# Status Break Down Error **URL:** \ **Category:** Kibana\ **Created:** [August 27, 2017, 12:38pm UTC](https://discuss.elastic.co/t/status-break-down-error/98476 "2017-08-27T12:38:46Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![suchand](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@suchand](https://discuss.elastic.co/u/suchand)\ **Post date:** [August 27, 2017, 12:38pm UTC](https://discuss.elastic.co/t/status-break-down-error/98476/1 "2017-08-27T12:38:46Z")
Status break Down Error in Kibana. Please help me to resolve this issues. Error screenshots attached. ![Screenshot_2](https://us1.discourse-cdn.com/elastic/original/3X/7/c/7cb416728c9c37e361b91643723044ef97b42d0a.jpg). ![Kibana Status](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a9922027f88eba510b41d21d8e15471c9ab9207b.jpg) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 27, 2017, 3:52pm UTC](https://discuss.elastic.co/t/status-break-down-error/98476/2 "2017-08-27T15:52:16Z")
It looks like you Elasticsearch cluster might be overwhelmed and in a `red` state. Look in the Elasticsearch logs for further clues about what exactly is wrong. ---
**Author:** ![suchand](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@suchand](https://discuss.elastic.co/u/suchand)\ **Post date:** [August 27, 2017, 6:45pm UTC](https://discuss.elastic.co/t/status-break-down-error/98476/3 "2017-08-27T18:45:45Z")
Thank you for your reply. We have upgraded our cloud resource to solve this issue, but i am not able to resolve this issue yet. Sometime Kibana status showing Green status, but its not consistent. I have attached the Kibana status showing Green. In addition to that i have attached Elasticsearch memory overview screenshot and a Fatal error screenshot. Waiting for your kind feedback. ![ElasticSearch Fatal Error](https://us1.discourse-cdn.com/elastic/original/3X/a/c/ac2dd82c4f029eb37be42d6a1d596dc66b1111a9.jpg) ![ElasticSearch Overview](https://us1.discourse-cdn.com/elastic/original/3X/0/4/04b97a76cd742110e3cca45747e5e77b59d6b0f8.jpg) ![kibana_ status_Green](https://us1.discourse-cdn.com/elastic/original/3X/5/a/5a0c36c94e45aeb8ed49fa837adcbf8daf826f1d.jpg) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 27, 2017, 7:26pm UTC](https://discuss.elastic.co/t/status-break-down-error/98476/4 "2017-08-27T19:26:18Z")
You have a very small instance and far too many shards. Each shard has overhead in terms of file handles and heap space. You will need to reduce the number of shards in the cluster dramatically and/or increase the size of the node. You can reduce the number of shards by using the [shrink index API](https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-shrink-index.html) or simply reindex into indices with far fewer shards. ---
**Author:** ![suchand](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@suchand](https://discuss.elastic.co/u/suchand)\ **Post date:** [August 28, 2017, 3:10pm UTC](https://discuss.elastic.co/t/status-break-down-error/98476/5 "2017-08-28T15:10:01Z")
|Thank you for your reply. I have gone through shrink index API link that you have provided. Still i am confused where should i add those script to shrink the index. Is it in elasticsearch.yml file? I am using elk cloud instance. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 28, 2017, 6:33pm UTC](https://discuss.elastic.co/t/status-break-down-error/98476/6 "2017-08-28T18:33:42Z")
It is a REST-based API, so you can access it though `Console` under `Dev tools` in Kibana. ---
**Author:** ![suchand](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@suchand](https://discuss.elastic.co/u/suchand)\ **Post date:** [September 6, 2017, 7:42am UTC](https://discuss.elastic.co/t/status-break-down-error/98476/7 "2017-09-06T07:42:41Z")
Thank you for your support. I am not able to reduce the number of Shards. But i have deleted all the replicas because here i have only a single node in my cluster. But still replica's generating automatically, how can i stop replicating shards. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 6, 2017, 8:18am UTC](https://discuss.elastic.co/t/status-break-down-error/98476/8 "2017-09-06T08:18:52Z")
You can control the number of replica shards through [index templates](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/indices-templates.html). ---
**Author:** ![suchand](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@suchand](https://discuss.elastic.co/u/suchand)\ **Post date:** [September 6, 2017, 8:39am UTC](https://discuss.elastic.co/t/status-break-down-error/98476/9 "2017-09-06T08:39:00Z")
thanks for your valuable reply. Can you please help me to get a sample watcher to alert Brute Force Attack using windows Event id. (with throttling\_period). I need to show Source IP,Destination IP ,Computer name and User name in watcher history dashboard. I have added this a separate topic in community, but not yet received a reply. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 6, 2017, 8:43am UTC](https://discuss.elastic.co/t/status-break-down-error/98476/10 "2017-09-06T08:43:35Z")
I do not have such a sample, but there are some other [example watches](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches) available that you may be able to draw inspiration from. ---
**Author:** ![suchand](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@suchand](https://discuss.elastic.co/u/suchand)\ **Post date:** [September 6, 2017, 8:47am UTC](https://discuss.elastic.co/t/status-break-down-error/98476/11 "2017-09-06T08:47:52Z")
Thanks for sharing that link. Below i have shared the Watcher to alert Successful logon. In this i would like to visualize the source IP and destination IP along with computer Name in dashboard. But now i am able to fetch only one single field(Computer name) . How can i fetch multiple field\_Names in this. Also i the throatling\_period which i have given in this script is not working. { "trigger": { "schedule": { "interval": "3m" } }, "input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": [ "\*" ], "types": [], "body": { "query": { "bool": { "filter": [ { "range": { "@timestamp": { "from": "now-20h", "to": "now" } } }, { "term": { "event\_id": "4624" } } ] } }, "aggs": { "failed\_name": { "terms": { "field": "computer\_name" } } } } } } }, "condition": { "always": {} }, "actions": { "log\_error": { "logging": { "level": "info", "text": " Success Full Logon {{ctx.payload.aggregations.failed\_name.buckets.0}}" } } }, "throttle\_period\_in\_millis": 120000 } ---
**Author:** ![suchand](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@suchand](https://discuss.elastic.co/u/suchand)\ **Post date:** [September 7, 2017, 11:56am UTC](https://discuss.elastic.co/t/status-break-down-error/98476/12 "2017-09-07T11:56:42Z")
How come this unassigned Shard generates in Cluster. How can i avoid this. Can someone help me to do this. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 5, 2017, 11:57am UTC](https://discuss.elastic.co/t/status-break-down-error/98476/13 "2017-10-05T11:57:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.