Keep getting unassigned shards

Cristian Radu

unread,

Dec 15, 2022, 8:02:24 AM12/15/22

to Wazuh mailing list

Hello,

I keep on getting unassigned shards.

curl -X GET "https://localhost:9200/_cluster/health?pretty" -u admin:pass -k
{
"cluster_name" : "wazuh-cluster",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"discovered_master" : true,
"active_primary_shards" : 777,
"active_shards" : 777,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 9,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 98.85496183206108
}
curl -X GET "https://localhost:9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason" -u admin:pass-k | grep UNASSIGNED
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0.opendistro-ism-managed-index-history-2022.12.09-000038 0 r UNASSIGNED INDEX_CREATED
.opendistro-ism-managed-index-history-2022.12.08-000037 0 r UNASSIGNED INDEX_CREATED
100 56717 100 56717 0.opendistro-ism-managed-index-history-2022.12.06-000035 0 r UNASSIGNED CLUSTER_RECOVERED
0 .opendistro-ism-managed-index-history-2022.12.14-000043 0 r UNASSIGNED INDEX_CREATED
581.opendistro-ism-managed-index-history-2022.12.10-000039 0 r UNASSIGNED INDEX_CREATED
71 0 -.opendistro-ism-managed-index-history-2022.12.12-000041 0 r UNASSIGNED INDEX_CREATED
-:--.opendistro-ism-managed-index-history-2022.12.11-000040 0 r UNASSIGNED INDEX_CREATED
:-.opendistro-ism-managed-index-history-2022.12.07-000036 0 r UNASSIGNED CLUSTER_RECOVERED
- --:--:-- --:--:-- 58111
.opendistro-ism-managed-index-history-2022.12.13-000042 0 r UNASSIGNED INDEX_CREATED

I did all the tings mentioned here on the group. Assigned the number of replica to 0, but the shards keep on getting created and unassigned. What can I do to solve this issue?

Thanks,

Cristian

Bin Do Tuan Anh

unread,

Dec 15, 2022, 10:05:49 AM12/15/22

to Wazuh mailing list

Hi,

Can you please let me know about your environment: if you have a single node Elasticsearch cluster?

We can confirm the number of replica by running this command in the Dev Tool:

GET .opendistro-ism-managed-index-history-2022.12.08-000037/_settings

In the response box you will be able to find a number_of_replicas value.

Also, to troubleshoot the issue you can run following command:

GET _cluster/allocation/explain?pretty

The output may provide us with helpful details about why certain shards in your cluster remain unassigned. Please share the output so we can have more information regarding the issue.

Best regards,

Bin.

Cristian Radu

unread,

Dec 19, 2022, 11:13:52 AM12/19/22

to Bin Do Tuan Anh, Wazuh mailing list

Hello Bin,

I have a single node Elasticsearch cluster.

GET .opendistro-ism-managed-index-history-2022.12.08-000037/_settings

{
".opendistro-ism-managed-index-history-2022.12.08-000037" : {
"settings" : {
"index" : {
"hidden" : "true",
"number_of_shards" : "1",
"provided_name" : "<.opendistro-ism-managed-index-history-{now/d{yyyy.MM.dd}}-000037>",
"creation_date" : "1670485173360",
"number_of_replicas" : "1",
"uuid" : "E9A6iOC2Tk2ib8gMq0xMig",
"version" : {
"created" : "135238227"
}
}
}
}
}

GET _cluster/allocation/explain?pretty

{
"index" : ".opendistro-ism-managed-index-history-2022.12.18-000047",
"shard" : 0,
"primary" : false,
"current_state" : "unassigned",
"unassigned_info" : {
"reason" : "INDEX_CREATED",
"at" : "2022-12-18T15:39:33.449Z",
"last_allocation_status" : "no_attempt"
},
"can_allocate" : "no",
"allocate_explanation" : "cannot allocate because allocation is not permitted to any of the nodes",
"node_allocation_decisions" : [
{
"node_id" : "Wgcxeaj4RM6UkojA65tufg",
"node_name" : "node-1",
"transport_address" : "10.1.220.178:9300",
"node_attributes" : {
"shard_indexing_pressure_enabled" : "true"
},
"node_decision" : "no",
"weight_ranking" : 1,
"deciders" : [
{
"decider" : "same_shard",
"decision" : "NO",
"explanation" : "a copy of this shard is already allocated to this node [[.opendistro-ism-managed-index-history-2022.12.18-000047][0], node[Wgcxeaj4RM6UkojA65tufg], [P], s[STARTED], a[id=e1LUndo5TEeUDXYaP-PP8w]]"
}
]
}
]
}

Thanks for your assistance!

Br

Cristian

--
You received this message because you are subscribed to a topic in the Google Groups "Wazuh mailing list" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wazuh/f8wHKXWSLSk/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/1668900e-1855-4835-ac38-fc35177f922an%40googlegroups.com.

Bin Do Tuan Anh

unread,

Dec 20, 2022, 12:32:42 PM12/20/22

to Wazuh mailing list

Hi,

As we can see number of replicas is not 0. Most probably you have assigned the number of replicas to 0 for existing indexes. So every time it creates a new Index it does not get the configuration with 0 replicas.

To disable all the future indexes you can run following command in the Dev Tool:

PUT /_cluster/settings
{
"persistent" : {
"opendistro" : {
"index_state_management" : {
"history" : {
"number_of_replicas" : "0"
}
}
}
}
}