AWS OpenSearch Support
Fix OpenSearch cluster status red or yellow.
Yellow means primary shards are allocated but some replicas are not. Red means at least one primary shard is missing, so some data is unavailable. The cause is usually disk space, a lost node without replicas or too many shards. We find out why shards are unassigned before changing anything.
When You Need This
The situations where this work pays for itself.
Signs it is time
- ClusterStatus.red or ClusterStatus.yellow alarms are firing
- Writes are blocked with a cluster block error such as index read-only
- A data node was replaced and indices did not recover
- A single-node domain shows yellow permanently
- Searches return partial results or errors for some indices
What you get
- Root cause for the status with supporting output
- Recovery of affected indices from replicas or snapshots
- Capacity and replica configuration fixes
- CloudWatch alarms for status, storage and write blocks
How we do it
A clear, safe process you can follow along with.
1. Check the health and the metrics
We read ClusterStatus, Nodes, FreeStorageSpace, ClusterIndexWritesBlocked and JVMMemoryPressure in CloudWatch to see whether the cause is capacity, a node loss or a blocked write state.
2. Find the unassigned shards
With _cluster/health and _cat/shards we list unassigned shards, which indices they belong to and whether they are primaries or replicas.
3. Ask OpenSearch why
_cluster/allocation/explain reports the reason, such as no node with enough disk, allocation rules, shard limits per node or a failed node.
4. Fix yellow
Yellow on a one-node domain is expected because replicas have nowhere to go. Otherwise we add capacity, free disk space, or lower replica count for indices that cannot be placed.
5. Fix red
A red cluster after node loss may recover as nodes return. If a primary is truly lost and there was no replica, we restore the index from an automated or manual snapshot, or delete and recreate a disposable index.
6. Fix disk watermark issues
When a node crosses disk watermarks, OpenSearch stops allocating and may block writes. We free space, delete old indices, scale storage or nodes, and clear the write block once safe.
7. Prevent a repeat
We add alarms on free storage, node count and status, set replica counts for production, and review shard counts so a node failure does not leave you red.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Deleting indices to clear red before checking snapshots
That can destroy data that was recoverable.
Running with zero replicas in production
One node failure then causes red.
Ignoring disk until writes block
Disk watermarks trigger blocks that need active clearing.
Frequently Asked Questions
What does a yellow OpenSearch cluster mean?
All primary shards are assigned but one or more replicas are not. Data is available, but you lack redundancy until replicas are assigned.
What does a red OpenSearch cluster mean?
At least one primary shard is unassigned, so data in that index is unavailable or partial. Find out which index and why before taking action.
How do I restore a red index on Amazon OpenSearch Service?
If a replica or the node returns, it may self-recover. Otherwise restore the index from a snapshot, noting that automated snapshots can be used but must be restored using the snapshot API.
Want Help With Fix OpenSearch cluster status red or yellow?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required