I have two server, both with logstash 2.4.0 and elasticsearch 2.4.0. I found the following warnings in the elasticsearch log on my master node:
[2016-10-12 14:34:33,957][INFO ][cluster.metadata ] [node-2] [filebeat-test-2016.10.12] creating index, cause [auto(bulk api)], templates [], shards [5]/[1], mappings []
[2016-10-12 14:34:34,234][INFO ][cluster.routing.allocation] [node-2] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[filebeat-test-2016.10.12][3], [filebeat-test-2016.10.12][1], [filebeat-test-2016.10.12][4], [filebeat-test-2016.10.12][0], [filebeat-test-2016.10.12][2]] ...]).
[2016-10-12 14:34:34,620][INFO ][cluster.metadata ] [node-2] [filebeat-test-2016.10.12] create_mapping [filebeat-test]
[2016-10-12 14:34:35,520][INFO ][cluster.routing.allocation] [node-2] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[filebeat-test-2016.10.12][4]] ...]).
On my data node I can see nearly at the same time:
[2016-10-12 14:34:34,485][WARN ][transport ] [node-1] Transport response handler not found of id [877575]
[2016-10-12 14:34:34,495][WARN ][transport ] [node-1] Transport response handler not found of id [877576]
[2016-10-12 14:34:35,195][WARN ][transport ] [node-1] Transport response handler not found of id [877599]
Index creation makes the cluster red for a very short moment (until shards are started and ready for indexing). In v5.0.0 we have changed this to make it more user-friendly (see here: https://github.com/elastic/elasticsearch/pull/19450 ).
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.