<p>I got alert stating elasticsearch has 2 unassigned shards. I made below api calls to gather more details.</p>
<pre><code>    curl -s http://localhost:9200/_cluster/allocation/explain | python -m json.tool
</code></pre>
<p>Output below</p>
<pre><code>    &quot;allocate_explanation&quot;: &quot;cannot allocate because allocation is not permitted to any of the nodes&quot;,
    &quot;can_allocate&quot;: &quot;no&quot;,
    &quot;current_state&quot;: &quot;unassigned&quot;,
    &quot;index&quot;: &quot;docs_0_1603929645264&quot;,
    &quot;node_allocation_decisions&quot;: [
        {
            &quot;deciders&quot;: [
                {
                    &quot;decider&quot;: &quot;max_retry&quot;,
                    &quot;decision&quot;: &quot;NO&quot;,
                    &quot;explanation&quot;: &quot;shard has exceeded the maximum number of retries [5] on failed allocation attempts - manually call [/_cluster/reroute?retry_failed=true] to retry, [unassigned_info[[reason=ALLOCATION_FAILED], at[2020-10-30T06:10:16.305Z], failed_attempts[5], delayed=false, details[failed shard on node [o_9jyrmOSca9T12J4bY0Nw]: failed recovery, failure RecoveryFailedException[[docs_0_1603929645264][0]: Recovery failed from {elasticsearch-data-1}{fIaSuZsNTwODgZnt90f7kQ}{Qxl9iPacQVS-tN_t4YJqrw}{IP1}{IP:9300} into {elasticsearch-data-0}{o_9jyrmOSca9T12J4bY0Nw}{1w5mgwy0RYqBQ9c-qA_6Hw}{IP}{IP:9300}]; nested: RemoteTransportException[[elasticsearch-data-1][IP:9300][internal:index/shard/recovery/start_recovery]]; nested: RecoveryEngineException[Phase[1] phase1 failed]; nested: RecoverFilesRecoveryException[Failed to transfer [129] files with total size of [4.4gb]]; nested: RemoteTransportException[[elasticsearch-data-0][IP2:9300][internal:index/shard/recovery/file_chunk]]; nested: 
CircuitBreakingException[[parent] Data too large, data for [&lt;transport_request&gt;] would be [1972835086/1.8gb], which is larger than the limit of [1972122419/1.8gb], real usage: [1972833976/1.8gb], new bytes reserved: [1110/1kb]]; ], allocation_status[no_attempt]]]&quot;
                }
            ],
            &quot;node_decision&quot;: &quot;no&quot;,
            &quot;node_id&quot;: &quot;1XEXS92jTK-asdfasdfasdf&quot;,
            &quot;node_name&quot;: &quot;elasticsearch-data-2&quot;,
            &quot;transport_address&quot;: &quot;IP1:9300&quot;
        },
        {
            &quot;deciders&quot;: [
                {
                    &quot;decider&quot;: &quot;max_retry&quot;,
                    &quot;decision&quot;: &quot;NO&quot;,
                    &quot;explanation&quot;: &quot;shard has exceeded the maximum number of retries [5] on failed allocation attempts - manually call [/_cluster/reroute?retry_failed=true] to retry, [unassigned_info[[reason=ALLOCATION_FAILED], at[2020-10-30T06:10:16.305Z], failed_attempts[5], delayed=false, details[failed shard on node [o_9jyrmOSca9T12J4bY0Nw]: failed recovery, failure RecoveryFailedException[[docs_0_1603929645264][0]: Recovery failed from {elasticsearch-data-1}{fIaSuZsNTwODgZnt90f7kQ}{Qxl9iPacQVS-tN_t4YJqrw}{IP1}{IP1:9300} into {elasticsearch-data-0}{o_9jyrmOSca9T12J4bY0Nw}{1w5mgwy0RYqBQ9c-qA_6Hw}{IP2}{IP2:9300}]; nested: RemoteTransportException[[elasticsearch-data-1][IP1:9300][internal:index/shard/recovery/start_recovery]]; nested: RecoveryEngineException[Phase[1] phase1 failed]; nested: RecoverFilesRecoveryException[Failed to transfer [129] files with total size of [4.4gb]]; nested: RemoteTransportException[[elasticsearch-data-0][IP2:9300][internal:index/shard/recovery/file_chunk]]; nested: 
