Elasticsearch red/yellow cluster & unassigned shards

Symptom

_cluster/health 'red' or 'yellow'; unassigned shards; reads/writes restricted or data inaccessible.

1. Color and cause

yellow = replica shards are unassigned (data is present, durability is reduced). red = at least one PRIMARY shard is missing (that data is inaccessible). First determine which one and why.

Elasticsearch

GET _cluster/health?level=indices
GET _cluster/allocation/explain

2. List unassigned shards and the reason

The unassigned.reason column gives the root cause (NODE_LEFT, ALLOCATION_FAILED, DISK, etc.).

Elasticsearch

GET _cat/shards?v&h=index,shard,prirep,state,unassigned.reason&s=state

3. Address the common causes

1) Disk watermark → above low, the node receives no new shards; at flood_stage, indices become read-only. 2) A node went down / left. 3) Allocation was left disabled. 4) Replica count > number of eligible nodes.

4. Fix

Unblock according to whichever cause applies.

Elasticsearch

# If disk space was freed, remove the read-only block (7.4+ also lifts it automatically once below the high watermark):
PUT _all/_settings {"index.blocks.read_only_allow_delete": null}
# If allocation was left restricted, return it to the default (all):
PUT _cluster/settings {"persistent":{"cluster.routing.allocation.enable":null}}
# Retry failed allocations:
POST _cluster/reroute?retry_failed=true

5. If still red and the primary is truly lost

Restore the affected index from a snapshot or reindex it from the source data (_reindex). Permanent: disk watermark alerting, an appropriate replica count (≥1) and node health monitoring.