Suddenly elasticsearch start writing duplicate data and after checking the logs and data we found that another instance of elasticseach was started by Monit (https://mmonit.com/monit/) after a false detection.
Before that we have only one node directory "0" and now we are seeing another folder "1" and two different elastcisearch processes (ps aux). Both folders have identical data and all indexers operation are replicated on duplicate node as well hence doubled indexing time, disk consumption and processing.
I dont know what is it (a replica?) and how can I get rid of the duplicate one.
That "1" folder is created when multiple Elasticsearch instances are started on the same data directory. You should stop the instance that uses that "1" folder. If the cluster health remains green then it means all the data that this instance stored was also on other nodes, so you can remove that folder.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.