Corrupted index

[xdatanet]

On 20th of June I found my cluster in red status.
No resource problem, only the index of 19 was corrupted.
If I open the index the cluster goes to red status with CPU to 100%.

Now I can view the status green but NLS tells me:
"Some indices are still opening. 1 of 1 remaining"

The open button is greyed and I can only delete it.

In my dashboard, if I include the index day the graph is wrong and does not appair.

What can I do??

[xdatanet]

I discovered that the index has two void shards 1 and 3.
NLS cannot assign this two shards because is void.


% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 89960 100 89960 0 0logstash-2025.06.19 3 p UNASSIGNED INDEX_REOPENED
150k logstash-2025.06.19 3 r UNASSIGNED INDEX_REOPENED
0logstash-2025.06.19 1 p UNASSIGNED INDEX_REOPENED
--:logstash-2025.06.19 1 r UNASSIGNED INDEX_REOPENED

How can remove it from index?

Regards,
Graziano.

[jmichaelson]

This looks like a Log Server 2024R1 system. First question, is it clustered? The next question I have, is do you have snapshots configured where you could restore that index from a snapshot? that would be your best bet for getting the index back.

[kg2857]

Maybe delete the index.

[jmichaelson]

Yeah if there are no snapshots of that index available, deleting it might be the only option. I hope its not, but it might be.

[Akash12]

A corrupted index usually indicates a problem with the data structure used to quickly locate and access information within a database or file system. This corruption can occur due to hardware failure, unexpected shutdowns, software bugs, or improper updates. When an index becomes corrupted, performance may degrade, or data may become inaccessible. It's essential to back up your data regularly and run diagnostic or repair tools as soon as such errors are detected to prevent further issues.