Is Elasticsearch Down? How to Check Cluster Status in 2026

Elasticsearch powers search and analytics for thousands of production applications — from e-commerce search to log management and security analytics. When Elasticsearch goes down or a cluster enters a red state, search functionality fails, log ingestion stops, and application errors cascade. Understanding Elasticsearch's health model is the key to fast diagnosis and recovery.

Elasticsearch Cluster Status: Green, Yellow, Red Explained

Elasticsearch reports cluster health in three states:

How to Diagnose Elasticsearch Being Down

1. Check the Cluster Health API

# Basic health check
curl -s "http://localhost:9200/_cluster/health?pretty"

# Output includes:
# - status: green/yellow/red
# - number_of_nodes: total nodes
# - unassigned_shards: shards needing recovery
# - active_primary_shards: primary shards serving data

# For Elastic Cloud (requires authentication)
curl -s -u username:password \
  "https://YOUR_CLUSTER.es.io/_cluster/health?pretty"

2. Check Node Availability

# List all nodes (shows which are online)
curl -s "http://localhost:9200/_cat/nodes?v&h=name,ip,heap.percent,disk.used_percent,load_1m,node.role"

# Check if master node is elected
curl -s "http://localhost:9200/_cat/master?v"

3. Diagnose Unassigned Shards

# List unassigned shards with reasons
curl -s "http://localhost:9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason&s=state"

# Get detailed allocation explanation
curl -s -XGET "http://localhost:9200/_cluster/allocation/explain?pretty" \
  -H 'Content-Type: application/json' \
  -d '{"index": "your-index", "shard": 0, "primary": true}'

Common Elasticsearch Outage Causes and Fixes

Out of Memory (JVM Heap Exhaustion)

Elasticsearch is Java-based and requires adequate heap memory. Symptoms: OOM errors in logs, nodes crashing under load.

# Check heap usage
curl -s "http://localhost:9200/_nodes/stats/jvm?pretty" | \
  jq '.nodes | to_entries[] | {name: .key, heap_used_percent: .value.jvm.mem.heap_used_percent}'

# Fix: Increase heap in jvm.options (set Xms and Xmx to same value, max 50% of RAM)
# -Xms8g
# -Xmx8g

Disk Full — Indices in Read-Only Mode

When disk usage exceeds 90% (flood_stage watermark), Elasticsearch automatically makes all indices read-only to prevent data corruption.

# Check disk usage per node
curl -s "http://localhost:9200/_cat/allocation?v"

# Check for read-only indices
curl -s "http://localhost:9200/_cat/indices?v&h=index,status,health" | grep -E "open|close"

# Remove read-only lock after freeing disk space
curl -XPUT "http://localhost:9200/_all/_settings" \
  -H 'Content-Type: application/json' \
  -d '{"index.blocks.read_only_allow_delete": null}'

Split Brain / Master Election Failure

A network partition can cause multiple nodes to think they're the master (pre-Elasticsearch 7.x). Symptoms: cluster health API unreachable, conflicting master nodes.

• Ensure discovery.zen.minimum_master_nodes is set to ⌈(N/2)+1⌉ (quorum)
• Elasticsearch 7+ uses Raft-based consensus — split brain is largely eliminated
• Check cluster UUID consistency across nodes to detect split brain

Elasticsearch vs. Elastic Cloud: Different Failure Modes

Frequently Asked Questions