Customer Support Perspective

SITUATION
  What is the customer experiencing? What are the symptoms?
  Example: "Cluster health is RED after adding a 4th node"

PROBLEM
  What is the root cause?
  Example: "Disk watermark exceeded on new node, preventing shard allocation"

RESOLUTION
  Step-by-step fix
  Example:
    1. Check disk watermarks: GET _cluster/settings
    2. Free disk space or adjust watermarks
    3. Re-enable allocation
    4. Verify cluster health returns to GREEN

ENVIRONMENT
  Version, OS, deployment type, relevant configuration
  Example: "Elasticsearch 8.12.0, RHEL 8, self-managed, 4 nodes"

# Check cluster health
curl -s https://localhost:9200/_cluster/health?pretty \
  --cacert ca.crt -u elastic:$PASSWORD

# Find unassigned shards
curl -s https://localhost:9200/_cat/shards?v\&h=index,shard,prirep,state,unassigned.reason \
  --cacert ca.crt -u elastic:$PASSWORD | grep UNASSIGNED

# Get allocation explanation for a specific shard
curl -s https://localhost:9200/_cluster/allocation/explain?pretty \
  --cacert ca.crt -u elastic:$PASSWORD -H 'Content-Type: application/json' -d '{
    "index": "support-tickets",
    "shard": 0,
    "primary": true
  }'

# Enable slow logs
PUT /support-tickets/_settings
{
  "index.search.slowlog.threshold.query.warn": "5s",
  "index.search.slowlog.threshold.query.info": "2s",
  "index.search.slowlog.threshold.fetch.warn": "1s"
}

# Profile a specific query
POST /support-tickets/_search
{
  "profile": true,
  "query": {
    "match": { "description": "클러스터 상태" }
  }
}

# Check hot threads (find CPU-heavy operations)
GET _nodes/hot_threads