Am I losing data?

Elastic Stack Elasticsearch
1

Hi guys,
I'm currently not sure if I'm losing data. Last monday, I restarted the Elasticsearch cluster. Sadly, I restarted the master nodes all at the same time and didn't deactivate the shard allocation.
I changed the configuration file and switched the master nodes, so the cluster got back up again. When looking at the size of some indices (rotating daily), they seem to have the usual size. But when looking at the index in Kibana, I got way less hits than usual (~1,7 million hits daily vs ~ 700k now) and some data seems to be missing.
I checked like every log and it seems like everything is working as intended. Do you guys have anything in mind what I could check after such a crash?

Thanks in advance,
Ossenfeld

2

Welcome to our community! :smiley: We aren't all guys though.

Have you used _cat/indices or similar to see if you have all the indexes you expect?

3

We aren't all guys though

My bad, sorry, was a no brainer from me. :smiley:

Have you used _cat/indices or similar to see if you have all the indexes you expect?

Yes, and it seems like everything is fine. But if I look at the hits in Kibana of an index, it is about 2/3rd less than before the crash which is why I assume there is something wrong.

4

It's hard to say without some concrete output showing this unfortunately. Especially if your logs aren't reporting issues with the indices.

5

Fair point, the more days pass by, the more it seems like it's just the usual fluctuation. I marked this as done and will ask again if I can be more precise.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.