ElasticSearch stack has an extremely large amount of unassigned shards
Issue
To delete an unassigned shard the command
$ oc exec $es_pod -- curl -s --key /etc/elasticsearch/secret/admin-key --cert /etc/elasticsearch/secret/admin-cert --cacert /etc/elasticsearch/secret/admin-ca -XDELETE https://localhost:9200/<index_name>
Is usually used. This command can only delete one shard at a time.
The number of unassigned shards in the EFK stack can get incredibly large depending on the size of the stack. This makes effectively deleting all the unassigned shards very repetitive and takes a large amount of time.
Environment
- Red Hat OpenShift Container Platform (RHOCP)
- 3
- 4
- Red Hat OpenShift Logging (RHOL)
- 5
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.