(M-600 and M-700 only) No more logs on Panorama after upgrade to PAN-OS 11.1+

• The ES cluster health command shows no data node
  

  admin@Panorama> show log-collector-es-cluster health
  {
    "cluster_name" : "__pan_cluster__",
    "status" : "red",
    "timed_out" : false,
    "number_of_nodes" : 1,     
    "number_of_data_nodes" : 0,     
    "active_primary_shards" : 0,
    "active_shards" : 0,
    "relocating_shards" : 0,
    "initializing_shards" : 0,
    "unassigned_shards" : 1084,
    "delayed_unassigned_shards" : 0,
    "number_of_pending_tasks" : 0,
    "number_of_in_flight_fetch" : 0,
    "task_max_waiting_in_queue_millis" : 0,
    "active_shards_percent_as_number" : 0.0
  }

• The issue persists across system/process restart.

• Panorama
• M-600
• M-700
• Panorama mode
• Upgrade to PAN-OS 11.1+

A software issue is blocking the data nodes on the Panorama to start.

Upgrade to a fixed release

• PAN-OS 11.1: 11.1.8+
• PAN-OS 11.2: 11.2.6+

Downgrading PAN-OS is not recommended as it will require the deletion of all logs on the Panorama.
https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgradedowngrade-considerations