cluster_health_red: cluster health status: RED / unassigned shards

What does it mean?

Cluster health RED means at least one primary shard is unassigned and unavailable. This is a critical state in which some data cannot be read/written, with a risk of partial data loss. (YELLOW means only replicas are unassigned; primaries are intact.)

Why does it happen?

A node crashed/left and the primary shards on it were left without a copy, allocation is blocked by the disk watermark, a corrupted shard, an error during snapshot restore, or allocation settings preventing shard assignment.

How to fix it

See why shards are unassigned: GET _cluster/allocation/explain or GET _cat/shards?v&h=index,shard,prirep,state,unassigned.reason. Bring crashed nodes back; if it is a disk problem, free up space (watermark). If allocation was blocked temporarily, trigger reallocation: POST _cluster/reroute?retry_failed=true. If a primary is completely lost, restore from a snapshot. In the RED state, focus on recovering primaries first.