Big-IQ not collecting Big-IP stats

Do you only have one DCD? Are all your DCDs giving you the same error?

Yes, just the one DCD

I am also interested in the cause of this - currently have a BIG-IQ running 5.4 and BIG-IQ logger on the same code. Had this error for months and cannot resolve. Opened a support ticket and got no answer. Both report the same error. Also when I go under the monitoring tab I get this error.

Logging Service is not available. Please check your BIG-IQ Logging configuration to receive accurate data.

At least one primary shard (and all of its replicas) are missing. This means that you are missing data; searches will return partial results, and indexing into that shard will return an exception.

Has anyone found a resolution? I have the same "shard" error on 5.2 with one DCD. I found the two articles (for 5.3 and 5.4) to resolve shard issues. Maybe they can help you? Restarting the elasticsearch daemon didn't help my situation.

https://support.f5.com/kb/en-us/products/big-iq-centralized-mgmt/manuals/product/bigiq-central-mgmt-upgrading-dcd-cluster-with-minimal-downtime-from-5-2/6.html

https://support.f5.com/kb/en-us/products/big-iq-centralized-mgmt/manuals/product/bigiq-central-mgmt-monitoring-reports-5-4-0/6.html

Here is what I had to do to resolve the "shard" issue and get my DCD cluster back in good health. I had to rebuild the DCD cluster (only had 1 DCD), which means we lost data. However, I was in a pre-production so it's wasn't that big of a deal. I wasn't even able to remove the DCD from the centralized manager (CM). Kept getting a 503 error. The following curl command (removes indices) on the CM got me to where I could remove the DCD from the CM so I didn't have to rebuild the CM.

Note: You will lose data if you run this command

curl -X DELETE localhost:9200/*

Rebuild steps I took after running the curl command above on the CM:

• Remove the DCD from the CM (at this point I had 0 DCDs attached to my CM)
• Go to the DCD and reset to factory defaults (https://support.f5.com/csp/article/K15886) and go through the setup wizard (this kept the DCD master keys in tact so FPS on Big-IPs didn't need reconfigured)
• Upgrade both CM and DCD to latest version of Big-IQ (5.4 HF2)
• Attach DCD to CM and activate FPS service (FPS events started immediately processing)

BigIQ Node v5.4 HF2

https://support.f5.com/kb/en-us/products/big-iq-centralized-mgmt/manuals/product/bigiq-central-mgmt-monitoring-reports-5-4-0/6.html

Thanks for sharing Jason! I have a single BigIQ Data Collection Node that had the same issue and building + running the script located under "Resolve unassigned cluster shards" worked exactly as designed to return from a red status to yellow where I began to collect stats again. Also, thanks for sharing the last resort steps to rebuild the data node.