Empty indices
Elastic Cloud Hosted lets you manage and configure one or more deployments of the versioned Elastic Stack, hosted on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Elastic Cloud on Kubernetes extends Kubernetes orchestration capabilities to allow you to deploy and manage components of the Elastic Stack. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Enterprise is a self-managed orchestration platform for deploying and managing the Elastic Stack at scale. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Self-managed deployments are Elastic Stack deployments managed without the assistance of an orchestrator. Availability This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
ECH
Generally available
ECK
Generally available
ECE
Generally available
Self-managed
Generally available
Many shards or indices in the cluster contain no documents. Shard balancing counts shards per node, not how much data each shard holds, so empty shards spread like busy ones.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Index |
| Domains | performance, index-management, shard-allocation |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| Exclude indices based on this pattern | List of strings | |
| Total empty indices threshold | Integer | 50 |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
Empty indices: 12
Empty shards: 12
Sample empty indices: logs-prod-000045, logs-prod-000046
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Delete empty indices
Condition: Always shown for this insight.
Delete empty indices that you no longer need to reduce empty shard count. Confirm they are safe to remove before you run the action below.
DELETE logs-prod-000045Requires the manage cluster privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
Set up or review ILM
Condition: Always shown for this insight.
Create or update an ILM policy to control rollover shard size and maximum write age, preventing empty shards from accumulating.
Optimize shard design
Condition: Always shown for this insight.
From Elasticsearch 8.4, use ILM min and max index age and document count to avoid empty or too-frequent rollovers. On earlier versions, schedule deletion of empty indices as part of routine maintenance.
The cluster shard balancer tries to give each data node the same number of shards. It does not weigh how much data each shard holds. Some nodes can end up with many active shards while others hold mostly empty ones. That uneven distribution can create hot spots where search and indexing concentrate on a subset of nodes.