Elasticsearch Cluster Health 101: Understanding, Monitoring, and Maintaining Your Cluster

Elasticsearch reports cluster health in three states—green, yellow, and red—each indicating the allocation status of primary and replica shards. Master‑eligible nodes maintain the cluster state and elect a master through a quorum‑based voting algorithm, preventing split‑brain scenarios. When a node starts, it discovers peers via discovery.seed_hosts and registers itself to receive the latest state. Unassigned shards arise when allocation rules cannot be satisfied, often due to disk thresholds or disabled allocation, and they trigger rebalancing that promotes replicas to primaries and creates new replicas on available nodes. The GET /_cluster/health API returns key fields such as status, active_primary_shards, unassigned_shards, and relocating_shards, and can block until a desired status with wait_for_status. Diagnosing a red cluster involves identifying missing primary shards, checking node health and disk usage, freeing space or adding nodes, enabling allocation, and optionally forcing allocation with _cluster/reroute. A yellow cluster indicates missing replicas but still readable data; solutions include waiting for automatic rebalancing, adding data nodes, or reviewing allocation filters. High CPU or memory usage can occur even when the cluster is green, requiring monitoring of node metrics and shard distribution.