Search_phase_execution_exception filebeat all shards failed

[whosecode (Shaheer)]

Hi!

My ealstic cluster overview panel shows health yellow as shards are missing, and I get below reponses whenever I try to produce some visualization, or dashboard

search_phase_execution_exception
all shards failed

Error: Bad Request
at Fetch._callee3$ (http://localhost:5601/36063/bundles/core/core.entry.js:6:59535)
at l (http://localhost:5601/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740520)
at Generator._invoke (http://localhost:5601/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740273)
at Generator.forEach.e.<computed> [as next] (http://localhost:5601/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740877)
at fetch_asyncGeneratorStep (http://localhost:5601/36063/bundles/core/core.entry.js:6:52652)
at _next (http://localhost:5601/36063/bundles/core/core.entry.js:6:52968)

I was able to look up the issue from the shards status url:
http://localhost:9200/_cluster/health/?level=shards

I was able to fix this by sending API request from Dev tools within kibana.

I used GET to display the settings for each indices, and found the filebeat has 1 no.of replicas configured (i guess by default), and I had to correct them to 0 because I have only single node running for the els.

GET _settings/

PUT filebeat-7.10.1/_settings
{
  "number_of_replicas": 0
}   

This is just an informational message, since I believe this might be useful for someone who got lost in this issue.

Thanks
Shaheer

[shaunak (Shaunak Kashyap)]

Hi @whosecode, welcome to the Elastic Community forums!

Thanks for reporting this issue. You can also set setup.template.settings.index.number_of_replicas: 0 in your filebeat.yml before running Filebeat. Even better would be to set setup.template.settings.index.auto_expand_replicas: "0-1" so it adjusts according the number of data nodes in your Elasticsearch cluster.

Shaunak