ES not found documents

Elastic Stack Elasticsearch
1

Hi, after resetting the index and re-indexing, the search stopped finding any documents. In the logs I see all shards failed. What could be the problem?

{
  "cluster_name" : "elasticsearch",
  "status" : "yellow",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "active_primary_shards" : 5,
  "active_shards" : 5,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 5,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 50.0,
  "indices" : {
    "myind" : {
      "status" : "yellow",
      "number_of_shards" : 5,
      "number_of_replicas" : 1,
      "active_primary_shards" : 5,
      "active_shards" : 5,
      "relocating_shards" : 0,
      "initializing_shards" : 0,
      "unassigned_shards" : 5,
      "shards" : {
        "0" : {
          "status" : "yellow",
          "primary_active" : true,
          "active_shards" : 1,
          "relocating_shards" : 0,
          "initializing_shards" : 0,
          "unassigned_shards" : 1
        },
        "1" : {
          "status" : "yellow",
          "primary_active" : true,
          "active_shards" : 1,
          "relocating_shards" : 0,
          "initializing_shards" : 0,
          "unassigned_shards" : 1
        },
        "2" : {
          "status" : "yellow",
          "primary_active" : true,
          "active_shards" : 1,
          "relocating_shards" : 0,
          "initializing_shards" : 0,
          "unassigned_shards" : 1
        },
        "3" : {
          "status" : "yellow",
          "primary_active" : true,
          "active_shards" : 1,
          "relocating_shards" : 0,
          "initializing_shards" : 0,
          "unassigned_shards" : 1
        },
        "4" : {
          "status" : "yellow",
          "primary_active" : true,
          "active_shards" : 1,
          "relocating_shards" : 0,
          "initializing_shards" : 0,
          "unassigned_shards" : 1
        }
      }
    }
  }
}
2

What is the query you are trying ?
Ideally your queries should work because all primary shards are still available.

For making cluster green you need to see what went bad in your node.

Try these api's :

curl -XGET localhost:9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason| grep UNASSIGNED

curl -XGET localhost:9200/_cluster/allocation/explain?pretty

You can use your node ip as well in place of localhost.

3

That response (below) for the curl -XGET localhost:9200/_cluster/allocation/explain?pretty

{
  "index" : "myind",
  "shard" : 3,
  "primary" : false,
  "current_state" : "unassigned",
  "unassigned_info" : {
    "reason" : "CLUSTER_RECOVERED",
    "at" : "2021-12-08T07:14:29.624Z",
    "last_allocation_status" : "no_attempt"
  },
  "can_allocate" : "no",
  "allocate_explanation" : "cannot allocate because allocation is not permitted to any of the nodes",
  "node_allocation_decisions" : [
    {
      "node_id" : "ooooooXJReu5UEfmLlupUQ",
      "node_name" : "ooooooX",
      "transport_address" : "x.x.x.x:9300",
      "node_attributes" : {
        "ml.machine_memory" : "38653595648",
        "xpack.installed" : "true",
        "ml.max_open_jobs" : "20",
        "ml.enabled" : "true"
      },
      "node_decision" : "no",
      "deciders" : [
        {
          "decider" : "same_shard",
          "decision" : "NO",
          "explanation" : "the shard cannot be allocated to the same node on which a copy of the shard already exists [[myind][3], node[ooooooXJReu5UEfmLlupUQ], [P], s[STARTED], a[id=wJ2CAhFkTv6M8F1dTFuitQ]]"
        }
      ]
    }
  ]
}
4

Either you need to add another node or reduce the number of replicas for the changing the status to green.

One node is anyways not recommended and you should at least have 2 nodes in a cluster.

5

How I can add node?

On same local host but an other directory, that’s work?

6

And after add another node-shard will be healthy automatically?

7

If you are running a single instance of Elasticsearch, you have a cluster of one node. All primary shards reside on the single node. No replica shards can be allocated, therefore the cluster state remains yellow. The cluster is fully functional but is at risk of data loss in the event of a failure.

Ideally you should have another vm for second node, but if you are running it locally then you can spin up a new es instance on another port . Once this node is part of the cluster then shard relocation will happen automatically.

Please refer this page for more details : Add and remove nodes in your cluster | Elasticsearch Guide [7.16] | Elastic

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.