Indexing stopped - shards unassigned

Hi All,

I'm experiencing difficulties with indexing. We are shipping logs to logstash which is trying to index them but we are seeing the errors as shown below.

Has anybody seen this before? It was working fine, then all of a sudden we hit this and indexing totally stopped. It's no doubt a mis-configuration of some kind but i don't know where to start looking

$ curl -XGET localhost:9200/_cluster/allocation/explain?pretty
{
  "index" : "filebeat-2018.05.30",
  "shard" : 0,
  "primary" : false,
  "current_state" : "unassigned",
  "unassigned_info" : {
    "reason" : "CLUSTER_RECOVERED",
    "at" : "2018-06-13T14:54:08.390Z",
    "last_allocation_status" : "no_attempt"
  },
  "can_allocate" : "no",
  "allocate_explanation" : "cannot allocate because allocation is not permitted to any of the nodes",
  "node_allocation_decisions" : [
    {
      "node_id" : "CFzjUFeeQEenb22QZqKqyQ",
      "node_name" : "my-cluster",
      "transport_address" : "127.0.0.1:9300",
      "node_decision" : "no",
      "deciders" : [
        {
          "decider" : "same_shard",
          "decision" : "NO",
          "explanation" : "the shard cannot be allocated to the same node on which a copy of the shard already exists [[filebeat-2018.05.30][0], node[CFzjUFeeQEenb22QZqKqyQ], [P], s[STARTED], a[id=zn-5Gr8lTyayyhj-4J55hg]]"
        }
      ]
    }
  ]
}

Regards

J

How many data nodes do you have in the cluster? Which version of Elasticsearch?

Currently we have a single data node

Version = Elasticsearch 6.3

If you only have a single node it is natural that replica shards can not be allocated as Elasticsearch never places replicas on the same node as primaries.

Ok, that makes sense. Is there a way to change the number of replicas to get this indexing again? It's on the roadmap to add additional nodes but i was hoping that would be at a later stage of the project

Yes, set the number of replicas to 0 until you have more data nodes in the cluster.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.