Unknown indices status


Hi all,

Hope i'm correct here :slight_smile:

Today I encountered a problem with our elastic server. I probably overloaded it with (too) many input files to ingest.
Elasticsearch stopped responding, cpu was through the roof. I stopped logstash, kibana and elasticsearch services. Emptied the folder containing the files and restarted elasticsearch service.

After that I also decided to delete some incomplete indexes and some old one.
Now in Kibana, those deleted indexes are shown as Unknown in the monitoring section.
I'm pretty sure the are deleted, but why are they still shown in the indices list?

Also, after application restart, I re-added files for logstash to ingest. I reduced the size by 70%. Some files are the same as before, and logstash has already processed them before crash.
My second question, will there be duplicate data entries? I see that a new sincedb file was created.

Thank you!


You can close the ticket. I found my answers. :slight_smile:

(Luca Wintergerst) #3

(Mark Walkom) #4

(Mark Walkom) #5

Great. Sharing your solution may help others :slight_smile:


Well. The unknown indices disappeared once few newer indexes were created.
And for the second question, yes there were duplicates after elastic crash. Not sure why, sincedb was not deleted.

(system) #7