Shards Failing

Elastic Stack Elasticsearch
1

Recently I have upgrade ElasticSearch version "6.3.1" but I am facing too many shards failing with old data.

I am using Elastic search with kibana,logstash, wazuh

curl -XGET localhost:9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason| grep UNASSIGNED
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
14 108k 14 16300 0 0 8260 0 0:0wazuh-alerts-3.x-2018.05.23 3 p UNASSIGNED CLUSTER_RECOVERED
0:13 wazuh-alerts-3.x-2018.05.23 3 r UNASSIGNED CLUSTER_RECOVERED
0:0wazuh-alerts-3.x-2018.05.23 2 p UNASSIGNED CLUSTER_RECOVERED
0:01wazuh-alerts-3.x-2018.05.23 2 r UNASSIGNED CLUSTER_RECOVERED
0:wazuh-alerts-3.x-2018.05.23 4 p UNASSIGNED CLUSTER_RECOVERED
00:1wazuh-alerts-3.x-2018.05.23 4 r UNASSIGNED CLUSTER_RECOVERED
2 8wazuh-alerts-3.x-2018.05.23 1 p UNASSIGNED CLUSTER_RECOVERED
257wazuh-alerts-3.x-2018.05.23 1 r UNASSIGNED CLUSTER_RECOVERED
wazuh-alerts-3.x-2018.05.23 0 p UNASSIGNED CLUSTER_RECOVERED
wazuh-alerts-3.x-2018.05.23 0 r UNASSIGNED CLUSTER_RECOVERED
wazuh-monitoring-3.x-2018.06.27 3 r UNASSIGNED CLUSTER_RECOVERED
wazuh-monitoring-3.x-2018.06.27 2 r UNASSIGNED CLUSTER_RECOVERED
wazuh-monitoring-3.x-2018.06.27 4 r UNASSIGNED CLUSTER_RECOVERED

Nodes: 1
Indices: 166
Total Shards: 1893
Unassigned Shards: 1192
Documents: 24,129,219
Data: 13.8 GB
Health: red Red

2

You probably have too many shards per node.

May I suggest you look at the following resources about sizing:

https://www.elastic.co/elasticon/conf/2016/sf/quantitative-cluster-sizing

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.