Status Red
Cluster health is red because at least one primary shard is unassigned or unavailable. Affected indices cannot accept writes and might return incomplete search results.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Critical |
| Scope | Cluster |
| Domains | cluster-health, high-availability |
You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to AutoOps event settings for details.
The default customization settings are:
| Setting | Type | Default |
|---|---|---|
| Minimum duration of the red status in seconds | Integer | 0 |
| Index name patterns excluded from red status | List of strings | partial-,restored- |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
The current number of unassigned primary shards is: 12. The maximum number of unassigned shards is: 12. The number of initializing shards is: 12. Current allocation blocker: Disk low watermark is blocking primary shard allocation on the hot, warm tier.
truetrue See sample list: logs-prod-000045, logs-prod-000046.
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Wait for shard initialization to complete
Condition: Shown when only initializing shards.
There initializing. Wait for initialization to finish; cluster status should update when all shards are ready.
Wait for shard recovery to complete
Condition: Shown when data node is disconnected and might rejoin.
Shard recovery is in progress after data nodes restarted or were removed: es-data-01. Wait until recovery finishes before making other cluster changes.
Explore shard allocation in the cluster
Condition: Shown when no initializing shards.
Use cluster allocation explain to see why shards are unassigned for index logs-prod-000045, shard 0. Run the action below.
GET _cluster/allocation/explain
Requires the manage cluster privilege. Requires Elasticsearch 8.0.0 or later. This action is read-only.
Check total shards per node limit
Condition: Shown when no initializing shards AND disk watermark or data-tier capacity is NOT the likely allocation blocker.
index.routing.allocation.total_shards_per_node on logs-prod-000045 might block replica assignment. Fetch index settings with the action below and adjust or remove the limit if it causes unassigned shards.
GET logs-prod-000045/_settings
Requires the manage index privilege. Requires Elasticsearch 8.0.0 or later. This action is read-only.
Retry failed shard allocations
Condition: Shown when any shard failed to be allocated.
If shards failed to allocate and nothing is recovering, retry allocation with a cluster reroute. Use the action below (retry_failed=true).
POST _cluster/reroute?retry_failed=true
Requires the manage cluster privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
Restore red index from snapshot
Condition: Shown when allocation is NOT blocked by a disk watermark or data-tier capacity constraint (that is, primary data is likely unrecoverable).
If you have a snapshot of the red index, delete the index and restore it from that snapshot.
Allocate empty primary (data loss)
Condition: Shown when any index has lost a primary shard AND allocation is NOT blocked by a disk watermark or data-tier capacity constraint (data is intact).
Only if you accept data loss for index logs-prod-000045 shard 0, allocate an empty primary with accept_data_loss to return the cluster toward green. Use the action below.
POST _cluster/reroute
{ "commands" : [ { "allocate_empty_primary" : { "index" : "logs-prod-000045", "shard":0, "node" : "es-data-02", "primary": "true" "accept_data_loss": true } } ] }
Requires the manage cluster privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
Delete unrecoverable red index
Condition: Shown when the red index is not recoverable AND allocation is NOT blocked by a disk watermark or data-tier capacity constraint.
If departed nodes cannot rejoin and affected indices cannot be recovered, delete them with the action below. This step is irreversible and should be a last resort to restore cluster health.
DELETE logs-prod-000045
Requires the manage cluster privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
Temporary disk watermark increase
Condition: Shown when a disk watermark breach on a non-frozen data tier (hot, warm, cold, or content) is the likely current allocation blocker; prefer gating via the existing DISK_WATERMARK_LOW indication.
Temporarily raise the disk watermark so you can free space before the cluster restricts shard allocation. After you reclaim disk, return the watermark to its previous value. Use the action below to update cluster.routing.allocation.disk.watermark.high.
PUT _cluster/settings
{
"transient": {
"cluster.routing.allocation.disk.watermark.high": "90%"
}
}
Requires the manage cluster privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
Add data node
Condition: Shown when index replication exceeds available data nodes OR a non-frozen data-tier capacity shortfall is the likely current allocation blocker (capacity-blocked OR replication-blocked).
Add a data node to increase capacity and reduce pressure on the existing nodes.
Impact: Some data is not available for search and there is a high probability of data loss. Red status means one or more primary shards are unavailable. While this persists, affected indices cannot accept writes and search results are incomplete. The root cause is not always data loss: allocation rules that block placement while data is still intact, such as disk watermarks or capacity limits on a data tier, are a common cause alongside node outages and failed recoveries. This might also be transient following a node restart or during snapshot restore of indices on cold or frozen tiers. Confirm why shards stay unassigned before accepting data loss or deleting an index. You can reduce alert noise by configuring an exclusion pattern for lower-risk index families or a minimum red duration for transient events. If neither suppression applies, investigate urgently.