What version of elastic search and how many data nodes? Do you have replicas enabled/ how many?
The error says "not allowed, reason: [NO(shard cannot be allocated on same node [mB5gKQroSu6XQNzNkeHzxQ] it already exists on)]" Are there any errors in the elastic search logs? I found this which may be relevant https://groups.google.com/forum/m/#!msg/elasticsearch/sztApzHmTjY/Nbr0N3EtfhMJ And maybe http://stackoverflow.com/questions/34619265/elasticsearch-unassigned-shards-with-two-nodes-different-machines-1-master-bo -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/c57275f8-9ffa-4696-8056-6ed350e9a1f8%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
