How To Solve Issues Related to Log – Starting to track leader shard

Get an Elasticsearch Check-Up

Check if your ES issues are caused from misconfigured settings
(Free 2 min process)

Check-Up

Last update: Jan-20

Elasticsearch Error Guide In Page Navigation (click to jump) :

Troubleshooting Background – start here to get the full picture       
Related Issues – selected resources on related issues  
Log Context – usefull for experts
About Opster – offering a diffrent approach to troubleshoot Elasticsearch

Check Your Elasticsearch Settings for Painfull Mistakes 


Troubleshooting background

To troubleshoot Elasticsearch log “Starting to track leader shard” it’s important to know common problems related to Elasticsearch concepts: plugin, shard. See below-detailed explanations complete with common problems, examples and useful tips.

Plugin in Elasticsearch

What it is

Plugins are used to extend the functionality of Elasticsearch. In addition to the core plugins available to you, it is possible to write custom plugins as well. Plugins are generated in a zip format with the mandatory file structure.

Examples:
  • Core Plugins: Xpack for Security and monitoring, Discovery plugins for EC2
  • Adding S3 plugin for storing snapshots on S3
sudo bin/elasticsearch-plugin install repository-s3
  • Adding HDFS plugin for storing snapshots on HDFS
sudo bin/elasticsearch-plugin install repository-hdfs
  • Removing a plugin
sudo bin/elasticsearch-plugin remove repository-hdfs
Notes:
  • Plugins are installed using the Elasticsearch-plugin script, which enables actions such as  listing, removing and installing plugins.
  • Core plugins can be installed simply by providing the name of the plugin to the Elasticsearch-plugin command.
  • You can also download the plugin manually and then install it using the elasticsearch-plugin install command, providing the file name/path of the plugin’s source file.
  • When a plugin is removed, you will need to restart the elasticsearch node(s) in order to complete the removal process.
Common Problems:
  • You need to install the required plugins in your Elasticsearch deployment before moving it to production machines. (as it’s likely your production machines are behind a proxy and it’s very hard to get plugins installed behind a proxy).
  • The same is true when you are going to deploy elasticsearch using Docker images, you will most likely be rebuilding the standard image and including your required plugins in the custom docker build. Make sure the docker build is run on a build machine that is not behind a proxy, otherwise the plugin installation will fail during docker build.

Click here to get to our list of the Most frequent issues caused by Elasticsearch Plugins

Shards in Elasticsearch

What it is

Data in an Elasticsearch index can grow to massive proportions. In order to keep it manageable, it is split into a number of shards. Each Elasticsearch shard is an Apache Lucene index, with each individual Lucene index containing a subset of the documents in the Elasticsearch index. Splitting indices in this way keeps resource usage under control. An Apache Lucene index has a limit of 2,147,483,519 documents.

Examples

It is when an index is created that the number of shards is set, and this cannot be changed later without reindexing the data. When creating an index, you can set the number of shards and replicas as properties of the index

PUT /sensor
2
{
3
    "settings" : {
4
        "index" : {
5
            "number_of_shards" : 6,
6
            "number_of_replicas" : 2
7
        }
8
    }
9
}

The ideal number of shards should be determined based on the amount of data in an index. Generally, an optimal shard should hold 30-50GB of data. For example, if you expect to accumulate around 300GB of application logs in a day, having around 10 shards in that index would be reasonable.

During their lifetime, shards can go through a number of states, including:

  • Initializing: An initial state before the shard can be used.
  • Started: A state in which the shard is active and can receive requests.
  • Relocating: A state that occurs when shards are in the process of being moved to a different node. This may be necessary under certain conditions, for example, when the node they are on is running out of disk space.
  • Unassigned: The state of a shard that has failed to be assigned. A reason is provided when this happens, for example, if the node hosting the shard is no longer in the cluster (NODE_LEFT) or due to restoring into a closed index (EXISTING_INDEX_RESTORED).

In order to view all shards, their states, and other metadata, use the following request:

GET _cat/shards

To view shards for a specific index, append the name of the index to the URL, for example

sensor:
GET _cat/shards/sensor

This command produces output, such as in the following example. By default, the columns shown include the name of the index, the name (i.e. number) of the shard, whether it is a primary shard or a replica, its state, the number of documents, the size on disk, the IP address, and the node ID.

sensor 5 p STARTED    0  283b 127.0.0.1 ziap
sensor 5 r UNASSIGNED                   
sensor 2 p STARTED    1 3.7kb 127.0.0.1 ziap
sensor 2 r UNASSIGNED                   
sensor 3 p STARTED    3 7.2kb 127.0.0.1 ziap
sensor 3 r UNASSIGNED                   
sensor 1 p STARTED    1 3.7kb 127.0.0.1 ziap
sensor 1 r UNASSIGNED                   
sensor 4 p STARTED    2 3.8kb 127.0.0.1 ziap
sensor 4 r UNASSIGNED                   
sensor 0 p STARTED    0  283b 127.0.0.1 ziap
sensor 0 r UNASSIGNED
Notes and good things to know
  • Having shards that are too large is simply inefficient. Moving huge indices across machines is time- and labor-intensive process. First, the Lucene merges would take longer to complete and would require greater resources. Moreover, moving the shards across the nodes for rebalancing would also take longer and recovery time would be extended. Thus by splitting the data and spreading it across a number of machines, it can be kept in manageable chunks and minimize risks.
  • Having the right number of shards is important for performance. It is thus wise to plan in advance. When queries are run across different shards in parallel, they execute faster than an index composed of a single shard, but only if each shard is located on a different node and there are sufficient nodes in the cluster. At the same time, however, shards consume memory and disk space, both in terms of indexed data and cluster metadata. Having too many shards can slow down queries, indexing requests, and management operations, and so maintaining the right balance is critical.


To help troubleshoot related issues we have gathered selected Q&A from the community and issues from Github , please review the following for further information :

1. Github Issue Number 34016  

2. Github Issue Number 41737      

Github Issue Number 34648


Log Context

Log ”Starting to track leader shard” classname is ShardFollowTasksExecutor.java
We have extracted the following from Elasticsearch source code to get an in-depth context :

<pre class="wp-block-syntaxhighlighter-code"> 
    
Override
    protected void nodeOperation(final AllocatedPersistentTask task; final ShardFollowTask params; final PersistentTaskState state) {
        Client followerClient = wrapClient(client; params.getHeaders());
        ShardFollowNodeTask shardFollowNodeTask = (ShardFollowNodeTask) task;
        logger.info("{} Starting to track leader shard {}"; params.getFollowShardId(); params.getLeaderShardId());

        FollowerStatsInfoHandler handler = (followerHistoryUUID; followerGCP; maxSeqNo) -> {
            shardFollowNodeTask.start(followerHistoryUUID; followerGCP; maxSeqNo; followerGCP; maxSeqNo);
        };
        Consumer<Exception> errorHandler = e -> {



</pre>

About Opster

Incorporating deep knowledge and broad history of Elasticsearch issues. Opster’s solution identifies and predicts root causes of Elasticsearch problems, provides recommendations and can automatically perform various actions to manage, troubleshoot and prevent issues

Learn more: Glossary | Blog| Troubleshooting guides | Error Repository

Need help with any Elasticsearch issue ? Contact Opster

Did this page help you?