Determining the availability of Shards

Similar to operating system metrics for a server, the cluster health status is a basic metric for Elasticsearch. It provides an overview of running nodes and the status of shards distributed to the nodes. 

The metrics listed here will help you to check the allocation of Shards on the cluster. 

Cluster status

Cluster status helps us understand the availability of the replica shards. 

If the cluster status is yellow, at least one replica shard is not allocated. You might loose data if the Shards continue to disappear. A red cluster status indicates that at least one primary shard is missing, that means the searches will return partial results. 

The KM indicates these states as:

0 = Green - All primary and replica shards are active.

1 = Yellow - All primary shards are active, but not all replica shards are active.

2 = Red - Not all primary shards are active.

For more information about this attribute, see Cluster Status attribute page.

Set threshold on this attribute to get notified about the status of the Cluster. The KM generates an alarm and triggers an event when the Cluster health is at risk. 

Suggested action

The KM event indicates that you might want to check the allocation of primary and replica Shards in the Cluster.

Active primary shards

Shard allocation helps us understand if the application is using optimum number of Shards. A high number of active primary Shards indicates that the application is using a fair amount of primary Shards and the Cluster is stable. For more information about this attribute, see Active Primary Shards attribute page.

Set threshold on this attribute to get notified about number of primary Shards that are active. Consider setting up an alert to trigger if the number of active primary shards drops drastically. The KM generates an alarm and triggers an event when the threshold values are met. 

Suggested action

The KM event indicates that you might want to check the allocation of primary Shards in the Cluster.

Unassigned shards

Shard allocation helps us understand if the application is using optimum number of Shards. A high number of unassigned Shards indicates that the application is not using the available Shards and the Cluster is unstable. For more information about this attribute, see Unassigned Shards attribute page.

Set threshold on this attribute to get notified about number of unassigned Shards. Consider setting up an alert to trigger if the number of unassigned shards increases drastically. The KM generates an alarm and triggers an event when the threshold values are met. 

Suggested action

The KM event indicates that you might want to check the allocation of Shards in the Cluster.

Where to go from here

Using the TrueSight console, you can adjust the thresholds ranges for these monitoring attributes with the Agent Threshold tab in the Infrastructure Policies page. For more information see, Defining a monitoring policy.

Was this page helpful? Yes No Submitting... Thank you

Comments