0%

Elasticsearch 常用命令

Elasticsearch 常用命令

  • _reindex
1
2
3
4
5
6
7
8
9
10
curl --location --request POST 'http://10.138.25.214:9200/_reindex' \
--header 'Content-Type: application/json' \
--data-raw '{
"source": {
"index": "deploy-log"
},
"dest": {
"index": "deploy-log-2018.12.24"
}
}'
  • 创建index
1
curl --location --request PUT 'http://10.138.25.214:9200/deploy-log'
  • 创建mapping
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
curl --location --request POST 'http://10.138.25.214:9200/deploy-log/deploy_log' \
--header 'Content-Type: application/javascript' \
--data-raw '{
"settings":{
"number_of_shards":5,
"number_of_replicas":1
},
"mappings":{
"deploy_log":{
"properties":{
"project":{
"type":"keyword",
"index":"not_analyzed"
},
"app":{
"type":"string",
"index":"not_analyzed"
},
"endpoint":{
"type":"ip"
},
"containerName":{
"type":"string",
"index":"not_analyzed"
},
"timestamp":{
"type":"long"
},
"message":{
"type":"text"
}
}
}
}
}'
  • 删除index
1
curl --location --request DELETE 'http://10.133.0.87:9200/.kibana_1'
  • _termvectors
1
curl --location --request GET 'http://10.138.25.214:9200/deploy-log/deploy_log/AWfK6rkZ_ashmo4ko1yd/_termvectors?fields=containerName'
  • index插入内容
1
2
3
4
5
6
7
8
9
10
11
curl --location --request POST 'http://10.163.204.193:9200/logstash-2020.10.27/deploy_log' \
--header 'Content-Type: application/javascript' \
--data-raw '{
"project":"monitor",
"app":"elasticsearch1111",
"env":"dev",
"containerName":"monitor1545302038695",
"endpoint":"10.138.40.223",
"timestamp":1545302038,
"message":"image: hub.docker.terminus.io:5000/es-ext:log-search_1811301023_PRO_180410"
}'
  • mapping删除
1
curl --location --request DELETE 'http://10.138.25.214:9200/deploy-log/deploy_log/_mapping'
  • _template删除
1
curl --location --request DELETE 'http://10.138.25.214:9200/_template/d*'
  • 查询_template
1
curl --location --request GET 'http://10.138.25.214:9201/_template?pretty'
  • indices
1
curl --location --request GET 'http://10.138.16.190:9200/_cat/indices?v'
  • allocate_replica(reroute)
1
2
3
4
5
6
7
8
9
10
11
12
13
curl --location --request POST 'http://10.163.204.80:9200/_cluster/reroute?retry_failed=true' \
--header 'Content-Type: application/json' \
--data-raw '{
"commands":[
{
"allocate_replica":{
"index":".kibana_1",
"shard":0,
"node":"10.163.204.80"
}
}
]
}'
  • cluster.routing.allocation.enable
1
2
3
4
5
6
7
curl --location --request PUT 'http://10.138.16.188:9200/_cluster/settings' \
--header 'Content-Type: application/json' \
--data-raw '{
"transient":{
"cluster.routing.allocation.enable":"all"
}
}'
  • template更新(新增)

6.x

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
curl --location --request PUT 'http://10.163.204.193:9200/_template/k8s-log-template2222' \
--header 'Content-Type: application/json' \
--data-raw '{
"order": 0,
"index_patterns": [
"logstash-*"
],
"settings": {
"index": {
"number_of_shards": "12",
"number_of_replicas": "1",
"translog.durability": "async",
"translog.flush_threshold_size": "1024mb",
"translog.sync_interval": "120s",
"refresh_interval": "120s"
}
},
"mappings": {
"_default_": {
"_all": {
"enabled": false
},
"dynamic_templates": [
{
"strings_as_keywords": {
"mapping": {
"type": "keyword"
},
"match_mapping_type": "string",
"unmatch": "log"
}
},
{
"log": {
"match": "log",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"analyzer": "standard",
"norms": false
}
}
}
]
}
},
"aliases": {}
}'

