Hello,
I am am hoping someone can point me in the right direction. I rebooted my ELK stack the other day and upon trying to start Logstash I received an error about all shards failed. I was able to delete my indices to get things back up and operating, but I am not in the clear. I was required to re-install the dashboards for winlogbeats and metricbeats and after I am seeing several panels in the Metricbeat dashboards as "The request for this panel failed all shards failed" or "no data to display for the selected metrics". Can anyone point me in a direction to troubleshoot this? I am very new to ELK and only somewhat familiar with Linux, any help is greatly appreciated!
Hello! Maybe the restart made some shards went to red and never recovered.
In Kibana Dev Tools, you can try GET _cluster/health/?level=shards and it will show you all the indices and shards. If the shard is unhealthy, deleting the whole index and restart metricbeat will work(not ideal).
Thank you the response!
After running the commend you sent it looks like I am bad shape. I am in status red with with 358 active shhards, all in the yellow state.
I deleted the Metricebeat shard, but am not sure on how to restart Metricbeat, I am monitoring windows machines so should I go to each of those machines and restart Metricbeat?
The other 356 shards are Winlogbeats which seem to be in worse shape. I am sending everything to logstash which is showing
"unavailable shards exception" "reason"=>"[winlogbeat-7.3.1-2019.09.20][0] primary shard in not active...."
When I ran the command you send it showed 358 active primary shards & 358 active shards. Interestingly though it shows 358 unassigned shards.
Should I try deleting all of the winlogbeats as well? I have only installed winlogbeats on 15 machines or so, which makes me think something is definitely wrong.
Thanks again,
Mark
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.