技術標籤：elasticsearchesdockerlinuxzookeeper

1.單節點elasticsearch的配置
# cat /usr/local/elk/elasticsearch/config/elasticsearch.yml

cluster.name: alisz_yt_pixso_cluster
node.name: alisz_yt_pixso_elk01
path.data: /data/es/data
path.logs: /data/es/logs
bootstrap.memory_lock: true
network.host: 172.18.10.154
http.port: 9200
cluster.initial_master_nodes: ["172.18.10.154"]
transport.tcp.port: 9300
transport.tcp.compress: true
path.repo: ["/data/esback/"]
cluster.max_shards_per_node: 10000
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /usr/local/elk/elasticsearch/config/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/local/elk/elasticsearch/config/elastic-certificates.p12
 

2.程式的管理
# cat /etc/systemd/system/elasticsearch.service

[Unit]
Description=elasticsearch
[Service]
User=elasticsearch
LimitNOFILE=500000
LimitNPROC=500000
LimitMEMLOCK=infinity
ExecStart=/usr/local/elk/elasticsearch/bin/elasticsearch
[Install]
WantedBy=multi-user.target

3.因為系統只有單節點，很多分片是沒法進行分配的，會導致叢集狀態為yellow，此時是沒法查詢資料的

{
  "cluster_name" : "alisz_yt_pixso_cluster",
  "status" : "yellow",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "active_primary_shards" : 21,
  "active_shards" : 21,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 20,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 51.21951219512195
}
 

# 解決辦法：設定現有索引 副本為0

curl -u elastic:pass -X PUT "http://172.18.10.154:9200/_settings" -H 'Content-Type: application/json' -d '{"index":{"number_of_replicas":0}}'

[root~]# curl -u elastic:pass http://172.18.10.154:9200/_cluster/health?pretty

{
  "cluster_name" : "alisz_yt_pixso_cluster",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "active_primary_shards" : 21,
  "active_shards" : 21,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}

設定elasticsearch預設模板(之後建立索引副本為0)

curl -u elastic:pass -X PUT 172.18.10.154:9200/_template/log  -H 'Content-Type: application/json' -d '{
  "template": "*",
  "settings": {
    "number_of_shards": 5,
    "number_of_replicas": "0"
  }
}'

"template": "*" 代表所有 索引
"template": "apple*" 代表生成apple*的索引都會按照這個模板來了

1.單節點elasticsearch的配置
# cat /usr/local/elk/elasticsearch/config/elasticsearch.yml
cluster.name: alisz_yt_pixso_cluster
node.name: alisz_yt_pixso_elk01
path.data: /data/es/data
path.logs: /data/es/logs
bootstrap.memory_lock: true
network.host: 172.18.10.154
http.port: 9200
cluster.initial_master_nodes: ["172.18.10.154"]
transport.tcp.port: 9300
transport.tcp.compress: true
path.repo: ["/data/esback/"]
cluster.max_shards_per_node: 10000
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /usr/local/elk/elasticsearch/config/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/local/elk/elasticsearch/config/elastic-certificates.p12
2.程式的管理
# cat /etc/systemd/system/elasticsearch.service
[Unit]
Description=elasticsearch
[Service]
User=elasticsearch
LimitNOFILE=500000
LimitNPROC=500000
LimitMEMLOCK=infinity
ExecStart=/usr/local/elk/elasticsearch/bin/elasticsearch
[Install]
WantedBy=multi-user.target
3.因為系統只有單節點，很多分片是沒法進行分配的，會導致叢集狀態為yellow，此時是沒法查詢資料的
問題：單節點elasticsearch出現大量未分片的
[[email protected]:~]# curl -u elastic:pass http://172.18.10.154:9200/_cluster/health?pretty
{
"cluster_name" : "alisz_yt_pixso_cluster",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 21,
"active_shards" : 21,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 20,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 51.21951219512195
}
# 解決辦法：設定現有索引 副本為0
curl -u elastic:pass -X PUT "http://172.18.10.154:9200/_settings" -H 'Content-Type: application/json' -d '{"index":{"number_of_replicas":0}}'
[[email protected]:~]# curl -u elastic:pass http://172.18.10.154:9200/_cluster/health?pretty
{
"cluster_name" : "alisz_yt_pixso_cluster",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 21,
"active_shards" : 21,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
設定elasticsearch預設模板(之後建立索引副本為0)
curl -u elastic:pass -X PUT 172.18.10.154:9200/_template/log -H 'Content-Type: application/json' -d '{
"template": "*",
"settings": {
"number_of_shards": 5,
"number_of_replicas": "0"
}
}'
"template": "*" 代表所有 索引
"template": "apple*" 代表生成apple*的索引都會按照這個模板來了