Elasticsearch / OpenSearch cluster in yellow state
Last updated
Was this helpful?
⌘Ctrlk
A yellow health status indicates that at least one replica shard cannot be allocated in the cluster. All primary shards will be allocated, so all data is available in this state, but data availability is at risk if a node goes down.
The health status of the cluster can be checked with the following API call:
GET /_cluster/healthIf the status is yellow, you can use the following API call to get information on why a shard is unallocated:
GET /_cluster/allocation/explainThe allocation explain API without a body will return information on the first unallocated shard it finds. If you need to find details for a specific shard, you will need to include the shard information in the request body. For further details, please see the API documentation.
There are many possible causes for shards being unallocated, so you will need to take action tailored to the reason listed in the allocation explain API output.
Replica shards cannot allocate to the same node that the primary shard resides on, so a single node setup with replicas enabled will always be in a yellow state.
For a single node cluster, replicas must be set to 0 on all indices to achieve a green status. First, the replicas should be set to 0 in the flow collector configuration with the following settings:
Elasticsearch: EF_OUTPUT_ELASTICSEARCH_INDEX_TEMPLATE_REPLICAS
OpenSearch: EF_OUTPUT_OPENSEARCH_INDEX_TEMPLATE_REPLICAS
This will cause any new indices to be created with 0 replicas. Then, the replicas for existing indices will need to be updated to 0. For example, to change the replicas for all flow indices using codex:
The elastiflow-flow-codex-2.5-rollover-* index name can be updated as needed. Wildcards are allowed.
Last updated
Was this helpful?
Was this helpful?
PUT /elastiflow-flow-codex-2.5-rollover-*
{
"settings": {
"number_of_replicas": 0
}
}