Elasticsearch monitoring that counts every unassigned shard.

Cluster status turning yellow is the end of the story, not the start. The collector tracks shard states, JVM heap, GC time, and disk usage per node (the sequence that ends in a red cluster), and opens issues while there is still time to act.

What RootTrace watches

Every reading is checked continuously; bad readings become grouped issues with the evidence attached. RootTrace also remembers whether it has seen the same incident before.

Shard healthActive, initializing, relocating, delayed, and unassigned shards, plus active-shard percentage.
Cluster & node countsStatus, total nodes, and data nodes. A dropped node is visible immediately.
JVM heap & GCWorst-node heap percentage and total GC collection time.
Disk usageWorst-node disk percentage, ahead of the flood-stage watermark.
Pending tasksThe cluster-state queue that grows when a master is struggling.
Index latencyIndexing latency and totals, trended.

Warn and fail thresholds, prefilled

Sensible defaults out of the box, overridable per host with environment variables. No threshold spreadsheet required on day one.

Cluster status and shard counts drive severity automatically

Setup

elasticsearch setup

# after installing the collector package, point it at your instance:
$ export ROOTTRACE_ELASTICSEARCH_URL='http://elasticsearch-1:9200'

Read-only by architecture: no write path, no remediation executor, no inbound ports. Credential-like evidence is redacted before it leaves the host.

One collector, live in minutes

Everything on this page comes from the same read-only collector: one command per host, then point it at your targets.

install on any Linux host

$ # after adding the signed RootTrace dnf or apt repository:
sudo dnf install roottrace-collector  # apt: sudo apt install roottrace-collector
sudoedit /etc/roottrace/collector.env  # set ROOTTRACE_COLLECTOR_TOKEN and API URL
sudo roottrace-collector-setup apply
sudo systemctl enable --now roottrace-collector

Questions, answered honestly

Does it work with authentication and TLS?

Yes. Give the check an https URL and basic-auth credentials via environment variables. The collector makes read-only calls to the health and stats APIs.

Is this safe to run next to production?

The collector is read-only by architecture, not by policy: there is no write path, no remediation executor, and no privileged mode to switch on. It sends short-lived outbound HTTPS requests, opens no inbound ports, and redacts credential-like evidence before anything leaves the host.

Do I need a separate agent for this?

No. One RootTrace collector per host covers every integration on this site: databases, web servers, containers, endpoints, and the Linux host itself, all from one signed package or container. You point it at targets with environment variables; there is nothing else to deploy.

Free on 5 hosts. Live in minutes.

Create a workspace, install one collector, and watch issues explain themselves.

Create free workspace Schedule a demo