# Yellow health for my indicies from Filebeat and Winlogbeat **URL:** \ **Category:** Elasticsearch\ **Created:** [June 26, 2018, 9:01am UTC](https://discuss.elastic.co/t/yellow-health-for-my-indicies-from-filebeat-and-winlogbeat/137399 "2018-06-26T09:01:06Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\ **Post date:** [June 26, 2018, 9:01am UTC](https://discuss.elastic.co/t/yellow-health-for-my-indicies-from-filebeat-and-winlogbeat/137399/1 "2018-06-26T09:01:06Z")
Hi, All my indicies from filebeat and winlogbeat have yellow status on Kibana monitoring. I have some shards on Unassigned Shards. What does it means that and how i can fix it? Best Regards, Thanos ---
**Author:** ![tdasch](https://avatars.discourse-cdn.com/v4/letter/t/58f4c7/32.png) [@tdasch](https://discuss.elastic.co/u/tdasch)\ **Post date:** [June 26, 2018, 11:43am UTC](https://discuss.elastic.co/t/yellow-health-for-my-indicies-from-filebeat-and-winlogbeat/137399/2 "2018-06-26T11:43:27Z")
As long as your using Elasticsearch 5 or higher you can use the Cluster Allocation Explain API, [check the doc here](https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-allocation-explain.html). Its a great tool to see exactly what is going on with your shards. Feel free to post your results. Also, how many nodes do you have and what is your primary/replica shard settings? ---
**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\ **Post date:** [June 26, 2018, 12:58pm UTC](https://discuss.elastic.co/t/yellow-health-for-my-indicies-from-filebeat-and-winlogbeat/137399/3 "2018-06-26T12:58:34Z")
i got this [root@atdevxhv03 ~]# curl -XGET localhost:9200/\_cat/shards?h=index,shard,prirep,state,unassigned.reason| grep UNASSIGNED % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 2098 100 2098 0 0 51606 0 --:--:-- --:--:-- --:--:-- 52450 filebeat-2018.06.26 1 r UNASSIGNED INDEX\_CREATED filebeat-2018.06.26 3 r UNASSIGNED INDEX\_CREATED filebeat-2018.06.26 4 r UNASSIGNED INDEX\_CREATED filebeat-2018.06.26 2 r UNASSIGNED INDEX\_CREATED filebeat-2018.06.26 0 r UNASSIGNED INDEX\_CREATED winlogbeat-2018.06.26 1 r UNASSIGNED INDEX\_CREATED winlogbeat-2018.06.26 3 r UNASSIGNED INDEX\_CREATED winlogbeat-2018.06.26 4 r UNASSIGNED INDEX\_CREATED winlogbeat-2018.06.26 2 r UNASSIGNED INDEX\_CREATED winlogbeat-2018.06.26 0 r UNASSIGNED INDEX\_CREATED [root@atdevxhv03 ~]# • curl -XGET localhost:9200/\_cluster/allocation/explain?pretty -bash: •: command not found [root@atdevxhv03 ~]# curl -XGET localhost:9200/\_cluster/allocation/explain?pretty { "index" : "filebeat-2018.06.26", "shard" : 1, "primary" : false, "current\_state" : "unassigned", "unassigned\_info" : { "reason" : "INDEX\_CREATED", "at" : "2018-06-26T08:41:04.932Z", "last\_allocation\_status" : "no\_attempt" }, "can\_allocate" : "no", "allocate\_explanation" : "cannot allocate because allocation is not permitted to any of the nodes", "node\_allocation\_decisions" : [ { "node\_id" : "JsMY-JVeSHSuu2vWZcmWdg", "node\_name" : "JsMY-JV", "transport\_address" : "127.0.0.1:9300", "node\_attributes" : { "ml.machine\_memory" : "16655601664", "xpack.installed" : "true", "ml.max\_open\_jobs" : "20", "ml.enabled" : "true" }, "node\_decision" : "no", "weight\_ranking" : 1, "deciders" : [ { "decider" : "same\_shard", "decision" : "NO", "explanation" : "the shard cannot be allocated to the same node on which a copy of the shard already exists [[filebeat-2018.06.26][1], node[JsMY-JVeSHSuu2vWZcmWdg], [P], s[STARTED], a[id=xhqnfkFIQHGNzAmm8jOX5g]]" } ] } ] } ---
**Author:** ![tdasch](https://avatars.discourse-cdn.com/v4/letter/t/58f4c7/32.png) [@tdasch](https://discuss.elastic.co/u/tdasch)\ **Post date:** [June 26, 2018, 2:58pm UTC](https://discuss.elastic.co/t/yellow-health-for-my-indicies-from-filebeat-and-winlogbeat/137399/4 "2018-06-26T14:58:48Z")
Thanks for running that API. Some of the important parts of the output i'll go over. `"primary" : false,` Here we know we are dealing with a replica shard `"explanation" : "the shard cannot be allocated to the same node on which a copy of the shard already exists` And here we get our explanation, the replica shard cannot be allocated to the same node as the primary shard. Primary and replica shards need to be dispersed on different nodes. If there are not enough nodes then the replica shards cannot be allocated to a node and you will have yellow status. Commonly this occurs if you have 1 node full of primaries and no other node for the replicas to allocate to. If you provide the details of your cluster settings and shard settings we could see the reasoning. ---
**Author:** ![antonopo](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@antonopo](https://discuss.elastic.co/u/antonopo)\ **Post date:** [June 27, 2018, 9:06am UTC](https://discuss.elastic.co/t/yellow-health-for-my-indicies-from-filebeat-and-winlogbeat/137399/5 "2018-06-27T09:06:37Z")
> [@tdasch](#): > > If you provide the details of your cluster settings and shard settings we could see the reasoning. How i can provide the details of my cluster? I just installed elasticsearch - logstash and kibana on a centos 7 linux and then i have configured some linux clients using filebeat to send the logs to the ELK centos 7 server. That's my infrastructure. Best Regards, Thanos ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 25, 2018, 9:06am UTC](https://discuss.elastic.co/t/yellow-health-for-my-indicies-from-filebeat-and-winlogbeat/137399/6 "2018-07-25T09:06:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.