I85PREP
⌘ K
Elastic Certified Engineer study materials
Elastic Certified Engineer study resources

Elastic Certified Engineer: Cluster Administration

Elastic Certified Engineer · Work through your exam, one topic at a time.

All guide sections

Cluster Administration

What to know

_cluster/health returns green when every primary and replica shard is allocated, yellow when primaries are allocated but replicas are not, and red when at least one primary is unassigned. Allocation is shaped by cluster.routing.allocation.* settings, index-level index.routing.allocation.include/exclude/require filters on node attributes, disk watermarks (low 85%, high 90%, flood-stage 95% by default), and allocation awareness on attributes such as zone. Cluster settings are written through PUT _cluster/settings as persistent or transient; persistent survives a restart, transient does not. Snapshots need a registered repository (fs, s3, gcs, azure, hdfs) and can capture selected indices or the whole cluster with include_global_state.

Traps

  • Yellow is expected on a single node with replicas configured: number_of_replicas > 0 cannot be satisfied. Set it to 0 or add nodes.
  • _cluster/reroute commands (move, allocate_replica, cancel) are manual, one-off interventions; allocate_stale_primary requires accept_data_loss: true and loses data.
  • Allocation filtering references node attributes (_name, _ip, _host), never index names.
  • A flood-stage watermark breach sets index.blocks.read_only_allow_delete, so writes fail with a read-only error that looks unrelated to disk.
  • Restoring into an existing index name fails unless you rename with rename_pattern/rename_replacement or delete the index first.

Rule of thumb

Before declaring a cluster healthy, read _cat/shards?v&h=index,shard,prirep,state,unassigned.reason. The unassigned reason (NODE_LEFT, ALLOCATION_FAILED, INDEX_CREATED) tells you which lever to pull.