elasticsearch
system_error
ai_generated
partial
TranslogCorruptedException：在恢复索引 [my_index] 分片 [0] 时在位置 67890 检测到事务日志损坏
TranslogCorruptedException: translog corruption detected at position 67890 while recovering index [my_index] shard [0]
ID: elasticsearch/translog-corruption-during-recovery
70%修复率
86%置信度
1证据数
2023-09-05首次发现
版本兼容性
| 版本 | 状态 | 引入 | 弃用 | 备注 |
|---|---|---|---|---|
| Elasticsearch 7.16.0 | active | — | — | — |
| Elasticsearch 8.8.0 | active | — | — | — |
| Elasticsearch 8.15.0 | active | — | — | — |
根因分析
分片的事务日志文件损坏，通常由于节点突然关闭、磁盘错误或文件系统问题导致，阻止分片恢复。
English
The transaction log file for a shard is corrupted, often due to abrupt node shutdown, disk errors, or filesystem issues, preventing shard recovery.
官方文档
https://www.elastic.co/guide/en/elasticsearch/reference/current/translog.html#translog-corruption解决方案
-
Use the Elasticsearch CLI tool `elasticsearch-shard` to truncate the translog. Run: `bin/elasticsearch-shard remove-corrupted-data --index my_index --shard 0`. This removes corrupted translog entries and allows the shard to recover with potential data loss of recent operations.
-
Restore the shard from a snapshot. If a snapshot exists, delete the corrupt index and restore: `POST /_snapshot/my_repo/my_snapshot/_restore {"indices": "my_index", "rename_pattern": "my_index", "rename_replacement": "my_index"}`. Ensure the snapshot is recent enough.
无效尝试
常见但无效的做法:
-
85% 失败
This may cause data loss and prevent the shard from recovering at all because Elasticsearch expects a valid translog; the shard may become permanently unassigned.
-
60% 失败
If the corrupt shard is the primary, the cluster cannot allocate it, and reindexing from a snapshot may not include recent data not in the snapshot.