# What are the best (preferred) methods to recover data from a corrupted shard?

**URL:** https://discuss.elastic.co/t/what-are-the-best-preferred-methods-to-recover-data-from-a-corrupted-shard/207583
**Category:** Elasticsearch
**Created:** [November 12, 2019, 8:20pm UTC](https://discuss.elastic.co/t/what-are-the-best-preferred-methods-to-recover-data-from-a-corrupted-shard/207583 "2019-11-12T20:20:34Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![pushshift](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pushshift/32/50408_2.png) [@pushshift](https://discuss.elastic.co/u/pushshift)
#### Post date: [November 12, 2019, 8:20pm UTC](https://discuss.elastic.co/t/what-are-the-best-preferred-methods-to-recover-data-from-a-corrupted-shard/207583/1 "2019-11-12T20:20:34Z")

</div>

I recently ran into an out of space issue (I know, bad planning) and I would like to recover as much data from the shard as possible. I can see the data files under the node directory for that particular index and was wondering if there were any tools available to attempt to recover data from a shard (using Elasticsearch 7.4 currently).

I've seen online tutorials such as this one: [https://grh.am/2018/recovering-a-corrupted-elasticsearch-index-shard/](https://grh.am/2018/recovering-a-corrupted-elasticsearch-index-shard/)

Is this still a viable method to recover data?

Thank you!

---

<div class="post-metadata">

### Author: ![philippkahr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philippkahr/32/100137_2.png) [@philippkahr](https://discuss.elastic.co/u/philippkahr)
#### Post date: [November 12, 2019, 9:49pm UTC](https://discuss.elastic.co/t/what-are-the-best-preferred-methods-to-recover-data-from-a-corrupted-shard/207583/2 "2019-11-12T21:49:00Z")

</div>

Hi,

there is something that I do not understand. If you are running out space, elasticsearch will stop writing to the shards this instance holds. Everything should be readable and the elasticsearch instance will still be available and you can query it. At the moment you delete something from the harddisk or expand it somehow and elasticsearch checks that the harddisk has not reached it watermark, it will start writing to the shards again.

What version of elasticsearch are you running? Is it a cluster? How many nodes?

---

<div class="post-metadata">

### Author: ![pushshift](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pushshift/32/50408_2.png) [@pushshift](https://discuss.elastic.co/u/pushshift)
#### Post date: [November 13, 2019, 10:25am UTC](https://discuss.elastic.co/t/what-are-the-best-preferred-methods-to-recover-data-from-a-corrupted-shard/207583/3 "2019-11-13T10:25:30Z")

</div>

Hey there! Thanks for replying. I used the tool Glen mentioned here: [Option missing "fix" on startup](https://discuss.elastic.co/t/option-missing-fix-on-startup/207580/7)

The reason it was still writing is because I disabled watermark checks and forgot to re-enable them a while back. :-/

But the data was restored!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 11, 2019, 10:25am UTC](https://discuss.elastic.co/t/what-are-the-best-preferred-methods-to-recover-data-from-a-corrupted-shard/207583/4 "2019-12-11T10:25:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
