# Ignore lost shards and make cluster health from RED to GREEN **URL:** \ **Category:** Elasticsearch\ **Created:** [October 1, 2015, 12:46am UTC](https://discuss.elastic.co/t/ignore-lost-shards-and-make-cluster-health-from-red-to-green/31433 "2015-10-01T00:46:55Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![no\_jihun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/no_jihun/32/64028_2.png) [@no\_jihun](https://discuss.elastic.co/u/no_jihun)\ **Post date:** [October 1, 2015, 12:46am UTC](https://discuss.elastic.co/t/ignore-lost-shards-and-make-cluster-health-from-red-to-green/31433/1 "2015-10-01T00:46:55Z")
Hello. Recently some of shards disappeared and can not be recovered.( 4 shard lost of 6 month logstash with 5 shard + 1replica) I have changed replica from 1 to 0 due to storage shortage. but I don't know why this made some shard removed both primary and replica. Because of this cluster's health is RED and cluster rolling restart doesn't help. I have nothing can do so decided consider this to normal even there is some lost data. how can I make cluster health to green in this situation? ![](https://us1.discourse-cdn.com/elastic/original/2X/e/e5a28dfd3c2b11621ff0e77d9c56fc6f62aa7877.PNG) some shards is nowhere in the cluster. /\_cluster/health { "status": "red", "timed\_out": false, "number\_of\_nodes": 5, "number\_of\_data\_nodes": 5, "active\_primary\_shards": 1400, "active\_shards": 2800, "relocating\_shards": 0, "initializing\_shards": 0, "unassigned\_shards": 8, "number\_of\_pending\_tasks": 0, "number\_of\_in\_flight\_fetch": 0 } ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [October 1, 2015, 5:30am UTC](https://discuss.elastic.co/t/ignore-lost-shards-and-make-cluster-health-from-red-to-green/31433/2 "2015-10-01T05:30:29Z")
So you have 5 nodes and 2800 shards. Means 560 shards per node. Probably 280 days of data so far. That's a lot IMO. I'm unsure if you really need to have 5 shards per daily index. I would most likely reduce that in the logstash template to 1 shard, 1 replica. Also, if you don't use all indices, you can close them. To answer to your question, if you don't really care about the incomplete indices, you can always delete them. ---
**Author:** ![no\_jihun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/no_jihun/32/64028_2.png) [@no\_jihun](https://discuss.elastic.co/u/no_jihun)\ **Post date:** [October 1, 2015, 5:56am UTC](https://discuss.elastic.co/t/ignore-lost-shards-and-make-cluster-health-from-red-to-green/31433/3 "2015-10-01T05:56:41Z")
@dadoonet thanks for your advice. I understand you mean in usual case (1 shard + 1 replica ) good to logstash indices. I've read this post and it says like you too. [https://qbox.io/blog/optimizing-elasticsearch-how-many-shards-per-index](https://qbox.io/blog/optimizing-elasticsearch-how-many-shards-per-index) my further question is 1. if one shard of a day getting large up to 10GB~20GB, it will be ok when most queries made by kibana(aggregation, filter, search)? 2. no way to keep 4 shard(1 lost) opened and status make GREEN without closing that index? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 1, 2015, 6:14am UTC](https://discuss.elastic.co/t/ignore-lost-shards-and-make-cluster-health-from-red-to-green/31433/4 "2015-10-01T06:14:04Z")
1. That depends on the performance of your nodes, the mappings, and the query patterns so I don't think it's possible to give a straight answer. 2. A green cluster requires all shards to be present. ---
**Author:** ![no\_jihun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/no_jihun/32/64028_2.png) [@no\_jihun](https://discuss.elastic.co/u/no_jihun)\ **Post date:** [October 1, 2015, 9:29am UTC](https://discuss.elastic.co/t/ignore-lost-shards-and-make-cluster-health-from-red-to-green/31433/5 "2015-10-01T09:29:14Z")
Thanks @magnusbaeck. btw. could you please let me know more about > That depends on the performance of your nodes, the mappings, and the query patterns I saw many articles which generally says - a little overallocation good to scalability - shard consume resources, so too many shard make performance/resource issue. In my situation - there is no one document get. - you can see my mapping at this thread [How to add not analyzed field with dynamic tempate? - #3 by no\_jihun](https://discuss.elastic.co/t/how-to-add-not-analyzed-field-with-dynamic-tempate/31391/3) - cluster is under pressure both cpu and ram. - there are about 10 times full gc which takes 10~20secs per a day per a node. - almost of the query is aggretations which made by kibana dashboard in date range 1day ~ 30days. all node's hardward is - 22GB RAM(to es), 24v cores. It would be great if you let me know or give some url something like [Trifork Blog - Keep updated on the technical solutions Trifork is working on!](http://blog.trifork.com/2014/01/07/elasticsearch-how-many-shards/) but this post only reveal the upside of less shards\_count, and tested with facets not aggs. thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:47pm UTC](https://discuss.elastic.co/t/ignore-lost-shards-and-make-cluster-health-from-red-to-green/31433/6 "2017-07-05T23:47:14Z")