Handling an Elasticsearch Index in the Red State
GET _cat/shards?v=true&h=index,shard,prirep,state,node,unassigned.reason&s=state
1
2
| ops-pod-loggie-2026.06.11 0 p UNASSIGNED NODE_LEFT
ops-pod-loggie-2026.06.11 0 r UNASSIGNED ALLOCATION_FAILED
|
Try to reallocate.
1
| POST _cluster/reroute?retry_failed=true
|
Or delete it outright.
1
| DELETE ops-pod-loggie-2026.06.11
|
Scheduled Index Cleanup
Keep all indexes for only 7 days.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
| PUT _ilm/policy/ops-delete-after-7d
{
"policy": {
"phases": {
"hot": {
"actions": {}
},
"delete": {
"min_age": "7d",
"actions": {
"delete": {}
}
}
}
}
}
|
1
2
3
4
5
6
7
8
9
10
| PUT _index_template/ops-delete-after-7d
{
"index_patterns": ["*", "-.*"],
"priority": 1,
"template": {
"settings": {
"index.lifecycle.name": "ops-delete-after-7d"
}
}
}
|
- Associate existing indexes
1
2
3
4
| PUT /*,-.*/_settings
{
"index.lifecycle.name": "ops-delete-after-7d"
}
|
Deleting All Indexes
1
2
3
4
5
6
| PUT _cluster/settings
{
"transient": {
"action.destructive_requires_name": false
}
}
|
- Restore the safety setting
1
2
3
4
5
6
| PUT _cluster/settings
{
"transient": {
"action.destructive_requires_name": true
}
}
|
Cleaning Up Indexes
1
2
3
4
5
6
7
8
9
10
11
| USER="elastic"
PASS=""
URL="http://localhost:9200"
REFINE="ops-*"
INDICES=$(curl -s -u "$USER:$PASS" "$URL/_cat/indices/$REFINE?h=index")
for index in $INDICES; do
echo "del: $index"
curl -s -u "$USER:$PASS" -X DELETE "$URL/$index"
done
|
