# Unable to allocate .security index

**URL:** <https://discuss.elastic.co/t/unable-to-allocate-security-index/173234>\
**Category:** Elasticsearch\
**Created:** [March 20, 2019, 11:24pm UTC](https://discuss.elastic.co/t/unable-to-allocate-security-index/173234 "2019-03-20T23:24:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jathin](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@Jathin](https://discuss.elastic.co/u/Jathin)\
**Post date:** [March 20, 2019, 11:24pm UTC](https://discuss.elastic.co/t/unable-to-allocate-security-index/173234/1 "2019-03-20T23:24:14Z")

</div>

I have a alert on Kibana monitoring index stating a node got removed and got added later and I see the cluster in yellow state.  
No running GET \_cluster/allocation/explain i get .security index is not allocated as all nodes already have one.  
here is the output of the call  
same reason is mentioned for all nodes.

What actions need to be performed to get the cluster back to green?

```
{
  "index": ".security-6",
  "shard": 0,
  "primary": false,
  "current_state": "unassigned",
  "unassigned_info": {
    "reason": "REPLICA_ADDED",
    "at": "2019-03-20T22:02:26.227Z",
    "last_allocation_status": "no_attempt"
  },
  "can_allocate": "no",
  "allocate_explanation": "cannot allocate because allocation is not permitted to any of the nodes",
  "node_allocation_decisions": [
    {
      "node_id": "-KKqR4y_Rla0m_lfm2IwSw",
      "node_name": "[REDACTED]",
      "transport_address": "[REDACTED]",
      "node_attributes": {
        "ml.machine_memory": "64217174016",
        "ml.max_open_jobs": "20",
        "ml.enabled": "true"
      },
      "node_decision": "no",
      "deciders": [
        {
          "decider": "same_shard",
          "decision": "NO",
          "explanation": "the shard cannot be allocated to the same node on which a copy of the shard already exists [[.security-6][0], node[-KKqR4y_Rla0m_lfm2IwSw], [R], s[STARTED], a[id=XateldKdTmOooDSzmFk_rQ]]"
        }
      ]
```

---

<div class="post-metadata">

**Author:** ![Jathin](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@Jathin](https://discuss.elastic.co/u/Jathin)\
**Post date:** [March 20, 2019, 11:25pm UTC](https://discuss.elastic.co/t/unable-to-allocate-security-index/173234/2 "2019-03-20T23:25:02Z")

</div>

Elasticsearch version is 6.2.3

---

<div class="post-metadata">

**Author:** ![Jathin](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@Jathin](https://discuss.elastic.co/u/Jathin)\
**Post date:** [March 21, 2019, 12:51am UTC](https://discuss.elastic.co/t/unable-to-allocate-security-index/173234/3 "2019-03-21T00:51:33Z")

</div>

I have disabled allocation to 7 nodes using

```
put _cluster/settings
{
  "transient" : {
"cluster.routing.allocation.exclude._name" : "node names"
  }
}

```

And the a .security shard is not allocated to one of the nodes on that list. When i try to remove that node from the list and try to reroute failed shards it then tells me that it fails allocation one another shard and then the cycle continues.

---

<div class="post-metadata">

**Author:** ![Jathin](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@Jathin](https://discuss.elastic.co/u/Jathin)\
**Post date:** [March 21, 2019, 1:22pm UTC](https://discuss.elastic.co/t/unable-to-allocate-security-index/173234/4 "2019-03-21T13:22:20Z")

</div>

Got it fixed.

removed the allocation exclusion for nodes. and hence elasticsearch was able to figure out the allocation of the security index properly. and then it started to re balance the whole cluster.  
I added back the exclusion and it took couple of hours to remove those shards from those nodes.  
Those nodes are soon going to be terminated.

Thanks for reading

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2019, 1:22pm UTC](https://discuss.elastic.co/t/unable-to-allocate-security-index/173234/5 "2019-04-18T13:22:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.