Agent skill · elastic
elasticsearch-cluster-health
Diagnose a non-green Elasticsearch cluster and surface the single most likely cause with remediation. Use when an operator reports yellow or red status, unassigned shards, allocation failures, or wants read-only triage before deeper investigation. Teaches replica-vs-primary impact, allocation decider classification, and data-loss awareness.
What it needs
About 6k tokens when loaded.
What this skill does
Diagnose Cluster Health Triage a non-green Elasticsearch cluster read-only: localize the problem, classify the allocation decider, and report the single most likely cause with remediation. Never mutate cluster state — surface findings and let the operator act. <!-- begin-partial: preamble --> Environment Configuration This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds. This skill references operations in HTTP-shorthand form (e.g., GET /, GET /cat/indices, GET /{index}/mapping, GET /{index}/settings/index.mode, POST /query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly. <!-- end-partial: preamble --> Process 1. Read the overall status. Call GET /cluster/health. The status field is the verdict: green — every primary and replica is assigned. Report healthy and stop. yellow — every primary is assigned but at least one replica is not. Data remains readable; redundancy is degraded. This is not data loss. red — at least one primary is unassigned. Data for that shard is unavailable; treat as urgent. Also read unassignedshards, initializingshards, and relocatingshards. The decision: continue only when status is yellow or red. If initializingshards > 0 and unassignedshards == 0, the cluster is recovering on its own — call GET /cat/recovery to confirm progress, wait, and re-check GET /cluster/health before escalating. Data needed: cluster-wide status and shard counters. 2. Localize the problem to one index. Call GET /cluster/health?level=indices and pick the index that drives the cluster-wide status: Any red index outranks every yellow index. Among reds or yellows, prefer the index with the most unassignedshards. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills elastic/elasticsearch-cluster-health