:_mod-docs-content-type: ASSEMBLY
[id="troubleshooting-logging-alerts"]
include::_attributes/common-attributes.adoc[]
= Troubleshooting logging alerts
:context: troubleshooting-logging-alerts

toc::[]

You can use the following procedures to troubleshoot logging alerts on your cluster.

include::modules/es-cluster-health-is-red.adoc[leveloffset=+1]

[role="_additional-resources"]
.Additional resources
* xref:../../../observability/monitoring/accessing-metrics/accessing-metrics-as-an-administrator.adoc#reviewing-monitoring-dashboards-admin_accessing-metrics-as-an-administrator[Reviewing monitoring dashboards as a cluster administrator]
* link:https://www.elastic.co/guide/en/elasticsearch/reference/7.13/fix-common-cluster-issues.html#fix-red-yellow-cluster-status[Fix a red or yellow cluster status]

[id="elasticsearch-cluster-health-is-yellow"]
== Elasticsearch cluster health status is yellow

Replica shards for at least one primary shard are not allocated to nodes. Increase the node count by adjusting the `nodeCount` value in the `ClusterLogging` custom resource (CR).

[role="_additional-resources"]
.Additional resources
* link:https://www.elastic.co/guide/en/elasticsearch/reference/7.13/fix-common-cluster-issues.html#fix-red-yellow-cluster-status[Fix a red or yellow cluster status]

include::modules/es-node-disk-low-watermark-reached.adoc[leveloffset=+1]
include::modules/es-node-disk-high-watermark-reached.adoc[leveloffset=+1]
include::modules/es-node-disk-flood-watermark-reached.adoc[leveloffset=+1]

[id="troubleshooting-logging-alerts-es-jvm-heap-use-is-high"]
== Elasticsearch JVM heap usage is high

The Elasticsearch node Java virtual machine (JVM) heap memory used is above 75%. Consider https://www.elastic.co/guide/en/elasticsearch/reference/current/advanced-configuration.html#set-jvm-heap-size[increasing the heap size].

[id="troubleshooting-logging-alerts-aggregated-logging-system-cpu-is-high"]
== Aggregated logging system CPU is high

System CPU usage on the node is high. Check the CPU of the cluster node. Consider allocating more CPU resources to the node.

[id="troubleshooting-logging-alerts-es-process-cpu-is-high"]
== Elasticsearch process CPU is high

Elasticsearch process CPU usage on the node is high. Check the CPU of the cluster node. Consider allocating more CPU resources to the node.

include::modules/es-disk-space-low.adoc[leveloffset=+1]

[role="_additional-resources"]
.Additional resources
* link:https://www.elastic.co/guide/en/elasticsearch/reference/7.13/fix-common-cluster-issues.html#fix-red-yellow-cluster-status[Fix a red or yellow cluster status]

[id="troubleshooting-logging-alerts-es-filedescriptor-usage-is-high"]
== Elasticsearch FileDescriptor usage is high

Based on current usage trends, the predicted number of file descriptors on the node is insufficient. Check the value of `max_file_descriptors` for each node as described in the Elasticsearch link:https://www.elastic.co/guide/en/elasticsearch/reference/6.8/file-descriptors.html[File Descriptors] documentation.
