SearchPhaseExecutionException[无法执行阶段[查询]，所有分片失败] [英] SearchPhaseExecutionException[Failed to execute phase [query], all shards failed]

问题描述

最近我们的服务器在没有正确关闭 Elastic Search/Kibana 的情况下重新启动.重启后，两个应用程序都在运行，但不再创建索引.我在调试模式下检查了 logstash 设置，它正在向 Elastic Search 发送数据.

Recently our server was rebooted without correctly shutting down the Elastic Search / Kibana. After that reboot, both applications were running but no indices were getting created anymore. I checked logstash setup in debug mode and it is sending data to Elastic Search.

现在我创建的所有窗口都报告此错误:

now all my created windows report this error:

Oops! SearchPhaseExecutionException[Failed to execute phase [query], all shards failed]

我尝试重新启动 Elastic Search/Kibana，并清除了一些索引.我搜索了很多，但无法正确解决此问题.

I tried restarting Elastic Search / Kibana, and cleared some indices. I searched a lot but wasn't able to troubleshoot this correctly.

当前集群健康状态为红色，如图所示.

Current Cluster Health Status is RED as shown in picture.

有关如何解决已投票问题的任何帮助.谢谢

Any help as of how to troubleshoot that is upvoted. Thank you

[2015-05-06 00:00:01,561][WARN ][cluster.action.shard     ] [Indech] [logstash-2015.03.16][1] sending failed shard for [logstash-2015.03.16][1], node[fdSgUPDbQB2B3NQqX7MdMQ], [P], s[INITIALIZING], indexUUID [aBcfbqnNR4-AGEdIR8dVdg], reason [Failed to start shard, message [IndexShardGatewayRecoveryException[[logstash-2015.03.16][1] failed to recover shard]; nested: ElasticsearchIllegalArgumentException[No version type match [101]]; ]]
[2015-05-06 00:00:01,561][WARN ][cluster.action.shard     ] [Indech] [logstash-2015.03.16][1] received shard failed for [logstash-2015.03.16][1], node[fdSgUPDbQB2B3NQqX7MdMQ], [P], s[INITIALIZING], indexUUID [aBcfbqnNR4-AGEdIR8dVdg], reason [Failed to start shard, message [IndexShardGatewayRecoveryException[[logstash-2015.03.16][1] failed to recover shard]; nested: ElasticsearchIllegalArgumentException[No version type match [101]]; ]]
[2015-05-06 00:00:02,591][WARN ][indices.cluster          ] [Indech] [logstash-2015.04.21][4] failed to start shard
org.elasticsearch.index.gateway.IndexShardGatewayRecoveryException: [logstash-2015.04.21][4] failed to recover shard
    at org.elasticsearch.index.gateway.local.LocalIndexShardGateway.recover(LocalIndexShardGateway.java:269)
    at org.elasticsearch.index.gateway.IndexShardGatewayService$1.run(IndexShardGatewayService.java:132)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    at java.lang.Thread.run(Thread.java:744)
Caused by: org.elasticsearch.ElasticsearchIllegalArgumentException: No version type match [52]
    at org.elasticsearch.index.VersionType.fromValue(VersionType.java:307)
    at org.elasticsearch.index.translog.Translog$Create.readFrom(Translog.java:364)
    at org.elasticsearch.index.translog.TranslogStreams.readTranslogOperation(TranslogStreams.java:52)
    at org.elasticsearch.index.gateway.local.LocalIndexShardGateway.recover(LocalIndexShardGateway.java:241)

我在logsis中关注的是什么:

what concerns me in the logsis this:

[2015-05-06 15:13:48,059][DEBUG][action.search.type       ] All shards failed for phase: [query]



{
  "cluster_name" : "elasticsearch",
  "status" : "red",
  "timed_out" : false,
  "number_of_nodes" : 8,
  "number_of_data_nodes" : 1,
  "active_primary_shards" : 120,
  "active_shards" : 120,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 310
}

推荐答案

您有许多损坏的 translog 文件，您需要删除它们.您可以在 data/{clustername}/nodes/0/indices/logstash-2015.04.21/4/translog 中找到它，另一个在 data/{clustername}/nodes/0/索引/logstash-2015.03.16/1/translog.也许其他人，但这是我从你提供的片段中可以看出的.当然，会丢失 translog 文件中的内容.

You have many corrupt translog files, which you need to delete. You can find it in data/{clustername}/nodes/0/indices/logstash-2015.04.21/4/translog and another one in data/{clustername}/nodes/0/indices/logstash-2015.03.16/1/translog. And maybe others, but this is what I can tell from the snippet you provided. Of course, will loose what is in the translog files.

如果索引不再有索引文件(data/{clustername}/nodes/0/indices/[index_name]下仅存在_state文件夹)这意味着该索引中不再有数据，此时您可以删除该索引.如果您仍然需要它，您需要重新索引该数据.如果您决定删除索引，则需要关闭节点并删除 data/{clustername}/nodes/0/indices 下的索引文件夹，就像您提到的(空的，只包含_state 文件夹).

If the indices don't have the index files anymore (only _state folder exists under data/{clustername}/nodes/0/indices/[index_name]) this means there is no data in that index anymore and at this point you can delete the index. You need to reindex that data, if you still need it. If you decide to delete the indices, you need to shutdown the node and delete the index folders under data/{clustername}/nodes/0/indices that are like the one you mentioned (empty, containing just the _state folder).

这篇关于SearchPhaseExecutionException[无法执行阶段[查询]，所有分片失败]的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！