CircuitBreakingException[[parent] Data too large, data for [&lt;transport_request&gt;] would be [1972835086/1.8gb], which is larger than the limit of [1972122419/1.8gb], real usage: [1972833976/1.8gb], new bytes reserved: [1110/1kb]]; ], allocation_status[no_attempt]]]&quot;
                },
                {
                    &quot;decider&quot;: &quot;same_shard&quot;,
                    &quot;decision&quot;: &quot;NO&quot;,
                    &quot;explanation&quot;: &quot;the shard cannot be allocated to the same node on which a copy of the shard already exists [[docs_0_1603929645264][0], node[fIaSuZsNTwODgZnt90f7kQ], [P], s[STARTED], a[id=stHnyqjLQ7OwFbaqs5vWqA]]&quot;
                }
            ],
            &quot;node_decision&quot;: &quot;no&quot;,
            &quot;node_id&quot;: &quot;fIaSuZsNTwODgZnt90f7kQ&quot;,
            &quot;node_name&quot;: &quot;elasticsearch-data-1&quot;,
            &quot;transport_address&quot;: &quot;IP1:9300&quot;
        },
        {
            &quot;deciders&quot;: [
                {
                    &quot;decider&quot;: &quot;max_retry&quot;,
                    &quot;decision&quot;: &quot;NO&quot;,
                    &quot;explanation&quot;: &quot;shard has exceeded the maximum number of retries [5] on failed allocation attempts - manually call [/_cluster/reroute?retry_failed=true] to retry, [unassigned_info[[reason=ALLOCATION_FAILED], at[2020-10-30T06:10:16.305Z], failed_attempts[5], delayed=false, details[failed shard on node [o_9jyrmOSca9T12J4bY0Nw]: failed recovery, failure RecoveryFailedException[[docs_0_1603929645264][0]: Recovery failed from {elasticsearch-data-1}{fIaSuZsNTwODgZnt90f7kQ}{Qxl9iPacQVS-tN_t4YJqrw}{IP1}{IP1:9300} into {elasticsearch-data-0}{o_9jyrmOSca9T12J4bY0Nw}{1w5mgwy0RYqBQ9c-qA_6Hw}{Ip2}{IP2:9300}]; nested: RemoteTransportException[[elasticsearch-data-1][IP1:9300][internal:index/shard/recovery/start_recovery]]; nested: RecoveryEngineException[Phase[1] phase1 failed]; nested: RecoverFilesRecoveryException[Failed to transfer [129] files with total size of [4.4gb]]; nested: RemoteTransportException[[elasticsearch-data-0][IP2:9300][internal:index/shard/recovery/file_chunk]]; nested: 
CircuitBreakingException[[parent] Data too large, data for [&lt;transport_request&gt;] would be [1972835086/1.8gb], which is larger than the limit of [1972122419/1.8gb], real usage: [1972833976/1.8gb], new bytes reserved: [1110/1kb]]; ], allocation_status[no_attempt]]]&quot;
                }
            ],
            &quot;node_decision&quot;: &quot;no&quot;,
            &quot;node_id&quot;: &quot;o_9jyrmOSca9T12J4bY0Nw&quot;,
            &quot;node_name&quot;: &quot;elasticsearch-data-0&quot;,
            &quot;transport_address&quot;: &quot;IP2:9300&quot;
        }
    ],
    &quot;primary&quot;: false,
    &quot;shard&quot;: 0,
    &quot;unassigned_info&quot;: {
