FresherTechnicalElasticsearch
What do the green, yellow and red cluster statuses mean?
Try answering first
Model answer
The cluster health status summarises shard allocation.
- green: all primary and replica shards are assigned. Everything works and is redundant.
- yellow: all primaries are assigned, but at least one replica is not. Searches and writes work and no data is lost, but there is no redundancy for those shards.
- red: at least one primary shard is not assigned. Part of the data is unavailable, searches can return partial results or errors, and writes to those shards fail.
GET _cluster/health
GET _cluster/health?level=indices
GET _cat/health?v
The first call returns status, number_of_nodes, active_primary_shards, unassigned_shards and more. level=indices shows the status per index, and the cluster status is the worst status of any index.
A new single-node cluster with the default one replica shows yellow, because replicas have no second node to live on. Yellow after a node loss means replicas are being rebuilt. Red after a node loss means primaries were lost with no copy.
Alert on red immediately and on prolonged yellow.
Green means complete, yellow means no redundancy, and red means missing data.
Key points
- Green means all shards are assigned
- Yellow means replicas are missing, no data loss
- Red means a primary is missing and data is unavailable
- Cluster status is the worst index status
Likely follow-ups
- Why is a one-node development cluster often yellow?
- How do you find which index makes the cluster red?
Common mistakes
- Treating yellow as harmless in production
- Looking only at cluster status without per-index status