# Remove a node From a cluster **URL:** \ **Category:** Elasticsearch\ **Created:** [May 29, 2018, 11:12am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668 "2018-05-29T11:12:35Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![Hanen](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Post date:** [May 29, 2018, 11:12am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/1 "2018-05-29T11:12:35Z")
Hi, I would like to remove a node from my cluster without losing data. How can I achieve this. Many Thanks. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 29, 2018, 11:16am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/2 "2018-05-29T11:16:30Z")
Use [allocation filtering](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/shard-allocation-filtering.html) by IP/node name to remove shards from the host, then shut it down. ---
**Author:** ![Hanen](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Post date:** [May 29, 2018, 12:04pm UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/3 "2018-05-29T12:04:16Z")
thanks for your replay, in fact the health of the cluster is Red.. Can I do this without losing data? I will replace the node with an other node after I exclude it from the cluster. What do you think please! thanks ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 29, 2018, 9:25pm UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/4 "2018-05-29T21:25:22Z")
> [@Hanen](#): > > in fact the health of the cluster is Red.. Can I do this without losing data? It's not guaranteed. You would need to fix that first. ---
**Author:** ![Hanen](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Post date:** [May 29, 2018, 10:13pm UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/5 "2018-05-29T22:13:41Z")
Please if you have any idea could you help me! How can I fix the health of the cluster I have 7 nodes...can I reduce the number of shards ?? Or is it a problem of performence? Many thanks. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 30, 2018, 5:14am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/6 "2018-05-30T05:14:15Z")
If the cluster is RED it means that you are yet missing some primary shards which means that you have may be lost some data. Why the cluster is RED? What happened? Did you set number of replicas to 0 at some point? ---
**Author:** ![Hanen](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Post date:** [May 30, 2018, 8:12am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/7 "2018-05-30T08:12:37Z")
Hi Thank You for your replay, I kept the DEFAULT number of shards: 5 primary shards and 1 replicas ---
**Author:** ![mjunaidmuzammil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mjunaidmuzammil/32/56910_2.png) [@mjunaidmuzammil](https://discuss.elastic.co/u/mjunaidmuzammil)\ **Post date:** [May 30, 2018, 8:39am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/8 "2018-05-30T08:39:34Z")
First, you need identify the cause of RED STATE. You can look into `/\_cluster/state' output for problematic shards and fix them. ---
**Author:** ![Hanen](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Post date:** [May 30, 2018, 8:53am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/9 "2018-05-30T08:53:05Z")
the cause is : unassigned shards it can be a problem of memory space? ---
**Author:** ![mjunaidmuzammil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mjunaidmuzammil/32/56910_2.png) [@mjunaidmuzammil](https://discuss.elastic.co/u/mjunaidmuzammil)\ **Post date:** [May 30, 2018, 9:13am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/10 "2018-05-30T09:13:49Z")
You can check out the cluster allocation explain API for the cause. [https://www.elastic.co/guide/en/elasticsearch/reference/5.5/cluster-allocation-explain.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/cluster-allocation-explain.html) ---
**Author:** ![Hanen](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Post date:** [May 30, 2018, 9:33am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/11 "2018-05-30T09:33:11Z")
Many thanks for your replay the reason is:"unassigned","unassigned\_info":{"reason":"CLUSTER\_RECOVERED" please how can I solve this issue. ---
**Author:** ![mjunaidmuzammil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mjunaidmuzammil/32/56910_2.png) [@mjunaidmuzammil](https://discuss.elastic.co/u/mjunaidmuzammil)\ **Post date:** [May 30, 2018, 9:49am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/12 "2018-05-30T09:49:06Z")
What is the value against `allocate_explanation` key for cluster allocation explain API? ---
**Author:** ![Hanen](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Post date:** [May 30, 2018, 9:51am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/13 "2018-05-30T09:51:41Z")
"can\_allocate": "throttled", "allocate\_explanation": "allocation temporarily throttled", "node\_allocation\_decisions": [ { "node\_id": "ID", "node\_name": "name", "transport\_address": "@:9300", "node\_attributes": { "ml.machine\_memory": "4294365184", "ml.max\_open\_jobs": "20", "ml.enabled": "true" }, ---
**Author:** ![mjunaidmuzammil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mjunaidmuzammil/32/56910_2.png) [@mjunaidmuzammil](https://discuss.elastic.co/u/mjunaidmuzammil)\ **Post date:** [May 30, 2018, 11:38am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/14 "2018-05-30T11:38:27Z")
How many shards per node do you have? I believe you have larger number of shards / node. A similar thread can be found here. > [@Elasticsearch status:red](https://discuss.elastic.co/t/elasticsearch-status-red/109932): > > Hi team and all, Newbie to ELK and evaluating to put live soon, was all working until it stopped... no changes made just adding servers in one by one using winbeatlog direct to elasticsearch. Can someone tell me what I need to do to resolve this in simple language please? Bitnami ELK Stack 5.6.3 on Windows Server 2012 R2 C:\Users\administrator\>curl -XGET [http://localhost:9200/\_cluster/health?pretty=t](http://localhost:9200/_cluster/health?pretty=t) rue { "cluster\_name" : "elasticsearch", "status" : "red", "timed\_out" : false, "number… ---
**Author:** ![Hanen](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Post date:** [May 30, 2018, 11:54am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/15 "2018-05-30T11:54:39Z")
Hi, Many thanks for helping me the output of **GET /\_cluster/health?pretty=true** is the following: ```auto { "cluster_name": "SIEM-cluster", "status": "red", "timed_out": false, "number_of_nodes": 7, "number_of_data_nodes": 6, "active_primary_shards": 1616, "active_shards": 1616, "relocating_shards": 0, "initializing_shards": 0, "unassigned_shards": 1692, "delayed_unassigned_shards": 0, "number_of_pending_tasks": 0, "number_of_in_flight_fetch": 0, "task_max_waiting_in_queue_millis": 0, "active_shards_percent_as_number": 48.851269649334945 } ``` ---
**Author:** ![mjunaidmuzammil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mjunaidmuzammil/32/56910_2.png) [@mjunaidmuzammil](https://discuss.elastic.co/u/mjunaidmuzammil)\ **Post date:** [May 31, 2018, 11:08am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/16 "2018-05-31T11:08:12Z")
Based on the above output, I see 550 shard allocations to a single ES node (1616 + 1692)/6. How much heap space you have allocated? What is the disk size and is there ample disk space available? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 28, 2018, 11:08am UTC](https://discuss.elastic.co/t/remove-a-node-from-a-cluster/133668/17 "2018-06-28T11:08:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.