Graylog Opensearch cluster is yellow

If you only have 1 opensearch node, this is normal.

When you create an index, it may create replica shards as well. Replica shards are copies of the data. This is useful for fault tolerance when you have 2 or more opensearch nodes and you can have multiple copies of the data in case a node fails.

If you only have a single opensearch node, the replica shards do not have anywhere to be assigned since they can’t live on the same node as the primary shards. See About OpenSearch - OpenSearch documentation

To resolve this, you can update the index to set the number of replicas to 0:

curl -X PUT "http://127.0.0.1:9200/<index name>/_settings" -H 'Content-Type: application/json' -d '{"index":{"number_of_replicas":0}}'

replace <index name> with the index you want to update. You can also use * as a wildcard so if you did index.* it would match all indices starting with index..

Hope that helps.

2 Likes