        &quot;at&quot;: &quot;2020-10-30T06:10:16.305Z&quot;,
        &quot;details&quot;: &quot;failed shard on node [o_9jyrmOSca9T12J4bY0Nw]: failed recovery, failure RecoveryFailedException[[docs_0_1603929645264][0]: Recovery failed from {elasticsearch-data-1}{fIaSuZsNTwODgZnt90f7kQ}{Qxl9iPacQVS-tN_t4YJqrw}{IP1}{IP1:9300} into {elasticsearch-data-0}{o_9jyrmOSca9T12J4bY0Nw}{1w5mgwy0RYqBQ9c-qA_6Hw}{IP2}{IP2:9300}]; nested: RemoteTransportException[[elasticsearch-data-1][IP1:9300][internal:index/shard/recovery/start_recovery]]; nested: RecoveryEngineException[Phase[1] phase1 failed]; nested: RecoverFilesRecoveryException[Failed to transfer [129] files with total size of [4.4gb]]; nested: RemoteTransportException[[elasticsearch-data-0][IP2:9300][internal:index/shard/recovery/file_chunk]]; nested: 
CircuitBreakingException[[parent] Data too large, data for [&lt;transport_request&gt;] would be [1972835086/1.8gb], which is larger than the limit of [1972122419/1.8gb], real usage: [1972833976/1.8gb], new bytes reserved: [1110/1kb]]; &quot;,
        &quot;failed_allocation_attempts&quot;: 5,
        &quot;last_allocation_status&quot;: &quot;no_attempt&quot;,
        &quot;reason&quot;: &quot;ALLOCATION_FAILED&quot;
    }
}
</code></pre>
<p>I queried for the breaker config</p>
<pre><code>    curl -X GET &quot;localhost:9200/_nodes/stats/breaker?pretty
</code></pre>
<p>And can see that the parent limit_size_in_byes of 3 nodes (elasticsearch-data-0, elasticsearch-data-1 and elasticsearch-data-2) is as below.</p>
<pre><code>&quot;parent&quot; : {
          &quot;limit_size_in_bytes&quot; : 1972122419,
          &quot;limit_size&quot; : &quot;1.8gb&quot;,
          &quot;estimated_size_in_bytes&quot; : 1648057776,
          &quot;estimated_size&quot; : &quot;1.5gb&quot;,
          &quot;overhead&quot; : 1.0,
          &quot;tripped&quot; : 139
        }
</code></pre>
<p>I referred to this answer <a href="https://stackoverflow.com/a/61954408">https://stackoverflow.com/a/61954408</a> and planning to increase either the memory percentage of the circuit breaker or overall JVM heap.</p>
<p>This is a k8s environment and the elasticsearch-data is deployed as a statefulset with 3 replicas. When I did a describe of the statefulset, I can see the below ENV variable defined</p>
<pre><code>Containers:
   elasticsearch:
    Image:      custom/elasticsearch-oss-s3:7.0.0
    Port:       9300/TCP
    Host Port:  0/TCP
    Limits:
      cpu:     10500m
      memory:  21Gi
    Requests:
      cpu:      10
      memory:   20Gi
    Environment:
      DISCOVERY_SERVICE:     elasticsearch-discovery
      NODE_MASTER:           false
      PROCESSORS:            11 (limits.cpu)
      ES_JAVA_OPTS:          -Djava.net.preferIPv4Stack=true -Xms2048m -Xmx2048m
</code></pre>
<p>As per this, the heap size seems to be 2048m</p>
<p>I logged into a elasticsearch-data pod and under the elastic search config directory I see below files</p>
<pre><code>elasticsearch.keystore  elasticsearch.yml  jvm.options  log4j2.properties  repository-s3
</code></pre>
<p>elasticsearch.yml doesn't have any heap config or as such. It just had the master nodes' name etc..</p>
<p>Below is the jvm.options file</p>
<pre><code>
## JVM configuration

