SearchPhaseExecutionException[Failed to execute phase [query], all shards failed]

Question

Recently our server was rebooted without correctly shutting down the Elastic Search / Kibana. After that reboot, both applications were running but no indices were getting c

Answer 1

1. Try to delete your index and create it again. Helps sometimes.

2. Or maybe you are trying to query for an int and string field inside the same query.

Answer 2

You have many corrupt translog files, which you need to delete. You can find it in data/{clustername}/nodes/0/indices/logstash-2015.04.21/4/translog and another one in data/{clustername}/nodes/0/indices/logstash-2015.03.16/1/translog. And maybe others, but this is what I can tell from the snippet you provided. Of course, will loose what is in the translog files.

If the indices don't have the index files anymore (only _state folder exists under data/{clustername}/nodes/0/indices/[index_name]) this means there is no data in that index anymore and at this point you can delete the index. You need to reindex that data, if you still need it. If you decide to delete the indices, you need to shutdown the node and delete the index folders under data/{clustername}/nodes/0/indices that are like the one you mentioned (empty, containing just the _state folder).