elasticsearch data_error ai_generated true

事务日志损坏异常：在恢复分片 [my_index][0] 时，在位置 12345 检测到事务日志损坏

TranslogCorruptedException: translog corruption detected at position 12345 while recovering shard [my_index][0]

ID: elasticsearch/translog-corruption-on-recovery

其他格式: JSON · Markdown 中文 · English
82%修复率
87%置信度
1证据数
2023-09-05首次发现

版本兼容性

版本状态引入弃用备注
7.10.0 active — — —
7.17.0 active — — —
8.0.0 active — — —

根因分析

由于磁盘错误、突然关闭或文件系统不一致，分片的事务日志文件损坏，导致分片恢复失败。

English

The translog file for a shard is corrupted due to a disk error, abrupt shutdown, or filesystem inconsistency, preventing shard recovery.

generic

官方文档

https://www.elastic.co/guide/en/elasticsearch/reference/7.17/translog.html

解决方案

  1. Truncate the corrupted translog by removing the translog directory for the affected shard (e.g., `rm -rf /var/lib/elasticsearch/nodes/0/indices/<index-uuid>/0/translog`) and then force a recovery from the primary or replica using `POST _cluster/reroute?retry_failed=true`.
  2. If the shard is a replica, delete it and reallocate: `POST _cluster/reroute { "commands": [ { "cancel": { "index": "my_index", "shard": 0, "node": "node-1" } } ] }` then let Elasticsearch recreate it from the primary.

无效尝试

常见但无效的做法:

  1. 90% 失败

    Filesystem repair may not fix translog corruption at the application level; Elasticsearch may still see invalid data.

  2. 95% 失败

    The corruption persists in the translog file; restarting will trigger the same error during recovery.