# Xms represents the initial size of total heap space
# Xmx represents the maximum size of total heap space

-Xms1g
-Xmx1g


## GC configuration
-XX:+UseConcMarkSweepGC
-XX:CMSInitiatingOccupancyFraction=75
-XX:+UseCMSInitiatingOccupancyOnly


## DNS cache policy
-Des.networkaddress.cache.ttl=60
-Des.networkaddress.cache.negative.ttl=10


# pre-touch memory pages used by the JVM during initialization
-XX:+AlwaysPreTouch

## basic

# explicitly set the stack size
-Xss1m

# set to headless, just in case
-Djava.awt.headless=true

# ensure UTF-8 encoding by default (e.g. filenames)
-Dfile.encoding=UTF-8

# use our provided JNA always versus the system one
-Djna.nosys=true

# turn off a JDK optimization that throws away stack traces for common
# exceptions because stack traces are important for debugging
-XX:-OmitStackTraceInFastThrow


# flags to configure Netty
-Dio.netty.noUnsafe=true
-Dio.netty.noKeySetOptimization=true
-Dio.netty.recycler.maxCapacityPerThread=0

# log4j 2
-Dlog4j.shutdownHookEnabled=false
-Dlog4j2.disable.jmx=true

-Djava.io.tmpdir=${ES_TMPDIR}

## heap dumps

# generate a heap dump when an allocation from the Java heap fails
# heap dumps are created in the working directory of the JVM
-XX:+HeapDumpOnOutOfMemoryError

# specify an alternative path for heap dumps; ensure the directory exists and
# has sufficient space
-XX:HeapDumpPath=data

# specify an alternative path for JVM fatal error logs
-XX:ErrorFile=logs/hs_err_pid%p.log

## JDK 8 GC logging

8:-XX:+PrintGCDetails
8:-XX:+PrintGCDateStamps
8:-XX:+PrintTenuringDistribution
8:-XX:+PrintGCApplicationStoppedTime
8:-Xloggc:logs/gc.log
8:-XX:+UseGCLogFileRotation
8:-XX:NumberOfGCLogFiles=32
8:-XX:GCLogFileSize=64m

# JDK 9+ GC logging
9-:-Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m
# due to internationalization enhancements in JDK 9 Elasticsearch need to set the provider to COMPAT otherwise
# time/date parsing will break in an incompatible way for some date patterns and locals
9-:-Djava.locale.providers=COMPAT

</code></pre>
<p>From above, it seems the total heap size is 1g.</p>
<p>But from the env variable defined in the stateful set of this pod, it seems to be 2048m.</p>
<p>Which one is right?</p>
<p>Now, from the below link</p>
<p><a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/circuit-breaker.html#parent-circuit-breaker" rel="nofollow noreferrer">Circuit breaker settings | Elasticsearch</a></p>
<p>The parent-level breaker can be configured with the following settings:</p>
<p>indices.breaker.total.use_real_memory
(Static) Determines whether the parent breaker should take real memory usage into account (true) or only consider the amount that is reserved by child circuit breakers (false). Defaults to true.</p>
<p>indices.breaker.total.limit
(Dynamic) Starting limit for overall parent breaker. Defaults to 70% of JVM heap if indices.breaker.total.use_real_memory is false. If indices.breaker.total.use_real_memory is true, defaults to 95% of the JVM heap.</p>
<p>But the limit value in the error and in the breaker stats I queried is this - 1972122419 bytes (1.8G). This doesn't seem to be 95% of 2048M or 1g.</p>
<p>Now, how can I increase the heap or the memory limit of breaker parent so that I can get rid of this error?</p>

Gokul
<p>two things here, shard allocation exception and circuit breaker exception(nested exception as it looks).</p>
<p>Please use the below command in your cluster to re-trigger the allocation as previous all retry was failed and the same is suggested in your exception message if you carefully notice. more info on below command is on this <a href="https://github.com/elastic/elasticsearch/issues/23199#issuecomment-280272888" rel="noreferrer">related Github issue comment</a>.</p>
<blockquote>
<p>curl -XPOST ':9200/_cluster/reroute?retry_failed</p>
</blockquote>
<p>If still, it doesn't work, then you have to fix the parent circuit breaker exception, you should use the <code>http://localhost:9200/_nodes/stats</code> API to know the exact heap of your ES nodes, and accordingly increase it.</p>