7.x

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
curl --location --request PUT 'http://10.163.204.193:9200/_template/k8s-log-template2222' \
--header 'Content-Type: application/json' \
--data-raw '{
"order": 0,
"index_patterns": [
"logstash-*"
],
"settings": {
"index": {
"number_of_shards": "12",
"number_of_replicas": "1",
"refresh_interval": "30s"
}
},
"mappings": {
"dynamic_templates": [
{
"strings_as_keywords": {
"unmatch": "log",
"mapping": {
"type": "keyword"
},
"match_mapping_type": "string"
}
},
{
"log": {
"mapping": {
"norms": false,
"analyzer": "standard",
"type": "text"
},
"match_mapping_type": "string",
"match": "log"
}
},
{
"@timestamp": {
"mapping": {
"type": "date"
},
"match_mapping_type": "date",
"match": "@timestamp"
}
}
]
},
"aliases": {}
}'
  • 查询_mapping
1
curl --location --request GET 'http://10.133.0.87:9200/logstash-2019.12.04/_mapping'
  • 修改indices.breaker.fielddata.limit
1
2
3
4
5
6
7
curl --location --request PUT 'http://10.133.0.89:9200/_cluster/settings' \
--header 'Content-Type: application/json' \
--data-raw '{
"persistent":{
"indices.breaker.fielddata.limit":"75%"
}
}'
  • 清理cache
1
curl --location --request POST 'http://10.133.0.89:9200/logstash-*/_cache/clear?fields=*'
  • 查询_cluster/settings
1
curl --location --request GET 'http://10.133.0.89:9200/_cluster/settings'
  • 修改indices.breaker.total.limit
1
2
3
4
5
6
7
curl --location --request PUT 'http://10.133.0.89:9200/_cluster/settings' \
--header 'Content-Type: application/json' \
--data-raw '{
"transient":{
"indices.breaker.total.limit":"80%"
}
}'
  • 修改max_shards_per_node
1
2
3
4
5
6
7
8
9
curl --location --request PUT 'http://10.163.204.80:9200/_cluster/settings' \
--header 'Content-Type: application/json' \
--data-raw '{
"persistent": {
"cluster": {
"max_shards_per_node":10000
}
}
}'
  • remote cluster info
1
2
curl --location --request GET 'http://10.133.0.86:9201/_remote/info' \
--header 'Authorization: Basic ZWxhc3RpYzplbGFzdGlj'
  • 修改索引number_of_replicas
1
2
3
4
5
6
7
curl --location --request PUT 'http://10.163.204.80:9200/security-tracelogdev-20200223/_settings' \
--header 'Content-Type: application/json' \
--data-raw '{
"index" : {
"number_of_replicas" : 0
}
}'
  • allocation.exclude._ip节点下线
1
2
3
4
5
6
7
curl --location --request PUT 'http://10.163.204.80:9200/_cluster/settings' \
--header 'Content-Type: application/json' \
--data-raw '{
"transient" : {
"cluster.routing.allocation.exclude._ip" : "10.163.204.81,10.163.204.82"
}
}'
  • shard移动到某个节点(reroute)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
curl --location --request POST 'http://10.163.204.80:9200/_cluster/reroute?retry_failed=true' \
--header 'Content-Type: application/json' \
--data-raw '{
"commands": [
{
"move": {
"index": "security-tracelogdev-20200223",
"shard": 2,
"from_node": "10.163.204.81",
"to_node": "10.163.204.80"
}
}
]
}'
  • 调整refresh_interval
1
2
3
4
5
curl --location --request PUT 'http://10.163.204.193:9200/logstash-2020.09.24/_settings' \
--header 'Content-Type: application/json' \
--data-raw '{
"refresh_interval": "10s"
}'
  • 修改disk.watermark.high
1
2
3
4
5
6
7
8
curl --location --request PUT 'http://10.163.204.193:9200/_cluster/settings' \
--header 'Content-Type: application/json' \
