if default settings is only 1 primary shard is active, when rolling restart, the indexing write primary shard is down. primary have latest data, replicas haven't sync these latest data, when rolling restart cause primary shard own, the one shard of replica would be promoted to be primary, however it don't have latest data synced.
The index.write.wait_for_active_shards only check before write forward to replica, Is there any more strong style to ensure that check the data sink after the write forward to replica return.
Just like Kafka settings min.insync.replicas and ack will strongly ensure the data sink multiple replica after write then return the response to User
In a case : if In-sync Replica Group have only one replica, that is primary is worked, and the node which own the primary encounter an unrecoverable disaster, that primary data is corrupt permanently.
Perhaps a simpler example of independent failures leading to data loss is if you have a primary and a replica on distinct nodes and both of them encounter an unrecoverable disaster at the same time. At least in cases like this Elasticsearch will tell you that data was lost, rather than carrying on regardless. You cannot in general protect against collections of independent failures.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.