Briefly, this error occurs when Elasticsearch cannot find any active primary shards. This could be due to a number of reasons such as network issues, disk space problems, or node failures. To resolve this issue, you can try restarting the Elasticsearch cluster, checking for any network issues, ensuring there is enough disk space, or checking the health of the nodes. If the problem persists, you may need to reindex your data.
Before you dig into reading this guide, have you tried asking OpsGPT what this log means? You’ll receive a customized analysis of your log.
Try OpsGPT now for step-by-step guidance and tailored insights into your Elasticsearch/OpenSearch operation.
Briefly, this error occurs when a primary shard is not active in Elasticsearch. This can happen if the node that holds the primary shard is down or not responding. The solution is to check the node status and try to restart the node.
For a complete solution to your to your search operation, try for free AutoOps for Elasticsearch & OpenSearch . With AutoOps and Opster’s proactive support, you don’t have to worry about your search operation – we take charge of it. Get improved performance & stability with less hardware.
This guide will help you check for common problems that cause the log ” Primary shards were not active shards=; active= ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: shards, plugin.
Primary shards not active error message indicates that a cluster has not (yet) recovered from a red status. This indicates that one or more indices you are trying to either update or query do not have their primary shard allocated.
What this error means
This error message indicates that a primary shard has been lost or has not been allocated on the cluster. However, users should not panic and start firing off commands without finding out what is really going on first, because Elasticsearch has mechanisms in place to remedy the situation automatically.
Why this error occurs
There can be several reasons why this error would appear:
1. The cluster is in the recovery process, which is not yet complete
If you carry out the command:Â
GET _cluster/health
You can see the cluster status and should be able to see if there are shards in the “initializing” state. If this is the case, then you can wait and the cluster will recover on its own.
2. Disk space issues
Insufficient disk space may prevent Elasticsearch from allocating a shard to a node, and this could be the reason why shards are not active. Typically this will happen when disk utilization goes above the setting below (by default 85%).
cluster.routing.allocation.disk.watermark.low
Here, the solution would require users to delete indices, increasing disk size, or adding a new node to the cluster. Users can also temporarily increase the watermark to keep things running while deciding what to do, but doing nothing is not the best course of action.
PUT _cluster/settings
{
 "transient": {
  "cluster.routing.allocation.disk.watermark.low": "85%",
  "cluster.info.update.interval": "1m"
 }
}You can also get:Â
cannot allocate because allocation is not permitted to any of the nodes
Typically this happens when node disk utilization goes above the flood stage, creating a write block on the cluster. Just like above, users must delete data, or add a new node. The following can be used to buy some time:
PUT _cluster/settings
{
"transient": {
"cluster.routing.allocation.disk.watermark.flood_stage": "97%",
"cluster.info.update.interval": "1m"
}
}For more information, read this guide.
3. Node allocation awareness
Sometimes there may be specific issues with the allocation rules created on the cluster, which prevent the cluster from allocating shards. For example, it is possible to create rules that require a shard’s replicas be spread over a specific set of nodes (“allocation awareness”), such as AWS availability zones or different host machines in a kubernetes setup. On occasion, these rules conflict with other rules (such as disk space) and prevent shards from being allocated.
For further information about Node Allocation Awareness, read this guide.
Find the cause of non-allocation
Use the cluster allocation API:
GET /_cluster/allocation/explain
By running the above command you can get an explanation of the allocation status of the first unallocated shard found.
{
"index" : "my_index",
"shard" : 0,
"primary" : false,
"current_state" : "unassigned",
"unassigned_info" : {
"reason" : "NODE_LEFT",
"at" : "2017-01-04T18:53:59.498Z",
"details" : "node_left[G92ZwuuaRY-9n8_tc-IzEg]",
"last_allocation_status" : "no_attempt"
},
"can_allocate" : "allocation_delayed",
"allocate_explanation" : "cannot allocate because the cluster is still waiting 59.8s for the departed node holding a replica to rejoin, despite being allowed to allocate the shard to at least one other node",
"configured_delay" : "1m",
"configured_delay_in_millis" : 60000,
"remaining_delay" : "59.8s",
"remaining_delay_in_millis" : 59824,
"node_allocation_decisions" : [
{
"node_id" : "pmnHu_ooQWCPEFobZGbpWw",
"node_name" : "node_t2",
"transport_address" : "127.0.0.1:9402",
"node_decision" : "yes"
},
{
"node_id" : "3sULLVJrRneSg0EfBB-2Ew",
"node_name" : "node_t0",
"transport_address" : "127.0.0.1:9400",
"node_decision" : "no",
"store" : {
"matching_size" : "4.2kb",
"matching_size_in_bytes" : 4325
},
"deciders" : [
{
"decider" : "same_shard",
"decision" : "NO",
"explanation" : "the shard cannot be allocated to the same node on which a copy of the shard already exists [[my_index][0], node[3sULLVJrRneSg0EfBB-2Ew], [P], s[STARTED], a[id=eV9P8BN1QPqRc3B4PLx6cg]]"
}
]
}
]
}The above API returns:
“unassigned_info” => The reason why the shard became unassigned.
