Shards, Replicas and the Split-Brain Problem
The books index grows past what one machine can comfortably hold, and the shop cannot afford for search to vanish when one server dies. Elasticsearch solves both problems by cutting every index into shards and copying them.
The rule
Primaries split the data; replicas copy it; never on the same node.
- A primary shard holds one slice of an index's documents. Each document lives in exactly one primary, chosen by hashing its ID. Spreading primaries across nodes spreads storage and work.
- A replica shard is a full copy of a primary. It protects against a node dying and can also answer searches, adding read capacity. Elasticsearch never places a replica on the same node as its own primary — a copy on the same machine would die with it.
In version 8 a new index gets 1 primary and 1 replica by default. You can set both:
PUT /books
{
"settings": { "number_of_shards": 3, "number_of_replicas": 1 }
}That gives 3 primaries + 3 replicas = 6 shards. The replica count can change at any time; the primary count is fixed at creation (changing it means split, shrink or reindex into a new index).
Cluster health reports the result: green — every shard placed; yellow — all primaries placed but some replicas are not; red — at least one primary is missing. A single-node cluster with default settings is yellow: there is nowhere legal to put the replica.
Split brain is the cluster-level danger. If a network fault cuts a cluster in two and each half elects its own master, both accept writes and the data diverges. Elasticsearch prevents it by requiring a majority of master-eligible nodes to elect a master. With three master-eligible nodes, the side with two can elect one; the side with one cannot, so it stops accepting changes. That is why production clusters use at least three master-eligible nodes.
The shortcut
Count shards as primaries × (1 + replicas), and predict health by asking "can each copy find a node without its twin?"
Count
2 × (1 + 1) = 4 shards: P0, P1, R0, R1.
Drills
Answer fast — trust the rule.
An index has 4 primary shards and 2 replicas. How many shards in total?
A single-node cluster holds books with default settings. What is its health?
Which of these can you change on an existing index with a simple settings update?
A network split leaves one master-eligible node on one side and two on the other. What happens?
Remember
- Primaries split the data; replicas copy it; never on the same node.
- Total shards = primaries × (1 + replicas); replicas change freely, primaries do not.
- A majority of master-eligible nodes must agree — use at least three to avoid split brain.