://discuss.elastic.co/t/my-winlogbeat-indicies-red/151758/1 "2018-10-10T06:29:36Z")
Hi! After upgrade my ELK. Something wrong happened with my indicies winlogbeat,auditbeat,logstash( **Status RED** ) I have 32GB of free space on file system. ![%D0%B7%D0%BE%D0%B1%D1%80%D0%B0%D0%B6%D0%B5%D0%BD%D0%BD%D1%8F](https://us1.discourse-cdn.com/elastic/original/3X/a/c/ac190d63385b9879bf02619007895bab6d196716.png) **Settings:** { "settings": { "index": { "codec": "best\_compression", "mapping": { "total\_fields": { "limit": "10000" } }, "refresh\_interval": "5s", "number\_of\_shards": "3", "provided\_name": "winlogbeat-6.4.1-2018.10.10", "creation\_date": "1539129781184", "number\_of\_replicas": "1", "uuid": "jhKbiWEiTI2xaiJfAyjcBQ", "version": { "created": "6040299" } } }, "defaults": { "index": { "max\_ngram\_diff": "1", "translog": { "generation\_threshold\_size": "64mb", "flush\_threshold\_size": "512mb", "sync\_interval": "5s", "retention": { "size": "512mb", "age": "12h" }, "durability": "REQUEST" }, "auto\_expand\_replicas": "false", "max\_inner\_result\_window": "100", "mapper": { "dynamic": "true" }, "requests": { "cache": { "enable": "true" } }, "unassigned": { "node\_left": { "delayed\_timeout": "1m" } }, "max\_terms\_count": "65536", "data\_path": "", "highlight": { "max\_analyzed\_offset": "-1" }, "routing": { "rebalance": { "enable": "all" }, "allocation": { "enable": "all", "total\_shards\_per\_node": "-1" } }, "search": { "slowlog": { "level": "TRACE", "threshold": { "fetch": { "warn": "-1", "trace": "-1", "debug": "-1", "info": "-1" }, "query": { "warn": "-1", "trace": "-1", "debug": "-1", "info": "-1" } } } }, "fielddata": { "cache": "node" }, "routing\_partition\_size": "1", "max\_docvalue\_fields\_search": "100", "merge": { "scheduler": { "max\_thread\_count": "4", "auto\_throttle": "true", "max\_merge\_count": "9" }, "policy": { "reclaim\_deletes\_weight": "2.0", "floor\_segment": "2mb", "max\_merge\_at\_once\_explicit": "30", "max\_merge\_at\_once": "10", "max\_merged\_segment": "5gb", "expunge\_deletes\_allowed": "10.0", "segments\_per\_tier": "10.0" } }, "max\_refresh\_listeners": "1000", "max\_regex\_length": "1000", "max\_slices\_per\_scroll": "1024", "shard": { "check\_on\_startup": "false" }, "load\_fixed\_bitset\_filters\_eagerly": "true", "number\_of\_routing\_shards": "5", "write": { "wait\_for\_active\_shards": "1" }, "xpack": { "watcher": { "template": { "version": "" } }, "version": "" }, "percolator": { "map\_unmapped\_fields\_as\_text": "false", "map\_unmapped\_fields\_as\_string": "false" }, "allocation": { "max\_retries": "5" }, "mapping": { "coerce": "false", "nested\_fields": { "limit": "50" }, "depth": { "limit": "20" }, "ignore\_malformed": "false" }, "indexing": { "slowlog": { "reformat": "true", "threshold": { "index": { "warn": "-1", "trace": "-1", "debug": "-1", "info": "-1" } }, "source": "1000", "level": "TRACE" } }, "compound\_format": "0.1", "blocks": { "metadata": "false", "read": "false", "read\_only\_allow\_delete": "false", "read\_only": "false", "write": "false" }, "max\_script\_fields": "32", "query": { "default\_field": [ "\*" ], "parse": { "allow\_unmapped\_fields": "true" } }, "format": "0", "max\_result\_window": "10000", "sort": { "missing": , "mode": , "field": , "order": }, "store": { "stats\_refresh\_interval": "10s", "type": "", "fs": { "fs\_lock": "native" }, "preload": }, "priority": "1", "queries": { "cache": { "enabled": "true" } }, "ttl": { "disable\_purge": "false" }, "warmer": { "enabled": "true" }, "max\_rescore\_window": "10000", "max\_adjacency\_matrix\_filters": "100", "max\_shingle\_diff": "3", "gc\_deletes": "60s", "optimize\_auto\_generated\_id": "true", "query\_string": { "lenient": "false" } } } } ---
**Author:** ![dakrone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dakrone/32/23351_2.png) [@dakrone](https://discuss.elastic.co/u/dakrone)\ **Post date:** [October 11, 2018, 8:44am UTC](https://discuss.elastic.co/t/my-winlogbeat-indicies-red/151758/2 "2018-10-11T08:44:23Z")
Hi Serhiy, I would recommend that you check out the Cluster Allocation Explain API: [https://www.elastic.co/guide/en/elasticsearch/reference/6.4/cluster-allocation-explain.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/cluster-allocation-explain.html) If you run this, it will spit out a list of reasons why a particular unassigned shard cannot be assigned to any of the nodes in the cluster, this should let you know why the cluster is red. ---
**Author:** ![Serhiy\_H\_V](https://avatars.discourse-cdn.com/v4/letter/s/76d3ee/32.png) [@Serhiy\_H\_V](https://discuss.elastic.co/u/Serhiy_H_V)\ **Post date:** [October 11, 2018, 3:01pm UTC](https://discuss.elastic.co/t/my-winlogbeat-indicies-red/151758/3 "2018-10-11T15:01:59Z")
Thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 8, 2018, 3:02pm UTC](https://discuss.elastic.co/t/my-winlogbeat-indicies-red/151758/4 "2018-11-08T15:02:02Z")
Closed on November 8, 2018, 3:02pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.