Status red

Condition: Shown when only initializing shards.

There is 12 shard initializing. Wait for initialization to finish; cluster status should update when all shards are ready.

Condition: Shown when data node is disconnected and might rejoin.

Shard recovery is in progress after data nodes restarted or were removed: es-data-01. Wait until recovery finishes before making other cluster changes.

Condition: Shown when no initializing shards.

Use cluster allocation explain to see why shards are unassigned for index logs-prod-000045, shard 0. Run the action below.

GET _cluster/allocation/explain
{
  "index": "logs-prod-000045",
  "shard": 0,
  "primary": true
}

Condition: Shown when no initializing shards AND disk watermark or data-tier capacity is NOT the likely allocation blocker.

index.routing.allocation.total_shards_per_node on logs-prod-000045 might block replica assignment. Fetch index settings with the action below and adjust or remove the limit if it causes unassigned shards.

GET logs-prod-000045/_settings?include_defaults=true&filter_path=**.index.routing.allocation.total_shards_per_node

Condition: Shown when any shard failed to be allocated.

If shards failed to allocate and nothing is recovering, retry allocation with a cluster reroute. Use the action below (retry_failed=true).

POST _cluster/reroute?retry_failed=true

Condition: Shown when allocation is NOT blocked by a disk watermark or data-tier capacity constraint (that is, primary data is likely unrecoverable).

If you have a snapshot of the red index, delete the index and restore it from that snapshot.

Condition: Shown when any index has lost a primary shard AND allocation is NOT blocked by a disk watermark or data-tier capacity constraint (data is intact).

Only if you accept data loss for index logs-prod-000045 shard 0, allocate an empty primary with accept_data_loss to return the cluster toward green. Use the action below.

POST _cluster/reroute
{ "commands" : [ { "allocate_empty_primary" : { "index" : "logs-prod-000045", "shard":0, "node" : "es-data-02", "primary": "true" "accept_data_loss": true } } ] }

Condition: Shown when the red index is not recoverable AND allocation is NOT blocked by a disk watermark or data-tier capacity constraint.

If departed nodes cannot rejoin and affected indices cannot be recovered, delete them with the action below. This step is irreversible and should be a last resort to restore cluster health.

DELETE logs-prod-000045

Condition: Shown when a disk watermark breach on a non-frozen data tier (hot, warm, cold, or content) is the likely current allocation blocker; prefer gating via the existing DISK_WATERMARK_LOW indication.

Temporarily raise the disk watermark so you can free space before the cluster restricts shard allocation. After you reclaim disk, return the watermark to its previous value. Use the action below to update cluster.routing.allocation.disk.watermark.high.

PUT _cluster/settings
{
  "transient": {
    "cluster.routing.allocation.disk.watermark.high": "90%"
  }
}

Condition: Shown when index replication exceeds available data nodes OR a non-frozen data-tier capacity shortfall is the likely current allocation blocker (capacity-blocked OR replication-blocked).

Add a data node to increase capacity and reduce pressure on the existing nodes.