translog_corrupted_exception: translog_corrupted_exception

What does it mean?

A shard's transaction log (translog) could not be read because it is corrupted. During recovery, Elasticsearch detected that the translog failed its integrity check, and the shard could not start.

Why does it happen?

Translog files are usually corrupted by a sudden power loss, a full disk, a file system error, hardware/disk failure, or external operations on the data directory (copying, manual intervention). Partially completed writes during a forced shutdown (kill -9) can also cause it.

How to fix it

First try to recover the data from a replica or a snapshot; if a healthy copy exists, rebuilding the corrupted shard from it is the safest path. If no other copy exists and you accept data loss, stop the node and clean the corrupted translog/data with bin/elasticsearch-shard remove-corrupted-data --index <index> --shard-id <n> (this permanently loses data not yet committed; the old elasticsearch-translog tool was removed in 7.0). The tool prints the POST _cluster/reroute command (allocate_stale_primary, accept_data_loss: true) needed to allocate the shard after the node restarts. Back up the data directory before the operation. Check disk health and free space.