Elasticsearch Operator: red clusters on Elasticsearch and OpenSearch

Elasticsearch Operator investigates red and yellow Elasticsearch and OpenSearch clusters, from unassigned shards to snapshots, and recovers them without deleting an index.

REQUEST DEMO

READ THE DOCS

When an Elasticsearch or OpenSearch cluster turns red or yellow, 2501's Elasticsearch Operator specialty works out why each shard is unassigned and recovers what can be recovered safely.

A red cluster means at least one primary shard is unassigned, so part of an index cannot be searched or written. The fixes people reach for under pressure, deleting the index or forcing the shard back from whatever copy is left, are the ones that lose data.

What 2501 does

The Elasticsearch specialty takes these alerts and requests from your ticketing system. It finds the reason behind each unassigned shard, whether a node left, an allocation failed or a disk filled, and retries the recoveries that are safe to retry. It reopens indices in scope, diagnoses lifecycle rules that stopped rotating indices, checks that snapshot storage works, and investigates failed snapshots, slow indexing or searches and nodes that dropped out. It restores from a snapshot only when a ticket asks, and into a new index beside the live one.

Scope map of 2501's Elasticsearch Operator: it finds why shards are unassigned, retries safe recoveries, reopens closed indices in scope, lifts read-only blocks once the disk problem is solved, checks snapshot storage and restores into a new index beside the live one; forcing a shard from a stale or empty copy and deleting a snapshot early need a person, and it never deletes a red index or loosens disk limits.

You stay in control

You choose the level, per specialty: investigate only, act after a person confirms, or act on its own within your rules.
Settings stay yours: cluster settings, templates for new indices and lifecycle rules are read-only to it unless you allow changes.
Data-losing moves wait for a person: forcing a shard from a stale or empty copy, or deleting a snapshot before its retention is confirmed. Destructive commands can be blacklisted outright.
On-prem, cloud or hybrid: 2501 runs wherever you do, including fully air-gapped on-prem networks.

Frequently asked

Will it delete a red index to turn the cluster green? No. That index may hold the only recoverable copy of its data, so it is recovered or escalated, not removed.

Why did my indices become read-only? Usually a data node ran short of disk and the cluster blocked writes. 2501 lifts the block only once the disk problem is solved, without loosening the disk limits.

Problems it handles

Each page is one kind of ticket, and how this specialty handles it within the limits you set.

A red Elasticsearch cluster with unassigned primary shards gets back what can be recovered after 2501 finds why each shard is unassigned, without deleting an index or forcing a stale copy

Problem

Elasticsearch cluster red

Deleting the red index or forcing a stale shard turns a cluster green and can lose data. How 2501 finds why each shard is unassigned and recovers what is safe to recover.

See how it is handled

Elasticsearch Operator: red clusters on Elasticsearch and OpenSearch

What 2501 does

You stay in control

Frequently asked

Related

Problems it handles

SEE IT ON YOUR OWN INFRASTRUCTURE