Problems with Number of replicas and UNASSIGNED errors

Elastic Stack Elastic Agent
1

Hello, how are you doing ?

So, I have a standalone ELK Stack and I am suffering with the error messages "UNASSIGNED" replicas. I know, to not use replica, I need to set 'number_of_replicas': 0 to the index. As I am using a docker, I destroyed my environment and I created a global index and defined this variable. Then, I added some integrations to my Fleet agents and....Well, All the index templates are creating a replica!!
What Am I doing wrong ? Is there a way to set all these indexes to not use replicas ? (I've tried to use the API, but I will appreciate if someone give an example how to set)

Below, you can find the errors:

> index                                                              shard prirep state      node   unassigned.reason
> .ds-logs-elastic_agent-default-2023.08.29-000001                   0     r      UNASSIGNED        INDEX_CREATED
> .ds-metrics-elastic_agent.metricbeat-default-2023.08.29-000001     0     r      UNASSIGNED        INDEX_CREATED
> .ds-metrics-system.network-default-2023.08.29-000001               0     r      UNASSIGNED        INDEX_CREATED
> .ds-logs-elastic_agent.packetbeat-default-2023.08.29-000001        0     r      UNASSIGNED        INDEX_CREATED
> .ds-metrics-system.cpu-default-2023.08.29-000001                   0     r      UNASSIGNED        INDEX_CREATED
> .ds-logs-endpoint.events.file-default-2023.08.29-000001            0     r      UNASSIGNED        INDEX_CREATED
> .ds-metrics-system.socket_summary-default-2023.08.29-000001        0     r      UNASSIGNED        INDEX_CREATED
> .ds-metrics-system.diskio-default-2023.08.29-000001                0     r      UNASSIGNED        INDEX_CREATED
> .ds-logs-network_traffic.tls-default-2023.08.29-000001             0     r      UNASSIGNED        INDEX_CREATED
> .ds-logs-elastic_agent.metricbeat-default-2023.08.29-000001        0     r      UNASSIGNED        INDEX_CREATED
> .ds-metrics-system.fsstat-default-2023.08.29-000001                0     r      UNASSIGNED        INDEX_CREATED
> .ds-metrics-system.process.summary-default-2023.08.29-000001       0     r      UNASSIGNED        INDEX_CREATED
> .ds-logs-elastic_agent.endpoint_security-default-2023.08.29-000001 0     r      UNASSIGNED        INDEX_CREATED
> .ds-logs-network_traffic.icmp-default-2023.08.29-000001            0     r      UNASSIGNED        INDEX_CREATED

Thanks!

2

Hello, someone to help here ?

3

To set replica shard use below:

PUT /<YOUR_INDEX_NAME>
{
  "settings": {
    "index": { 
      "number_of_replicas": 0
    }
  }
}

For more details refer this documentation.

4

Hello, Thanks for you answer.

These templates are not blank, there are others settings and, If I run this "PUT", it will remove these settings, right ?

5

No, if you run this, It will only update the "number_of_replicas": 0 property. All other properties will remain the same since 'PUT' will only update the property specified.

6

Well, I got this error:

_index_template/metrics-elastic_agent.filebeat" -H "Content-Type: application/json" -d '
{
        "settings": {
        "index": { 
                "number_of_replicas": 0
        }
        }
}'
{"error":{"root_cause":[{"type":"x_content_parse_exception","reason":"[3:2] [index_template] unknown field [settings]"}],"type":"x_content_parse_exception","reason":"[3:2] [index_template] unknown field [settings]"},"status":400}

THe template context that we trying to modify is:

_index_template/metrics-elastic_agent.filebeat"
{"index_templates":[{"name":"metrics-elastic_agent.filebeat","index_template":{"index_patterns":["metrics-elastic_agent.filebeat-*"],"template":{"settings":{"index":{"mode":"time_series"}},"mappings":{"_meta":{"package":{"name":"elastic_agent"},"managed_by":"fleet","managed":true}}},"composed_of":["metrics-elastic_agent.filebeat@package","metrics-elastic_agent.filebeat@custom",".fleet_globals-1",".fleet_agent_id_verification-1"],"priority":200,"_meta":{"package":{"name":"elastic_agent"},"managed_by":"fleet","managed":true},"data_stream":{"hidden":false,"allow_custom_routing":false}}}]}
7

Hi @Ednei_Rodrigues

Perhaps I can clarify a bit.

Assuming you only have a single node what you are seeing with unallocated replicas is normal behavior AND you are not actually required to fix anything but you will see Yellow health.

What @HiteshSingh suggested was to set the replicas to 0 on existing indices not the template which will be used when new indices are created. It looks like You tried to apply the setting to the template
.. which you can but will need to use the correct syntax

From what it looks to me you are using metricbeat and agent , these have built in built template s.

All in all your cluster and replicas are operating as the should and really the Yellow status is to remind you that with only one node you could have data loss.

Perhaps take a look at this thread

Hope this helps

1 Like
8

@Ednei_Rodrigues is right. But if you still want to apply this setting over your template use this:

PUT /_index_template/metrics-elastic_agent.filebeat
{
  "index_patterns" : [".ds-*"], // Give regex pattern for all the indexes you want to apply this setting.
  "priority" : 1,
  "template": {
    "settings" : {
         "number_of_replicas": 0
    }
  }
}
1 Like
9

Hum, So I am doing wrong running ELK stack in standalone mode and this alert should be ignored. I thought this is the cause of my ELK getting slow and I started to chase a solution for it. :sweat:

@HiteshSingh it is worked!

@stephenb Thank you for your impressions and I will create a second node to avoid this situation.

Guys, thank you all, I am very happy with the support. Have a nice day.

1 Like
10

@Ednei_Rodrigues

Glad we could help.

Really you should create 3 nodes it is the best minimal solution for reliability/ resiliency..

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.