How do you investigate a yellow or red Elasticsearch cluster?

Question

IT Interview Practice · Accepted Answer

Yellow means the primary data shards are assigned but at least one replica copy has no assigned node. Red means at least one primary has no assigned node, so some data may be unavailable.

## Identify the affected shard

In Kibana Dev Tools, start with:

```http
GET /_cat/shards?v&h=index,shard,prirep,state,node
```

An illustrative row `products 0 r UNASSIGNED` means replica `r` of shard 0 has no destination. If `p`, the primary, is unassigned instead, investigate data availability urgently.

## Ask why allocation was refused

For that replica, request an explanation:

```http
GET /_cluster/allocation/explain
{
  "index": "products",
  "shard": 0,
  "primary": false
}
```

Read `can_allocate` and the per-node allocation decisions. A disk-space rejection leads to checking capacity; a rule excluding all available nodes leads to reviewing that rule. This turns a cluster color into a specific cause to fix.

## Recover without discarding data

A one-node development cluster cannot place a replica beside its own primary. Reducing replicas may be acceptable there, but removes redundancy. In production, restore resources or a valid copy, or use a tested snapshot when necessary. Do not force an empty or stale primary just to obtain green status: it can lose data. Verify allocation and application behavior after recovery.

[Official documentation](https://www.elastic.co/docs/troubleshoot/elasticsearch/red-yellow-cluster-status).

Identify the affected shard

Ask why allocation was refused

Recover without discarding data

Related questions