LogSearch

Index commands

Check current available indices

curl -X GET http://localhost:19013/_cat/indices

Delete specific indices

curl -X DELETE http://localhost:19013/*<pattern>*

Elastic Troubleshooting

docker logs -f ad-elastic_default --tail 100

Available disk storage should always be under 80% on ACCELO_HOME/data
Check using docker stats command for resource consumption and available memory on server
Make sure to set vm.max_map_count=262144 in session and /etc/sysctl.confto start ad-elastic without any error

Facing Errors in Logs of LogStash?

If you are facing the below error in logs of the logstash container, perform the following:

response=>{"index"=>{"status"=>400, "error"=>{"type"=>"validation_exception", "reason"=>"Validation Failed: 1: this action would add [3] shards, but this cluster currently has [999]/[1000] maximum normal shards open;"}

To increase the maximum number of allowed shards, perform the following steps on the node where Elasticsearch is running:

curl -k -XPUT http://localhost:19013/_cluster/settings -H 'Content-type: application/json' --data-binary $'{"persistent":{"cluster.max_shards_per_node":3000}}'

Resource Unavailability in ad-elastic Container

There is a ULIMIT configuration within the Elastic container. If this value exceeds 65,000 on the underlying host, it can trigger the occurrence of the below error.

[root@odpperf4:acceldata (ad-default)]$ docker logs -f ad-elastic_default

exec /bin/tini: resource temporarily unavailable

exec /bin/tini: resource temporarily unavailable

exec /bin/tini: resource temporarily unavailable

exec /bin/tini: resource temporarily unavailable

To resolve the above issue, perform the following steps:

If /data01/acceldata/config/docker/addons/ad-logsearch.yml file is not yet created then run the following command

accelo admin makeconfig ad-logsearch

Alter the nproc field under the ulimits of ad-elastic container configs according to the file descriptors resources available on the host.
Finally, restart the ad-elastic container using the following command:

accelo restart ad-elastic