# TranslogCorruptedException：在恢复索引 [my_index] 分片 [0] 时在位置 67890 检测到事务日志损坏

- **ID:** `elasticsearch/translog-corruption-during-recovery`
- **领域:** elasticsearch
- **类别:** system_error
- **验证级别:** ai_generated
- **修复率:** 70%

## 根因

分片的事务日志文件损坏，通常由于节点突然关闭、磁盘错误或文件系统问题导致，阻止分片恢复。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| Elasticsearch 7.16.0 | active | — | — |
| Elasticsearch 8.8.0 | active | — | — |
| Elasticsearch 8.15.0 | active | — | — |

## 解决方案

1. ```
   Use the Elasticsearch CLI tool `elasticsearch-shard` to truncate the translog. Run: `bin/elasticsearch-shard remove-corrupted-data --index my_index --shard 0`. This removes corrupted translog entries and allows the shard to recover with potential data loss of recent operations.
   ```
2. ```
   Restore the shard from a snapshot. If a snapshot exists, delete the corrupt index and restore: `POST /_snapshot/my_repo/my_snapshot/_restore {"indices": "my_index", "rename_pattern": "my_index", "rename_replacement": "my_index"}`. Ensure the snapshot is recent enough.
   ```

## 无效尝试

- **** — This may cause data loss and prevent the shard from recovering at all because Elasticsearch expects a valid translog; the shard may become permanently unassigned. (85% 失败率)
- **** — If the corrupt shard is the primary, the cluster cannot allocate it, and reindexing from a snapshot may not include recent data not in the snapshot. (60% 失败率)