elasticsearch笔记


elasticsearch

安装

优化

  • 关闭swap
  • unlimit调整
  • 使用ssd

踩坑

  • 滚动重启

    重启前

    curl -XPUT http://192.168.67.14:9200/_cluster/settings -d '{
        "transient" : {
            "cluster.routing.allocation.enable" : "none"
        }
    }'
    

    重启后

    curl -XPUT http://192.168.67.14:9200/_cluster/settings -d '{
        "transient" : {
            "cluster.routing.allocation.enable" : "all"
        }
    }'
    
  • 修改index.number_of_shards
  • 磁盘损坏
    curl -XPOST 'http://192.168.60.32:9200/_cluster/reroute' -d '{
            "commands" : [ {
                  "allocate" : {
                      "index" : ".marvel-2018.10.10",
                      "shard" : 0,
                      "node" : "1.7.5-192.168.67.14",
                      "allow_primary" : true
                  }
                }
            ]
        }'
    
  • unassigned shards
    curl http://127.0.0.1:9200/_cat/shards?v 2>&1 | grep UNASSIGNED
    
    curl http://127.0.0.1:9200/_nodes/process?pretty
    
    curl -XPOST 'http://192.168.60.32:9200/_cluster/reroute' -d '{
            "commands" : [ {
                    "allocate" : {
                        "index" : "logstash-kkk-2018.11.07",
                        "shard" : 3,
                        "node" : "RixLlAEkTUO7d35ijUfg",
                        "allow_primary" : true
                    }
                }
            ]
        }'
    

kibana

安装

优化

踩坑

  • 保存时kibana报错 Visualization Editor: blocked by: [FORBIDDEN/12/index read-only

    参考 https://github.com/elastic/kibana/issues/13685

    curl -XPUT -H "Content-Type: application/json" http://127.0.0.1:9200/.kibana/_settings -d '{"index.blocks.read_only_allow_delete": null}'