{
  "id": "elasticsearch/translog-corruption-on-flush",
  "signature": "TranslogCorruptedException: translog corruption detected at position 12345",
  "signature_zh": "事务日志损坏：在位置 12345 检测到事务日志损坏",
  "regex": "TranslogCorruptedException: translog corruption detected at position \\d+",
  "domain": "elasticsearch",
  "category": "data_error",
  "subcategory": null,
  "root_cause": "The translog file is corrupted due to a sudden node crash, disk I/O error, or file system inconsistency during a flush operation.",
  "root_cause_type": "generic",
  "root_cause_zh": "事务日志文件因节点突然崩溃、磁盘 I/O 错误或刷新操作期间的文件系统不一致而损坏。",
  "versions": [
    {
      "version": "7.17.15",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "8.7.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "8.13.2",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Deleting the translog directly causes data loss and may leave the index in an inconsistent state that cannot be recovered.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "A corrupted translog cannot be replayed; Elasticsearch will fail to open the shard and the error persists.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Use the Elasticsearch 'elasticsearch-shard' CLI tool to truncate the translog: ./bin/elasticsearch-shard remove-corrupted-data --index my_index --shard 0. This removes only the corrupted part and recovers the shard.",
      "success_rate": 0.88,
      "how": "Use the Elasticsearch 'elasticsearch-shard' CLI tool to truncate the translog: ./bin/elasticsearch-shard remove-corrupted-data --index my_index --shard 0. This removes only the corrupted part and recovers the shard.",
      "condition": "",
      "sources": []
    },
    {
      "action": "If the shard is replica, allocate a new replica from the primary: POST /_cluster/reroute { \"commands\": [{ \"allocate_replica\": { \"index\": \"my_index\", \"shard\": 0, \"node\": \"my_node\" } }] } and then delete the corrupted shard.",
      "success_rate": 0.8,
      "how": "If the shard is replica, allocate a new replica from the primary: POST /_cluster/reroute { \"commands\": [{ \"allocate_replica\": { \"index\": \"my_index\", \"shard\": 0, \"node\": \"my_node\" } }] } and then delete the corrupted shard.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "使用 Elasticsearch 'elasticsearch-shard' CLI 工具截断事务日志：./bin/elasticsearch-shard remove-corrupted-data --index my_index --shard 0。仅移除损坏部分并恢复分片。",
    "如果分片是副本，从主分片分配新副本：POST /_cluster/reroute { \"commands\": [{ \"allocate_replica\": { \"index\": \"my_index\", \"shard\": 0, \"node\": \"my_node\" } }] }，然后删除损坏的分片。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://www.elastic.co/guide/en/elasticsearch/reference/current/troubleshooting.html",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.88,
  "fix_success_rate": 0.85,
  "resolvable": "true",
  "first_seen": "2024-06-20",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}