elastic unassigned shards keeps reappearing

[udi-mosh]

Version

2.4.110

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

24

RAM

128

Storage for /

500GB

Storage for /nsm

6TB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello,
this issue started several versions before.
currently i am using v2.4.110.
every month or so i get unassigned shards and it started when i have configured my own agent policy to deploy on windows computers.
is this the correct behavior ?
i have another airgapped network with the same version and deployment except for the addition of agent policy and it does not occurring there.

10x

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Which indices? If you check one of them with sudo so-elasticsearch-query $INDEX_NAME/_settings?pretty what is the output?

[udi-mosh]

hi @cm-ops ,
i have attached a file containing the indices from the last 2 moths or so. pls tell me if you still need the output of the query you mentioned.
10x
so.txt

[cm-ops]

Those are all metrics indices, we don't manage the metric ones. They probably have auto expand replicas in the settings. Do you need the metrics on? You should be able to turn off metrics in the integration.

[udi-mosh]

i think those metrics are useful. it's the agents metric if i remember correctly.
what can be done to keep them and not having to go through the monthly ritual ?

[cm-ops]

The index settings have "auto_expand_replicas": "0-1", you could try the index REST API and PUT to set that to false or loop throught them and PUT the number_of_replicas to 0.

To reiterate, we don't manage the metric indices or settings, those are the default Elastic settings.

[udi-mosh]

thank you very much, i will look into it