Graylog

Index becomes read only

curl -XPUT -H 'Content-Type: application/json' http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'

Shards become UNASSIGNED after cleaning data on disk

curl -XPOST "localhost:9200/_cluster/reroute?pretty" -H 'Content-Type: application/json' -d'
{
    "commands" : [
        {
          "allocate_empty_primary" : {
                "index" : "graylog_2",
                "shard" : 0,
                "node" : "graylog",
                "accept_data_loss" : "true"
          }
        }
    ]
}
'

List Nodes

curl -XGET "http://localhost:9200/_cat/nodes?v"

To assign all shards

# recover opensearch unassigned shards

shards=$(curl -s -XGET 'http://localhost:9200/_cat/shards' | grep UNASSIGNED | awk '{
    print $1
}')

node="graylog"

for i in 0 1 2 3; do
    for shard in $shards; do
    echo "Recovering shard $shard"
    curl -XPOST "http://localhost:9200/_cluster/reroute" -d "{
        \"commands\": [ {
          \"allocate_empty_primary\" : {
                \"index\" : \"$shard\",
                \"shard\" : $i,
                \"node\" : \"$node\",
                \"accept_data_loss\" : \"true\"
          }
        }]
    }" -H 'Content-Type: application/json'
done
done