报错信息

集群状态也为red。

{
  "cluster_name" : "es",
  "status" : "red",
  "timed_out" : false,
  "number_of_nodes" : 7,
  "number_of_data_nodes" : 4,
  "active_primary_shards" : 0,
  "active_shards" : 0,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 1,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 0.0
}

查看索引报错：[.geoip_databases] use and access is reserved for system operations

{
    "error": {
        "root_cause": [
            {
                "type": "illegal_argument_exception",
                "reason": "Indices [.geoip_databases] use and access is reserved for system operations"
            }
        ],
        "type": "illegal_argument_exception",
        "reason": "Indices [.geoip_databases] use and access is reserved for system operations"
    },
    "status": 400
}

解决

这个报错是es下载geoip数据库有问题。
查询相关文档：https://www.elastic.co/guide/en/elasticsearch/reference/7.17/geoip-processor.html
https://zhuanlan.zhihu.com/p/613151007
https://www.drupal.org/project/elasticsearch_connector/issues/3229401

将ingest.geoip.downloader.enabled修改为false即可，默认为true。

修改es-master-config的cm，添加：ingest.geoip.downloader.enabled: false，重启es-master。

k edit cm es-master-config
k rollout restart sts es-master
k get cm es-master-config -o yaml

再次查看索引.geoip_databases已经被自动删除。

集群状态恢复green。