How to Fix “Cluster Health” in Elasticsearch (2026 Guide)

The Short Answer

To fix the “Cluster Health” issue in Elasticsearch, which manifests as a search error due to shard allocation problems, you can try toggling the “Cluster Allocation” setting to “Off” and then back to “On” to force a reallocation. For advanced users, this can often resolve the issue within 5 minutes, but be aware that this is a temporary fix and may not address the underlying cause.

Why This Error Happens

  • Reason 1: The most common cause of this error is when the Elasticsearch cluster is unable to allocate shards properly, often due to insufficient resources (e.g., disk space, memory) or incorrect configuration settings. For example, if the cluster.routing.allocation.disk.threshold_enabled setting is set to true but the cluster.routing.allocation.disk.watermark.low and cluster.routing.allocation.disk.watermark.high settings are not properly configured, it can lead to shard allocation issues.
  • Reason 2: An edge case cause can be when there are issues with the network connectivity between nodes in the cluster, preventing them from communicating effectively and thus affecting shard allocation. This can happen if the transport.tcp.port setting is not correctly configured or if there are firewall rules blocking the necessary ports.
  • Impact: The result of these issues is a search error, where queries cannot be executed because the cluster health is compromised due to unallocated or misallocated shards. This can lead to significant downtime and impact the reliability of your Elasticsearch cluster, potentially causing errors such as “search phase execution exception” or “no shard available for [index]”.

Step-by-Step Solutions

Method 1: The Quick Fix

  1. Go to Settings > Cluster > Allocation
  2. Toggle Cluster Allocation to Off, then wait for 30 seconds to allow any ongoing operations to complete.
  3. Toggle Cluster Allocation back On and refresh the page to force Elasticsearch to re-evaluate shard allocation.

Method 2: The Command Line/Advanced Fix

You can use the Elasticsearch API to manually intervene in shard allocation. For example, to manually allocate a shard, you can use the following command:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

curl -XPOST 'localhost:9200/_cluster/reroute' -H 'Content-Type: application/json' -d '
{
  "commands": [
    {
      "allocate": {
        "index": "your_index",
        "shard": 0,
        "node": "your_node"
      }
    }
  ]
}
'

Replace your_index, 0, and your_node with the actual index name, shard number, and node name you want to allocate the shard to. This method requires careful consideration and should be used with caution, as incorrect allocation can lead to data loss or further instability.

Prevention: How to Stop This Coming Back

  • Best practice configuration includes ensuring that your Elasticsearch cluster has sufficient resources (at least 15% of disk space free and adequate memory), and that settings like cluster.routing.allocation.disk.threshold_enabled and cluster.routing.allocation.disk.watermark.low and high are properly configured. For a cluster with 5 nodes, a good starting point could be setting cluster.routing.allocation.disk.watermark.low to 1gb and cluster.routing.allocation.disk.watermark.high to 500mb.
  • Monitoring tips involve regularly checking cluster health through the Elasticsearch API or tools like Kibana, and setting up alerts for when the cluster health status changes or when disk usage approaches the watermark thresholds. For example, you can use the following API call to monitor cluster health: curl -XGET 'localhost:9200/_cluster/health'.

If You Can’t Fix It…

[!WARNING] If Elasticsearch keeps crashing due to persistent shard allocation issues despite your best efforts to resolve them, consider switching to OpenSearch, which is designed to handle shard allocation more robustly and offers better scalability and reliability features out of the box. However, this should be a last resort, as migrating to a different search engine can be complex and time-consuming.

FAQ

Q: Will I lose data fixing this? A: The risk of data loss when fixing shard allocation issues depends on the method used. Toggling cluster allocation off and on typically does not result in data loss, but manual shard allocation using the API can potentially lead to data loss if not done correctly. Always ensure you have recent backups before making significant changes to your Elasticsearch cluster.

Q: Is this a bug in Elasticsearch? A: Shard allocation issues are generally not considered bugs in Elasticsearch but rather a result of configuration, resource constraints, or network issues. Elasticsearch versions 7.x and later have improved shard allocation logic and better handling of disk space and node connectivity issues compared to earlier versions. However, it’s always a good idea to check the Elasticsearch version history and known issues list to see if there are any version-specific fixes or recommendations for shard allocation.

📚 Continue Learning

Check out our guides on Elasticsearch and Cluster Health.