Big-IQ not collecting Big-IP stats

BigIQ Node v5.4 HF2

https://support.f5.com/kb/en-us/products/big-iq-centralized-mgmt/manuals/product/bigiq-central-mgmt-monitoring-reports-5-4-0/6.html

Thanks for sharing Jason! I have a single BigIQ Data Collection Node that had the same issue and building + running the script located under "Resolve unassigned cluster shards" worked exactly as designed to return from a red status to yellow where I began to collect stats again. Also, thanks for sharing the last resort steps to rebuild the data node.

Do you only have one DCD? Are all your DCDs giving you the same error?

Yes, just the one DCD

I am also interested in the cause of this - currently have a BIG-IQ running 5.4 and BIG-IQ logger on the same code. Had this error for months and cannot resolve. Opened a support ticket and got no answer. Both report the same error. Also when I go under the monitoring tab I get this error.

Logging Service is not available. Please check your BIG-IQ Logging configuration to receive accurate data.

At least one primary shard (and all of its replicas) are missing. This means that you are missing data; searches will return partial results, and indexing into that shard will return an exception.

Has anyone found a resolution? I have the same "shard" error on 5.2 with one DCD. I found the two articles (for 5.3 and 5.4) to resolve shard issues. Maybe they can help you? Restarting the elasticsearch daemon didn't help my situation.

https://support.f5.com/kb/en-us/products/big-iq-centralized-mgmt/manuals/product/bigiq-central-mgmt-upgrading-dcd-cluster-with-minimal-downtime-from-5-2/6.html

https://support.f5.com/kb/en-us/products/big-iq-centralized-mgmt/manuals/product/bigiq-central-mgmt-monitoring-reports-5-4-0/6.html

Here is what I had to do to resolve the "shard" issue and get my DCD cluster back in good health. I had to rebuild the DCD cluster (only had 1 DCD), which means we lost data. However, I was in a pre-production so it's wasn't that big of a deal. I wasn't even able to remove the DCD from the centralized manager (CM). Kept getting a 503 error. The following curl command (removes indices) on the CM got me to where I could remove the DCD from the CM so I didn't have to rebuild the CM.

Note: You will lose data if you run this command

curl -X DELETE localhost:9200/*

Rebuild steps I took after running the curl command above on the CM:

• Remove the DCD from the CM (at this point I had 0 DCDs attached to my CM)
• Go to the DCD and reset to factory defaults (https://support.f5.com/csp/article/K15886) and go through the setup wizard (this kept the DCD master keys in tact so FPS on Big-IPs didn't need reconfigured)
• Upgrade both CM and DCD to latest version of Big-IQ (5.4 HF2)
• Attach DCD to CM and activate FPS service (FPS events started immediately processing)