Health state yellow and unassigned index after policy created

[Cristian Radu]

Hello,

I created the attached policy for my indices. After that this index appeared which is in yellow state .opendistro-job-scheduler-lock. You can see the picture too.

Also by running the below command I get this. How can I solve it without breaking it :)

 curl -X GET "https://localhost:9200/_cluster/allocation/explain?pretty" -u admin:pass -k
{
  "index" : ".opendistro-job-scheduler-lock",
  "shard" : 0,
  "primary" : false,
  "current_state" : "unassigned",
  "unassigned_info" : {
    "reason" : "INDEX_CREATED",
    "at" : "2022-11-01T14:03:06.733Z",
    "last_allocation_status" : "no_attempt"
  },
  "can_allocate" : "no",
  "allocate_explanation" : "cannot allocate because allocation is not permitted to any of the nodes",
  "node_allocation_decisions" : [
    {
      "node_id" : "Wgcxeaj4RM6UkojA65tufg",
      "node_name" : "node-1",
      "transport_address" : "10.1.220.178:9300",
      "node_attributes" : {
        "shard_indexing_pressure_enabled" : "true"
      },
      "node_decision" : "no",
      "weight_ranking" : 1,
      "deciders" : [
        {
          "decider" : "same_shard",
          "decision" : "NO",
          "explanation" : "a copy of this shard is already allocated to this node [[.opendistro-job-scheduler-lock][0], node[Wgcxeaj4RM6UkojA65tufg], [P], s[STARTED], a[id=iuhhWdr3SuqjnSycdZR_Ow]]"
        }
      ]
    }
  ]
}

Thanks,

Cristian

[Daniel Folch]

Hello,

That message indicates that the replica shard can not be created because the same data is already on the node, this usually happens when there are less nodes than the number of replicas configured for the index.

If you have only one wazuh-indexer/opendistro node you can solve this issue by setting the number of replicas to 0, another solution would be to add more nodes to the cluster.

Regards,

Daniel F

[Cristian Radu]

Hello Daniel,

Thanks for the help! I solved the issue as you suggested.

Have a good day!

BR,

Cristian