Hello, It looks like I allocated more space than available on disk. The elasticsearch status is red, and graylog-server is not starting.
This graylog instance is installed from the 1.0.1 OVA. The total root partition size: ~17GB. The retention strategy was "size", 1GB per index and 10 indices. (I'm guessing Ubuntu also takes up ~5GB.) I did "sudo /usr/bin/graylog-ctl restart" after both changing the retention strategy decreasing the number/size of indices. graylog-server and elasticsearch aren't starting up and giving the same error messages below. Are these retention strategies applied only to newly created indices? Is there a way to delete old indices and start elasticsearch again? in /var/log/graylog/server/current: 2015-04-16_21:23:24.37414 2015-04-16 17:23:24,374 WARN : org.graylog2.indexer.esplugin.ClusterStateMonitor - No Elasticsearch data nodes in cluster, cluster is completely offline. 2015-04-16_21:23:27.58418 2015-04-16 17:23:27,584 WARN : org.graylog2.initializers.BufferSynchronizerService - Elasticsearch is unavailable. Not waiting to clear buffers and caches, as we have no healthy cluster. 2015-04-16_21:23:27.54738 2015-04-16 17:23:27,547 ERROR: org.graylog2.UI - 2015-04-16_21:23:27.54739 2015-04-16_21:23:27.54740 ################################################################################ 2015-04-16_21:23:27.54740 2015-04-16_21:23:27.54740 ERROR: The Elasticsearch cluster state is RED which means shards are unassigned. This usually indicates a crashed and corrupt cluster and needs to be investigated. Graylog will shut down. 2015-04-16_21:23:27.54741 in /var/log/graylog/elasticsearch/current: 2015-04-16_21:10:04.22641 [2015-04-16 17:10:04,226][WARN ][cluster.routing.allocation.decider] [Berzerker] high disk watermark [10%] exceeded on [cz0c8J6PRdG4Kuwnbz6rMQ][Berzerker] free: 718.3mb[4.7%], shards will be relocated away from this node 2015-04-16_21:10:04.22659 [2015-04-16 17:10:04,226][INFO ][cluster.routing.allocation.decider] [Berzerker] high disk watermark exceeded on one or more nodes, rerouting shards Thanks, Mustafa -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
