Problem with cluster after Windows Server patch

Elastic Search
14

You can follow next steps:

  1. Run ES as service to be a stable. There should be a trace something like this
    [2025-04-28T10:34:23,928][INFO ][o.e.h.AbstractHttpServerTransport] [elk1] publish_address {192.168.1.111:9200}, bound_addresses {[::]:9200}
    [2025-04-28T10:34:27,280][INFO ][o.e.c.r.a.AllocationService] [elk1] current.health="YELLOW" message="Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[.ds-.logs-elasticsearch.deprecation-default-2025.04.17-000001][0]]])." previous.health="RED" reason="shards started [[.ds-.logs-elasticsearch.deprecation-default-2025.04.17-000001][0]]"

  2. Run elasticsearch-service.bat manager Elasticsearch. Review "Java virtual Machine" and "Java Classpath",check are path correct.
    There was a bug with the drive's capital letter on Windows, but I don't think is your case. Check and exclude a possibility.
    Check how the service does start, default is the account Local System account

  3. Use curl to test ES APIs. Run it on every node, maybe one of them or index has an issue.
    GET 'http://server1:9200/_cat/health
    GET http://server1:9200/_cat/indices?bytes=b&s=store.size:desc&v&pretty

  4. Might be issues with the local firewall, check opened ports.

  5. Set log level to info, not debug. It's flood the log and slow down.

  6. Check do you have enough disk space. Reindexing is like index cloning + little bit additional space. How large are indices?

  7. Can you copy more lines, instead of 1-2? The best option is from the start until a problem show up.You can put on gdrive or A similar location.