Elastic Cheat Sheet

elastic_cheat_sheet.md

Elasticsearch Cheat Sheet

Populating this as we dig further into the platform, hopefully it'll be as useful to you as it is to use.

• When you need to reboot at least one node
• Explain why a shard is unallocated
• Fix an unallocated primary shard
• Turn off replication for an index
• Set transaction log (TRANSLOG) size

A few disclosures:

1. v8 is the prefix for all our indices. Replace uses of it with whatever yours are, or you can wildcard as well
2. Replace the IPs with your master node IP, especially for cluster-wide changes.

When you need to reboot at least one node

1. Disable shard allocation.

   curl -XPUT 'http://10.10.219.241:9200/_cluster/settings' -d '{
       "transient": {
           "cluster.routing.allocation.enable": "none"
       }
   }'

2. Run a synced flush on all indexes.

   curl -XPOST 'http://10.10.219.241:9200/v8_*/_flush/synced'

3. Stop one node at a time, do your business and restart ES. Wait until it becomes green again. Finish all nodes.

4. Turn rebalancing back on.

   curl -XPUT 'http://10.10.219.241:9200/_cluster/settings' -d '{
       "transient": {
           "cluster.routing.allocation.enable": "all"
       }
   }'

Explain why a shard is unallocated

$ curl -XGET 'http://10.10.219.241:9200/_cluster/allocation/explain' -d'{
  "index": "v8_collections",
  "shard": 0,
  "primary": true
}'

Fix an unallocated primary shard

Happens when a node temporarily leaves the cluster without replication turned on for the index.

curl -XPOST 'http://10.10.219.241:9200/_cluster/reroute' -d '{
    "commands": [{
        "allocate_stale_primary": {
            "index": "v8_datasets_c8b95d37_22b8_4e17_bfab_448d7b0b01e6",
            "shard": 17,
            "node": "search_worker_3",
            "accept_data_loss": true
        }
    }]
}'

Turn off replication for an index

curl -XPUT 'http://10.10.219.241:9200/v8_datasets_2a68234d_0756_4f40_93a7_ade8706f5ef5/_settings' -d '{
    "index": {
        "number_of_replicas": 0
    }
}'

Set transaction log (TRANSLOG) size

We don't want this setting to be too large or it makes shard relocation take FOREVER. It was previously set to 10GB for reference.

curl -XPUT 'http://10.10.219.241:9200/v8_datasets_*/_settings' -d '{
    "index": {
        "translog.flush_threshold_size": "512mb"
    }
}'