Skip to content

Housekeeping and Miscellaneous Commands

Service Restart

  • OpenSearch - dashboard: systemctl restart opensearch-dashboards

  • OpenSearch: systemctl restart opensearch

  • Logstash:

    • Determine the PID of the Logstash process: ps -ax | grep logstash
    • Followed by the kill command: kill -9 \<PID of logstash process>

  • To view free space on the log server: Enter df -h to view details of the free space left on the log server.

    Note

    It is recommended to run this command to check the free space at least once every 3 months, and appropriate cleaning procedures should be initiated.

  • To recover OpenSearch from READ-ONLY mode: If more than 85 percent of the available space on the hard drive (HDD) is used, OpenSearch will stop indexing new documents and enter READ-ONLY mode. This situation can occur due to insufficient HDD space allocated to the ARS server or because of inadequate retention periods that have been configured.

    To resolve this issue, manually delete the older indices.

    After doing so, run the following commands on the ARS server to remove OpenSearch from read-only mode:

    • curl -XPUT "https://admin:accopsars@localhost:9200/_all/_settings?pretty" -H 'Content-Type: application/json' -d'{"index.blocks.read_only_allow_delete": false}' -k