Elasticsearch Cluster help

Hello, I am having some difficulty building my cluster environment and was hoping someone could point me in the right direction. Right now the cluster status is red and Kibana is showing no results.

The environment was just one Elasticsearch node with Kibana installed but I added two more Elasticsearch nodes and am hoping to add a fourth soon. The end goal is to decommission the physical node and move to a 3 node vm cluster. I am trying to follow the advice from this post to decommission the physical host - Add / Remove nodes in cluster, good practice question (add nodes and then when all data copied over remove the physical host). Ever since I've added the two nodes the status has changed to red. It appears that data has copied over to the two new nodes because when browsing the file structure of the new hosts I can see the data used size has increased. This is my first time working with an Elasticsearch cluster. Any help would be appreciated. Thanks!


  • Node0 - original node - physical host
  • Node1 - new vm
  • Node2 - new vm
  • Node3 - new vm (not in the cluster yet)


  • Elasticsearch 6.7.2-1
  • Kibana 6.7.2-1

Results from GET _cluster/health

  "cluster_name" : "clustername",
  "status" : "red",
  "timed_out" : false,
  "number_of_nodes" : 2,
  "number_of_data_nodes" : 2,
  "active_primary_shards" : 1794,
  "active_shards" : 2731,
  "relocating_shards" : 0,
  "initializing_shards" : 2,
  "unassigned_shards" : 881,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 2,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 32643,
  "active_shards_percent_as_number" : 75.5672385168788

Was able to get this resolved by shutting down all the nodes, creating the new node (node3), allocating more memory and removing the original node. Had a few indices that were corrupted. Ended up deleting those after trying to close and reopen the indices. After waiting a few hours for all the unassigned shards to process, the cluster is now green.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.