# Unknown indices status

**URL:** <https://discuss.elastic.co/t/unknown-indices-status/86294>\
**Category:** Elasticsearch\
**Created:** [May 18, 2017, 3:27pm UTC](https://discuss.elastic.co/t/unknown-indices-status/86294 "2017-05-18T15:27:48Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mitabrev](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@mitabrev](https://discuss.elastic.co/u/mitabrev)\
**Post date:** [May 18, 2017, 3:27pm UTC](https://discuss.elastic.co/t/unknown-indices-status/86294/1 "2017-05-18T15:27:48Z")

</div>

Hi all,

Hope i'm correct here 🙂

Today I encountered a problem with our elastic server. I probably overloaded it with (too) many input files to ingest.  
Elasticsearch stopped responding, cpu was through the roof. I stopped logstash, kibana and elasticsearch services. Emptied the folder containing the files and restarted elasticsearch service.

After that I also decided to delete some incomplete indexes and some old one.  
Now in Kibana, those deleted indexes are shown as Unknown in the monitoring section.  
I'm pretty sure the are deleted, but why are they still shown in the indices list?

Also, after application restart, I re-added files for logstash to ingest. I reduced the size by 70%. Some files are the same as before, and logstash has already processed them before crash.  
My second question, will there be duplicate data entries? I see that a new sincedb file was created.

Thank you!  
Mario

---

<div class="post-metadata">

**Author:** ![mitabrev](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@mitabrev](https://discuss.elastic.co/u/mitabrev)\
**Post date:** [May 18, 2017, 8:36pm UTC](https://discuss.elastic.co/t/unknown-indices-status/86294/2 "2017-05-18T20:36:50Z")

</div>

You can close the ticket. I found my answers. 🙂  
thanks!

---

<div class="post-metadata">

**Author:** ![lwintergerst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lwintergerst/32/18164_2.png) [@lwintergerst](https://discuss.elastic.co/u/lwintergerst)\
**Post date:** [May 18, 2017, 8:42pm UTC](https://discuss.elastic.co/t/unknown-indices-status/86294/3 "2017-05-18T20:42:45Z")

</div>

Closed on May 18, 2017, 8:42pm UTC



---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 18, 2017, 8:53pm UTC](https://discuss.elastic.co/t/unknown-indices-status/86294/4 "2017-05-18T20:53:35Z")

</div>

Opened on May 18, 2017, 8:53pm UTC



---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 18, 2017, 8:53pm UTC](https://discuss.elastic.co/t/unknown-indices-status/86294/5 "2017-05-18T20:53:58Z")

</div>

> [@mitabrev](#):
>
> You can close the ticket. I found my answers. 🙂

Great. Sharing your solution may help others 🙂

---

<div class="post-metadata">

**Author:** ![mitabrev](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@mitabrev](https://discuss.elastic.co/u/mitabrev)\
**Post date:** [May 19, 2017, 6:57am UTC](https://discuss.elastic.co/t/unknown-indices-status/86294/6 "2017-05-19T06:57:55Z")

</div>

Well. The unknown indices disappeared once few newer indexes were created.  
And for the second question, yes there were duplicates after elastic crash. Not sure why, sincedb was not deleted.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:00pm UTC](https://discuss.elastic.co/t/unknown-indices-status/86294/7 "2017-07-05T22:00:15Z")

</div>

Closed on July 5, 2017, 10:00pm UTC