“node_allocation_decision” => A list of explanations for each node, explaining whether it could potentially receive the shard.
“deciders” => The decision and explanation of that decision.
Overview
Data in an Elasticsearch index can grow to massive proportions. In order to keep it manageable, it is split into a number of shards. Each Elasticsearch shard is an Apache Lucene index, with each individual Lucene index containing a subset of the documents in the Elasticsearch index. Splitting indices in this way keeps resource usage under control. An Apache Lucene index has a limit of 2,147,483,519 documents.
Examples
The number of shards is set when an index is created, and this number cannot be changed later without reindexing the data. When creating an index, you can set the number of shards and replicas as properties of the index using:
PUT /sensor
{
"settings" : {
"index" : {
"number_of_shards" : 6,
"number_of_replicas" : 2
}
}
}The ideal number of shards should be determined based on the amount of data in an index. Generally, an optimal shard should hold 30-50GB of data. For example, if you expect to accumulate around 300GB of application logs in a day, having around 10 shards in that index would be reasonable.
During their lifetime, shards can go through a number of states, including:
- Initializing: An initial state before the shard can be used.
- Started: A state in which the shard is active and can receive requests.
- Relocating: A state that occurs when shards are in the process of being moved to a different node. This may be necessary under certain conditions, such as when the node they are on is running out of disk space.
- Unassigned: The state of a shard that has failed to be assigned. A reason is provided when this happens. For example, if the node hosting the shard is no longer in the cluster (NODE_LEFT) or due to restoring into a closed index (EXISTING_INDEX_RESTORED).
In order to view all shards, their states, and other metadata, use the following request:
GET _cat/shards
To view shards for a specific index, append the name of the index to the URL, for example:
sensor: GET _cat/shards/sensor
This command produces output, such as in the following example. By default, the columns shown include the name of the index, the name (i.e. number) of the shard, whether it is a primary shard or a replica, its state, the number of documents, the size on disk, the IP address, and the node ID.
sensor 5 p STARTED 0 283b 127.0.0.1 ziap sensor 5 r UNASSIGNED sensor 2 p STARTED 1 3.7kb 127.0.0.1 ziap sensor 2 r UNASSIGNED sensor 3 p STARTED 3 7.2kb 127.0.0.1 ziap sensor 3 r UNASSIGNED sensor 1 p STARTED 1 3.7kb 127.0.0.1 ziap sensor 1 r UNASSIGNED sensor 4 p STARTED 2 3.8kb 127.0.0.1 ziap sensor 4 r UNASSIGNED sensor 0 p STARTED 0 283b 127.0.0.1 ziap sensor 0 r UNASSIGNED
Notes and good things to know
- Having shards that are too large is simply inefficient. Moving huge indices across machines is both a time- and labor-intensive process. First, the Lucene merges would take longer to complete and would require greater resources. Moreover, moving the shards across the nodes for rebalancing would also take longer and recovery time would be extended. Thus by splitting the data and spreading it across a number of machines, it can be kept in manageable chunks and minimize risks.
- Having the right number of shards is important for performance. It is thus wise to plan in advance. When queries are run across different shards in parallel, they execute faster than an index composed of a single shard, but only if each shard is located on a different node and there are sufficient nodes in the cluster. At the same time, however, shards consume memory and disk space, both in terms of indexed data and cluster metadata. Having too many shards can slow down queries, indexing requests, and management operations, and so maintaining the right balance is critical.
How to reduce your Elasticsearch costs by optimizing your shards
Watch the video below to learn how to save money on your deployment by optimizing your shards.
Log Context
Log “Primary shards were not active [shards={}; active={}]” class name is GetGlobalCheckpointsAction.java. We extracted the following from Elasticsearch source code for those seeking an in-depth context :
handleIndexNotReady(state; request; listener);
} else {
int active = routingTable.primaryShardsActive();
int total = indexMetadata.getNumberOfShards();
listener.onFailure(
new UnavailableShardsException(null; "Primary shards were not active [shards={}; active={}]"; total; active)
);
}
}
}
[ratemypost]
