Elasticsearch status RED

[rrs (Ramaswawmy)]

Hi All,

I am I bit confused about my Elasticsearch index. Some of the the indexes are turned into RED, while some are in Yellow status. I am suspecting the issue with unassigned_shards. Can anyone explain me is the Elasticsearch is running fine or the issue exists with unassigned_shards?

Thanks in advance.

"cluster_name" : "logstash",
"status" : "red",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 621,
"active_shards" : 621,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 637,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 49.36406995230524

[warkolm (Mark Walkom)]

You should look at _cat/indices to see what is unassigned.

@rrs

"number_of_data_nodes" : 1,
"active_primary_shards" : 621,

That's a little high, you should look to reduce your default shard count.

[rrs (Ramaswawmy)]

Thanks for update.

As per your suggestion, I checked the unassigned indices which are 8 primary and 624 replicas.

Whey should I worry when active_primary_shards and unassigned_shards numbers are high? Is there any algorithm to maintain proper cluster with number of nodes based on number of both indexes(primary/replica).

[warkolm (Mark Walkom)]

@rrs

unassigned indices which are 8 primary

That is a problem and why your cluster is red. You should check your logs to see what may be causing it.

@rrs

Whey should I worry when active_primary_shards and unassigned_shards numbers are high?

See Kagillion Shards | Elasticsearch: The Definitive Guide [2.x] | Elastic

@rrs

Is there any algorithm to maintain proper cluster with number of nodes based on number of both indexes(primary/replica).

It's a mix of things, there are other threads that go into this in more detail so have a bit of a look around