OpenSearch Not Working? Common Errors & Fixes

A red cluster means at least one primary shard is unassigned. Find the index with _cat/indices and _cluster/allocation/explain, fix the cause (dead node, full disk, memory), and only delete the index as a last resort.

Yellow means all primaries are assigned but at least one replica is not. A single node is always yellow; on multiple nodes check disk space and replica counts.

Use the allocation explain API to see why a shard cannot be placed. Typical causes are disk watermarks, node loss, allocation filters and shard limits.

Keep JVM memory pressure below about 80%. Reduce shard count, avoid aggregating on text fields, clear fielddata and scale nodes.

A JVM OutOfMemoryError usually means a circuit breaker was hit. Find the heavy query or mapping, then reduce load or scale; raise breaker limits only with care.

The default is 1,000 shards per node. Add data nodes, shrink or delete indices, or raise cluster.max_shards_per_node as a stopgap.

When a node passes the flood-stage disk watermark, indices become read-only. Free space first, then clear the block with read_only_allow_delete set to null.

429s mean the cluster is rejecting work: queues are full, heap is exhausted or shards are skewed. Back off, rebalance and scale.

Since 2.12 OpenSearch needs OPENSEARCH_INITIAL_ADMIN_PASSWORD with a strong value, and the host needs vm.max_map_count of at least 262144.

This message means Dashboards cannot reach or authenticate to OpenSearch, or a saved-object migration is stuck. Check hosts, credentials, ports and cluster health.

OpenSearch itself is free; to stop charges delete the Amazon OpenSearch Service domain or Serverless collection. Reserved Instances cannot be canceled or refunded.