New ES Instance Unassigned Shards

Elastic Stack Elasticsearch
1

Hi all

I've read several answers on the topic around unassigned shards, from data about thread pools to checking how many replicas are configured but none of those seem to have answers.

I've literally just built a brand new elasticsearch 6.3 node (for home use) with logstash and kibana on top. It currently has 1 filebeat client feeding data into logstash and with output to elastic.

I have 3 unassigned shards. The instance is not clustered, it is single node, it has plenty of RAM and heap available and it's been an hour. I am imagining these 3 unassigned shards are due to 3 being the default number of shards from filebeat.

What I want to know is how can I already have unassigned shards? I'd rather resolve this now before I start having other filebeats starting to deliver logs.

Please let me know any config I might need to post here.

{
"cluster_name" : "ES_Cluster",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 6,
"active_shards" : 6,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 3,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 66.66666666666666
}

Or am I just going crazy and I don't need to bother?

Thanks

2

This is expected as you probably have one replica per primary defined.
As you have only one node, replicas are not allocated.

Either start a new node or change the number of replicas to 0.

3

Perfect thank you.

In case anyone is wondering (there is a lot of information out there about earlier versions of elastic and the error information printed by elastic starting up didnt work for me) you can't do it in the elasticsearch.yml but this works:

curl -X PUT "localhost:9200/_all/_settings" -H 'Content-Type: application/json' -d'
{
    "index" : {
        "number_of_replicas" : 0
    }
}
'
4

Note that you might have a template created by filebeat so it would be better to modify the template as well so next day, you'll start with the right values.

Check:

GET /_template

Doc: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

5

Would it be fair to assume then that this is probably what I need to edit into the template as so?

{
  "filebeat-6.3.0" : {
    "order" : 1,
    "index_patterns" : [
      "filebeat-6.3.0-*"
    ],
    "settings" : {
      "index" : {
          "number_of_replicas" : 0
        "mapping" : {
          "total_fields" : {
            "limit" : "10000"
          }
        },