{
  "id": "elasticsearch/translog-corruption-on-recovery",
  "signature": "TranslogCorruptedException: translog corruption detected at position 12345 while recovering shard [my_index][0]",
  "signature_zh": "事务日志损坏异常：在恢复分片 [my_index][0] 时，在位置 12345 检测到事务日志损坏",
  "regex": "TranslogCorruptedException: translog corruption detected at position \\d+ while recovering shard \\[.*\\]",
  "domain": "elasticsearch",
  "category": "data_error",
  "subcategory": null,
  "root_cause": "The translog file for a shard is corrupted due to a disk error, abrupt shutdown, or filesystem inconsistency, preventing shard recovery.",
  "root_cause_type": "generic",
  "root_cause_zh": "由于磁盘错误、突然关闭或文件系统不一致，分片的事务日志文件损坏，导致分片恢复失败。",
  "versions": [
    {
      "version": "7.10.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "7.17.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "8.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Filesystem repair may not fix translog corruption at the application level; Elasticsearch may still see invalid data.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "The corruption persists in the translog file; restarting will trigger the same error during recovery.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Truncate the corrupted translog by removing the translog directory for the affected shard (e.g., `rm -rf /var/lib/elasticsearch/nodes/0/indices/<index-uuid>/0/translog`) and then force a recovery from the primary or replica using `POST _cluster/reroute?retry_failed=true`.",
      "success_rate": 0.85,
      "how": "Truncate the corrupted translog by removing the translog directory for the affected shard (e.g., `rm -rf /var/lib/elasticsearch/nodes/0/indices/<index-uuid>/0/translog`) and then force a recovery from the primary or replica using `POST _cluster/reroute?retry_failed=true`.",
      "condition": "",
      "sources": []
    },
    {
      "action": "If the shard is a replica, delete it and reallocate: `POST _cluster/reroute { \"commands\": [ { \"cancel\": { \"index\": \"my_index\", \"shard\": 0, \"node\": \"node-1\" } } ] }` then let Elasticsearch recreate it from the primary.",
      "success_rate": 0.8,
      "how": "If the shard is a replica, delete it and reallocate: `POST _cluster/reroute { \"commands\": [ { \"cancel\": { \"index\": \"my_index\", \"shard\": 0, \"node\": \"node-1\" } } ] }` then let Elasticsearch recreate it from the primary.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Truncate the corrupted translog by removing the translog directory for the affected shard (e.g., `rm -rf /var/lib/elasticsearch/nodes/0/indices/<index-uuid>/0/translog`) and then force a recovery from the primary or replica using `POST _cluster/reroute?retry_failed=true`.",
    "If the shard is a replica, delete it and reallocate: `POST _cluster/reroute { \"commands\": [ { \"cancel\": { \"index\": \"my_index\", \"shard\": 0, \"node\": \"node-1\" } } ] }` then let Elasticsearch recreate it from the primary."
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://www.elastic.co/guide/en/elasticsearch/reference/7.17/translog.html",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.87,
  "fix_success_rate": 0.82,
  "resolvable": "true",
  "first_seen": "2023-09-05",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}