Opensearch – Yellow / Top Queries

With an update of opensearch there suddenly is a new index called top_queries-xxxx. This will turn yellow on a single-node cluster, as it want’s two replicase. Apperantely, it’s not in the interest of opensearch, to create stuff, that works with their own software. So we have to fix it ourtselfs. Once again.

Luckely this is easy to do:

/usr/share/opensearch/bin/opensearch-plugin remove query-insights

This will delete the plugin that creates these indices. Now just restart the service, delete the current one and you’re all good:

# Restart Opensearch
systemctl restart opensearch

# Check if only the to be deleted indices are shown here
curl -XGET localhost:9200/_cat/indices | grep "top_queries-2" | awk '{print $3}'

# If yes, continue
curl -XGET localhost:9200/_cat/indices | grep "top_queries-2" | awk '{print $3}' | xargs -I {} curl -X DELETE localhost:9200/{}