skills.rest
LiboMa
LiboMaCOMMUNITY
Explore all skills by this author →
GitHub

elasticsearch

Diagnose and remediate Elasticsearch and OpenSearch cluster health, shard, and query issues.

3|1|Updated Feb 14, 2026
Search Tags:#query optimization#troubleshooting#aws#elasticsearch#opensearch#cluster health#shard allocation
One-click install
npx skills add https://github.com/LiboMa/agenticops-chat --skill elasticsearch-liboma
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: elasticsearch
Source: https://github.com/LiboMa/agenticops-chat/tree/main/skills/elasticsearch
Command: npx skills add https://github.com/LiboMa/agenticops-chat --skill elasticsearch-liboma

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Elasticsearch and OpenSearch clusters fail in opaque ways — red cluster status, unassigned shards, JVM heap pressure, and slow queries — and finding the right diagnostic commands under incident pressure is slow and error-prone. ## Core Features & Use Cases - Decision-tree troubleshooting: Step-by-step flows for red/yellow cluster health, shard allocation failures, circuit breakers, and JVM heap pressure, each mapping symptoms to concrete _cluster and _cat API calls. - Query and DSL optimization: Guidance for profiling slow queries, fixing wildcard and deep-pagination anti-patterns, and building efficient aggregations including composite pagination. - Lifecycle and operations runbooks: References covering rolling restarts, node scaling, ILM, snapshot/restore, reindex, shrink/split, and AWS OpenSearch specifics like UltraWarm and CloudWatch alarm thresholds. - Use Case: Your production cluster goes red after a node loss. Follow the decision tree to run _cluster/allocation/explain, identify NO_VALID_SHARD_COPY, and either restore from snapshot or accept data loss with allocate_stale_primary. ## Quick Start Diagnose why my Elasticsearch cluster status is red and give me the exact API calls to fix the unassigned shards.

Frequently Asked Questions about elasticsearch

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix a red Elasticsearch cluster status?▼

Run GET _cluster/health to confirm red status, then GET _cluster/allocation/explain to identify the cause such as NO_VALID_SHARD_COPY or ALLOCATION_FAILED. Depending on the cause, recover the lost node, free disk space, restore from snapshot, or use allocate_stale_primary to accept data loss.

How do I diagnose slow Elasticsearch queries?▼

Enable the search slow log with index.search.slowlog thresholds, then run the query with "profile": true to see per-clause timing. Common culprits are leading wildcards, wildcard queries on text fields, deep pagination with from/size, and script fields in the hot path.

Does this cover AWS OpenSearch Service specifically?▼

Yes. It includes AWS CLI commands like describe-domain, CloudWatch metric thresholds for ClusterStatus, JVMMemoryPressure, and thread pool rejections, plus UltraWarm and cold storage migration APIs specific to the managed service.

Why are my Elasticsearch shards unassigned?▼

Use GET _cluster/allocation/explain to get the exact reason. Common causes include disk watermark breaches, max_retries_exceeded, too many shards per node, and awareness zone constraints; retry with POST _cluster/reroute?retry_failed after fixing the underlying issue.

What causes Elasticsearch circuit breakers to trip?▼

Check GET _nodes/stats/breaker to see which breaker tripped: parent indicates overall heap pressure, fielddata indicates aggregations on text fields, and request indicates large per-request memory. Fix fielddata trips by switching text aggregations to keyword fields.

When should I not increase Elasticsearch thread pool queue sizes?▼

Never increase queue sizes to fix rejections — it only delays the problem and raises latency. Instead reduce load, optimize bulk indexing with 5-15 MB batches, increase refresh_interval during bulk loads, or add node capacity.

Related Skills

Explore More Software Engineering Skills→
aurainfosecaurainfosec

cloudwatch

Automates CloudWatch alarms, metrics, logs queries, and dashboards via APIs or CLI.

Official
Intermediate
fractaryfractary

ops-responder

Diagnose incidents and apply verified remediations to services.

Official
Intermediate
ccfosccfos
13.3k

modify-task-tpl

Generates and troubleshoots Nightingale alert self-healing scripts for the ibex task_tpl subsystem.

Official
Advanced
opensearch-projectopensearch-project
40

aws-setup

Automate AWS OpenSearch domain and serverless collection provisioning and configuration.

Official
Advanced