Elastic search cluster is shown as red. How to recover?

Question

I have a ES cluster showing the status as red.

{ "cluster_name": "elasticsearch", "status": "red", "timed_out": false, "number_of_nodes": 10, "number_of_data_nodes": 7, "active_primary_shards": 4431, "active_shards": 8862, "relocating_shards": 12, "initializing_shards": 0, "unassigned_shards": 20 }

I have so far tried to rolling restart the data nodes after disabling shard allocation, but cannot see any progress. Could someone be able to provide me a few hints on what to check further?

Answer 1

You have "unassigned_shards": 20 in health check response. This is most likely caused because data nodes in the Elasticsearch cluster lack free storage space. As explained here you can:

• Use the /_cat/indices Elasticsearch API to determine which of the indices are unassigned to nodes in your cluster

• You can also use the _cat/allocation?v API to check shard allocation and disk usage.