Elastic search cluster is shown as red. How to recover?

2
votes

I have a ES cluster showing the status as red.

{ "cluster_name": "elasticsearch", "status": "red", "timed_out": false, "number_of_nodes": 10, "number_of_data_nodes": 7, "active_primary_shards": 4431, "active_shards": 8862, "relocating_shards": 12, "initializing_shards": 0, "unassigned_shards": 20 }

I have so far tried to rolling restart the data nodes after disabling shard allocation, but cannot see any progress. Could someone be able to provide me a few hints on what to check further?

1
elasticsearchlogstashkibanaelastic-stack
This might Help – Shantesh
your cluster has 10 nodes, where 7 of them are data nodes? – Marko Vranjkovic

1 Answers

4
votes

You have "unassigned_shards": 20 in health check response. This is most likely caused because data nodes in the Elasticsearch cluster lack free storage space. As explained here you can:

  • Use the /_cat/indices Elasticsearch API to determine which of the indices are unassigned to nodes in your cluster

  • You can also use the _cat/allocation?v API to check shard allocation and disk usage.