Red status because of 1 index has an unassigned shard

Elastic Stack Elasticsearch
1

I left elastic running and came back to find that my status is red. I have 9 indices and only 1 of them is giving me a red status the rest are fine:

logstash-2015.10.01-systemstats":{
	"status":"red",
	"number_of_shards":5,
	"number_of_replicas":0,
	"active_primary_shards":3,
	"active_shards":3,
	"relocating_shards":0,
	"initializing_shards":1,
	"unassigned_shards":1
	}

So why would only one of my indices be red but the rest are green. This is some strange behavior. And since its red what should I do?

2

2 choices:

  • you have somewhere on a disk this shard so you should make it available in your cluster
  • you don't have a sane version of this shard

If the later, you can either live with this red index. It's still working but partially.
Or you can delete the index.

3

I don't think i understand your options, but i definitely do not want to delete the index. When I push this to production the documents are quite important.

I just don't understand why this index is having problems. My prior indices are green and the index after is green also. meaning everything before the 1st is okay and everything after the first is also.

4

It's barely impossible to know why your index is Red without any detailled information such as: logs, settings, mappings, hardware...

May be you over allocated the number of shards per node?

5

Is that possible to over allocate per node? Where I can I read documentation on this?

6

How many shards do you have?
How many nodes?

7

There are about 10 indices with 5 shards each. And with only 1 node.

8

That sounds reasonable at a first glance.

That said you should reduce the number of shards unless you really need them.

If you have no replica, I don't really see how to recover from that but again logs might tell more.