# TranslogCorruptedException: translog corruption detected at position 12345

- **ID:** `elasticsearch/translog-corruption-on-flush`
- **Domain:** elasticsearch
- **Category:** data_error
- **Verification:** ai_generated
- **Fix Rate:** 85%

## Root Cause

The translog file is corrupted due to a sudden node crash, disk I/O error, or file system inconsistency during a flush operation.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 7.17.15 | active | — | — |
| 8.7.0 | active | — | — |
| 8.13.2 | active | — | — |

## Workarounds

1. **Use the Elasticsearch 'elasticsearch-shard' CLI tool to truncate the translog: ./bin/elasticsearch-shard remove-corrupted-data --index my_index --shard 0. This removes only the corrupted part and recovers the shard.** (88% success)
   ```
   Use the Elasticsearch 'elasticsearch-shard' CLI tool to truncate the translog: ./bin/elasticsearch-shard remove-corrupted-data --index my_index --shard 0. This removes only the corrupted part and recovers the shard.
   ```
2. **If the shard is replica, allocate a new replica from the primary: POST /_cluster/reroute { "commands": [{ "allocate_replica": { "index": "my_index", "shard": 0, "node": "my_node" } }] } and then delete the corrupted shard.** (80% success)
   ```
   If the shard is replica, allocate a new replica from the primary: POST /_cluster/reroute { "commands": [{ "allocate_replica": { "index": "my_index", "shard": 0, "node": "my_node" } }] } and then delete the corrupted shard.
   ```

## Dead Ends

- **** — Deleting the translog directly causes data loss and may leave the index in an inconsistent state that cannot be recovered. (95% fail)
- **** — A corrupted translog cannot be replayed; Elasticsearch will fail to open the shard and the error persists. (90% fail)