ELK: How to delete unassigned shards to restore cluster health

ELK: How to delete unassigned shards to restore cluster health

If your ElasticSearch cluster is not healthy because of unassigned shards, there are multiple ways to recover that. The procedure will be executed when those unassigned shards are not required anymore, and deleting them restores cluster health.

First, we check on the cluster health and get the count of unassigned shards.

[root@elkserver conf.d]# curl -XGET http://<elastisearchserver>:9200/_cluster/health?pretty | grep unassigned_shards
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   468  100   468    0     0   306k      0 --:--:-- --:--:-- --:--:--  457k
  "unassigned_shards" : 15,
  "delayed_unassigned_shards" : 0,
[root@elkserver conf.d]#

The list of UNASSIGNED Shards:

[root@elkserver conf.d]# curl -XGET http://<elastisearchserver>:9200/_cat/shards | grep UNASSIGNED | awk {'print $1'}
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3191  100  3191    0     0  51666      0 --:--:-- --:--:-- --:--:-- 52311
%{[@metadata][beat]}-%{[@metadata][version]}-2020.02.18
%{[@metadata][beat]}-%{[@metadata][version]}-2020.02.18
%{[@metadata][beat]}-%{[@metadata][version]}-2020.02.18
%{[@metadata][beat]}-%{[@metadata][version]}-2020.02.18
%{[@metadata][beat]}-%{[@metadata][version]}-2020.02.18
logstash-2020.02.18
logstash-2020.02.18
logstash-2020.02.18
logstash-2020.02.18
logstash-2020.02.18
filebeat-6.8.6-2020.02.18
filebeat-6.8.6-2020.02.18
filebeat-6.8.6-2020.02.18
filebeat-6.8.6-2020.02.18
filebeat-6.8.6-2020.02.18
[root@elkserver conf.d]

Now delete the UNASSIGNED shards

curl -XGET http://<elastisearchserver>:9200/_cat/shards | grep UNASSIGNED | awk {'print $1'} | xargs -i curl -XDELETE "http://<elastisearchserver>:9200/{}"