Log files / indexes after reboot

[CFT6Server]

I had a previous thread where a Log server node is reading from apache logs, but everytime the node is rebooted, it basically reads and reopen indexes, which causes thousands of shards to be created.

https://support.nagios.com/forum/viewto ... &hilit=log

Any suggestions on how to stop this from happening?
You can see large number of shards opening and being unassigned.

Code: Select all

[root@2n3 ~]# curl localhost:9200/_cluster/health?pretty
{
  "cluster_name" : "80e9022e-f73f-429e-8927-f23d0d88dfd2",
  "status" : "red",
  "timed_out" : false,
  "number_of_nodes" : 6,
  "number_of_data_nodes" : 6,
  "active_primary_shards" : 3262,
  "active_shards" : 3780,
  "relocating_shards" : 0,
  "initializing_shards" : 35,
  "unassigned_shards" : 3707,
  "number_of_pending_tasks" : 46049,
  "number_of_in_flight_fetch" : 0
}
[root@2n3 ~]# curl localhost:9200/_cluster/health?pretty
{
  "cluster_name" : "80e9022e-f73f-429e-8927-f23d0d88dfd2",
  "status" : "red",
  "timed_out" : false,
  "number_of_nodes" : 6,
  "number_of_data_nodes" : 6,
  "active_primary_shards" : 4096,
  "active_shards" : 4624,
  "relocating_shards" : 0,
  "initializing_shards" : 32,
  "unassigned_shards" : 3576,
  "number_of_pending_tasks" : 64596,
  "number_of_in_flight_fetch" : 0
}
[root@2n3 ~]# curl localhost:9200/_cluster/health?pretty
{
  "cluster_name" : "80e9022e-f73f-429e-8927-f23d0d88dfd2",
  "status" : "red",
  "timed_out" : false,
  "number_of_nodes" : 6,
  "number_of_data_nodes" : 6,
  "active_primary_shards" : 4096,
  "active_shards" : 4624,
  "relocating_shards" : 0,
  "initializing_shards" : 32,
  "unassigned_shards" : 3576,
  "number_of_pending_tasks" : 64609,
  "number_of_in_flight_fetch" : 0
}

[hsmith]

For clarity, every time the NLS node is rebooted, or every time your apache server is rebooted? Or is your NLS reading the local apache log?

[CFT6Server]

Everytime the log server is rebooted and it is reading apache logs from a NFS share where the logs reside.

[hsmith]

Can I see the input you're using to do this?