I have a cluster of 2 nodes. On first(A) node single Elasticsearch instance is installed which is data node and on second(B) node 2 Elasticsearch instances are installed of which one is master node and another is data node. So there are a total of 3 Elasticsearch instances on two node i.e. 1 Master node and 2 Data nodes. Single index has been created in the cluster which has 5 primary shards and no replica. until last week all the 5 shards were distributed on 2 data nodes and all of them were working fine. Then last weekend Elasticsearch got restarted and since then 3 shards are in unassigned state. I have restarted Elasticsearch still those 3 shards are in unassigned state. In Elasticsearch log file i got "No space left on device error". After adding sufficient space still those 3 shards are in unassigned state. Do i need to restart Elasticsearch after space addition so that the unassigned shards will be assigned?
Also the data flow in my current index is user based due to which the index size is getting increased day by day. also there are no replicas for my current index.
i am thinking of creating a new index with time based data flow and having shards and replicas..
Which of the below approach would be usefull?
can i move all my existing data from current index into the newly created index(current index is based on user based data flow whereas new index is based on time based data flow.)? will there be any conflict while moving the data from current index to new index since there is difference in the data flow approach?
Or should i keep the existing data in the current index(where it is currently present)and use my newly created index to process new requests?
Kindly help me with the appropriate approach..