Panorama receiving logs but stop showing in GUI

[Jitaphon]

I found the issue about Panorama receives logs just fine but on GUI stop and saw the last record was two weeks ago, not show new log on GUI.

• I try to restart process logd and restarted management server but not fix.
• I found disks shows unavailable in panorama.
• Status elasticsearch process is running and status log collector is green.
• Panorama 10.1.6-h6

Please let me know, If someone who know the way to fix this issue. 

Panorama 

[Metgatz · Accepted solution]

H @Jitaphon i, something similar happened to me.

The solution by TAC, in the first instance was to restart the elasticsearch service in PANORAMA. Despite the restart, the service was not up, therefore the solution from TAC was directly the restart.

We decided to take advantage of the restart to upgrade from 9.1.4 to 9.1.14. After the reboot, the logs are gradually appearing correctly in PANORAMA.

Best regards

[TorokAdam]

Can you paste the output of 

"show log-collector-es-cluster health"

Do you have any unallocated shards?

[Jitaphon]

Thanks, after restart elasticsearch process, we found log already shows on GUI Panorama and the collector statistics status is available. So, the possible cause of the issue is after pan-os upgrading and rebooting right?

[TorokAdam]

Most likely yes. In my case it was only after restarting Panorama (but elasticsearch had unallocated shards and support had to delete them with root access). Good news is, upgrading from 10.2.2 to 10.2.3 had no problems with elasticsearch. Did you perhaps changed Panorama mode from Legacy to Panorama? That may have also caused the issue.