After edit of default index set,elasticsearch cluster is red

Graylog Central (peer support)
1

As per a request i created a new index set (2yrs) with 1 week per index max of 120 indicies,and changed exisiting index set (3months)to 1 week per index max of 14 index.after 12 hrs found that 14 unassigned shards.I wanna recover this without data loss.there are nor space or resources constrain

Pls help

Allocation explaination - “cannot allocate because a previous copy of the primary shard existed but can no longer be found on the nodes in the cluster”

  • OS Information:centos
  • Package Version:Graylog 2.4.3
    ES Version 5.6.0
    Mongo 4.2.12
2

Hello,

Pinpointing problematic shards

curl -XGET localhost:9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason| grep UNASSIGNED

Each row lists the name of the index, the shard number, whether it is a primary (p) or replica (r) shard, and the reason it is unassigned.

EDIT:
If the node holding the primary shards has gone away, then yes, your data is gone. After all, if there are no replicas, then where would the cluster retrieve the data from, if the primary (and only) shards are no longer part of the cluster? You will either need to bring the node holding those shards back up and add it into the cluster, or the data is gone.

here are some links I have found, maybe they might help.

Hope that helps

1 Like
3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.