All,
I had an issue where my log analyzer server would just say “Waiting for Database to start”, so I rebooted and it came back. Now when I login to the portal, I see absolutely nothing, regardless of what I search for or what filters are applied or not applied.
I can see from the “admin” tab that my documents are still there and being logged (according the stats of that tab) but nothing is being displayed and I cannot search for anything, thus, my data may not actually be there anymore and I do not know why.
I attempted to restart the “elasticsearch” service from the System Status page but I get an error message there as well (Picture below).
When I go to the forum for the answer to that error I get the message “You are not authorized to view this topic” (Picture Below), I assume this is because we are still in the trial phase and that is a paid customer forum.
I need some help here on what might have happened and where to turn next.
All my data is gone, I cannot see anything
-
- Posts: 8
- Joined: Thu May 09, 2019 11:40 am
All my data is gone, I cannot see anything
You do not have the required permissions to view the files attached to this post.
-
- DevOps Engineer
- Posts: 19396
- Joined: Tue Nov 15, 2011 3:11 pm
- Location: Nagios Enterprises
- Contact:
Re: All my data is gone, I cannot see anything
How much disk space is availaboe on the server?
Can you show a screenshot fo
Admin -> Index Status
and the Cluster Health at
Admin -> Cluster Status
Code: Select all
df -h
Admin -> Index Status
and the Cluster Health at
Admin -> Cluster Status
-
- Posts: 8
- Joined: Thu May 09, 2019 11:40 am
Re: All my data is gone, I cannot see anything
Plenty of disk space, although I see the status as "RED". Not sure why or what that means.
Any thoughts?
Any thoughts?
You do not have the required permissions to view the files attached to this post.
-
- DevOps Engineer
- Posts: 19396
- Joined: Tue Nov 15, 2011 3:11 pm
- Location: Nagios Enterprises
- Contact:
Re: All my data is gone, I cannot see anything
It looks like you have a corrupt index for today, on the
Admin -> Index Status
Click Delete on the line next to logstash-2019.06.13
Admin -> Index Status
Click Delete on the line next to logstash-2019.06.13
-
- Posts: 8
- Joined: Thu May 09, 2019 11:40 am
Re: All my data is gone, I cannot see anything
Looks like my information is slowly coming back, could this be due to the fact something was up with my database from earlier today?
How does the database get corrupted like that after being up for so long?
How does the database get corrupted like that after being up for so long?
-
- DevOps Engineer
- Posts: 19396
- Joined: Tue Nov 15, 2011 3:11 pm
- Location: Nagios Enterprises
- Contact:
Re: All my data is gone, I cannot see anything
Excellent.bkeating178 wrote:Looks like my information is slowly coming back, could this be due to the fact something was up with my database from earlier today?
How does the database get corrupted like that after being up for so long?
Yes is for any reason something goes wrong at the exact time an index is first trying to be created it can cause this.
It is rare, but I have seen it on a few occasions, usually related to the server losing write capability on the drive.
-
- Posts: 8
- Joined: Thu May 09, 2019 11:40 am
Re: All my data is gone, I cannot see anything
It is definitely odd, but it is working now.
Thank you for your help, I will note what we did so if it comes up again, we know what to do and where to look.
Thank you for your help, I will note what we did so if it comes up again, we know what to do and where to look.
-
- DevOps Engineer
- Posts: 19396
- Joined: Tue Nov 15, 2011 3:11 pm
- Location: Nagios Enterprises
- Contact:
Re: All my data is gone, I cannot see anything
Glad to hear it is working again!bkeating178 wrote:It is definitely odd, but it is working now.
Thank you for your help, I will note what we did so if it comes up again, we know what to do and where to look.
Locking thread