Cluster status is Yellow and I have a Indices stuck

[hcltech]

I have been trying to delete this month old Indices but it will not go away and now my cluster status is Yellow. Can someone please help?

[hcltech]

The cluster status finally went out of yellow but still have a few Indicies that I cant delete.

[benjaminsmith]

Hello @hcltech,

Let's take a look at the system profile and review the logs. You can download the system profile, send it over in a PM, by going to Admin > System Status >Download System Profile.

Also, what happens if you try to delete the indices from the command line? For example,

Code: Select all

curl -XDELETE localhost:9200/logstash-2018.07.19/

Thanks.

[hcltech]

Sending over the log now to you.

tried to delete via command line.
Last login: Tue Feb 25 14:44:28 2020 from 10.5.1.65
setup@cl-p-nagioslog01:~$ curl -XDELETE localhost:9200/logstash-2020.01.04/
{"acknowledged":true}setup@cl-p-nagioslog01:~$

I still see the Indcies in the web interface. It will go away but if i refresh it comes back and when i keep refreshing the #Docs changes.

[cdienger]

The profile does show a small index for 2020.01.04. This usually means you have a client somewhere with the wrong date and time set. Use the dashboard to look at events for 2020.01.04 and find the client where these logs are coming from.

[hcltech]

That was it for some reason some of my switches reverted back to old domain controllers that are no longer there. Thanks for the help.

[scottwilkerson]

That was it for some reason some of my switches reverted back to old domain controllers that are no longer there. Thanks for the help.

Glad to hear it is solved!

Locking thread