What does it mean when an Elasticsearch index has yellow health?

Question

I'm working on an application that creates N indices and N aliases, and there's a one-to-one correspondence between these indices and aliases.

But once in a while, I instead get N indices and N-1 aliases, and one of the indices has a name that should've been used by an alias. For some reason when this happens, the bogus index-that-should-have-been-an-alias-name has a yellow status, while the other indices are all green.

What might cause an index to be the only one that is yellow? I'm hoping understanding this might help me narrow down which part of the code I need to scrutinize to fix the bug.

My elasticsearch.yml has just:

cluster.name: "docker-cluster"
network.host: 0.0.0.0
discovery.zen.ping.unicast.hosts: ["127.0.0.1", "[::1]"]

In production we may have more ES nodes, but this is just a test system, so just one ES node.

Oskar

https://mcmap.net/q/1322859/-partial-query-results-due-to-elasticsearch-cluster-health-yellow this answer explained in detail the cause of yellow status, how to fix it and what is the impact of it, please have a look and let me know if further questions – Beacham

Answer 1

The status "yellow" indicates that replica shards of that certain index could not get allocated to other nodes.

This can happen for various reasons. For example, you have specified more replicas than you have nodes. It depends on your cluster setup and whether you configured shard allocation by your own or not.

Helvetia

1 common reason is if you are running Elasticsearch with only 1 node, like when running Elasticsearch on local in a Docker container, and you only have 1 container. Elasticsearch will not make that node/container a replica, so your indices would always be yellow. – Hartebeest

Related section of the doc: elastic.co/guide/en/elasticsearch/reference/8.4/…: "yellow means that the primary shard is allocated but replicas are not" – Hartebeest

If the replicas are not allocated, can we delete? – Diarrhoea

Answer 2

Elasticsearch will never assign a replica to the same node as the primary shard, so if you only have one node it is perfectly normal and expected for your cluster to indicate yellow. If you understand the risks and implications, then change the number of replicas on each index to be 0.

PUT /my-index/_settings
{
    "index" : {
        "number_of_replicas" : 0
    }
}

Please read this blog https://opster.com/guides/elasticsearch/operations/elasticsearch-yellow-status/

It explains very well how to fix yellow indexes.

Metalloid

Rather than "If you feel better about it being green", it should be "If you understand the risks and implications". – Hartebeest