--data-raw '{
"persistent" : {
"cluster.routing.allocation.disk.watermark.low":"90%",
"cluster.routing.allocation.disk.watermark.high" : "95%"
}
}'
  • 修改recovery相关配置
1
2
3
4
5
6
7
8
curl --location --request PUT 'http://10.163.204.193:9201/_cluster/settings' \
--header 'Content-Type: application/json' \
--data-raw '{
"persistent": {
"indices.recovery.max_bytes_per_sec": "40mb",
"cluster.routing.allocation.node_concurrent_recoveries": "2"
}
}'
  • 查看某个节点的thread_pool状态
1
curl --location --request GET 'http://10.163.204.193:9200/_nodes/10.163.204.193-node1/stats/thread_pool?human&pretty'
  • es集群thread_pool write状态
1
curl --location --request GET 'http://10.163.204.193:9200/_cat/thread_pool/write?v&h=node_name,ip,name,type,active,size,queue,queue_size,largest,rejected,completed&pretty'
  • 查看集群indices缓存信息
1
curl --location --request GET 'http://10.162.166.136:9201/_cluster/settings?include_defaults&flat_settings&local&filter_path=defaults.indices*'
  • 索引关闭
1
curl --location --request POST 'http://10.162.166.45:9201/hmcenter-*/_close'
  • 索引打开
1
curl --location --request POST 'http://10.162.166.45:9201/console*/_open'
  • es写入速度调优
1
2
3
4
5
6
7
8
9
curl --location --request PUT 'http://10.163.204.193:9200/logstash-2021.01.11/_settings' \
--header 'Content-Type: application/json' \
--data-raw '{
"index" : {
"translog.durability" : "async",
"translog.flush_threshold_size" : "1024mb",
"translog.sync_interval" : "120s"
}
}'
  • 查询_ingest/pipeline
1
curl --location --request GET 'http://10.163.204.193:9200/_ingest/pipeline'
  • 集群read_only_allow_delete
1
2
3
4
5
6
7
8
9
curl --location --request PUT 'http://10.133.0.84:9200/_settings' \
--header 'Content-Type: application/json' \
--data-raw '{
"index": {
"blocks": {
"read_only_allow_delete": "false"
}
}
}'
  • 查看索引_settings
1
curl --location --request GET 'http://10.163.204.193:9200/.monitoring-es-6-2021.01.27/_settings?pretty'
  • 索引read_only_allow_delete
1
2
3
4
5
6
7
8
9
curl --location --request PUT 'http://10.163.204.193:9200/.monitoring-es-6-2021.01.28/_settings' \
--header 'Content-Type: application/json' \
--data-raw '{
"index": {
"blocks": {
"read_only_allow_delete": "false"
}
}
}'
  • 查询_cluster/stats
1
curl --location --request GET 'http://10.163.204.193:9200/_cluster/stats'
  • 查看集群_nodes/hot_threads
1
curl --location --request GET 'http://10.163.204.193:9200/_nodes/hot_threads'
  • 查询某个节点的hot_threads
1
curl --location --request GET 'http://10.163.204.193:9200/_nodes/10.163.204.193/hot_threads'
  • 某个节点的stats/thread_pool
1
curl --location --request GET 'http://10.163.204.193:9200/_nodes/10.163.204.193/stats/thread_pool?human&pretty'
  • 查看某个模板
1
curl --location --request GET 'http://10.163.204.193:9200/_template/.monitoring-es?pretty'
  • 索引备份
    https://www.elastic.co/guide/en/elasticsearch/reference/5.4/docs-reindex.html

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    curl -XPOST 'localhost:9200/_reindex?pretty' -H 'Content-Type: application/json' -d'
    {
    "source": {
    "index": "twitter"
    },
    "dest": {
    "index": "new_twitter"
    }
    }
    '
  • es重启
    先kill 杀死es

    1
    sh bin/elasticsearch -d
  • elasticsearch 查看集群所有设置(包含默认的)

    1
    http://10.138.1.1:9200/_cluster/settings?include_defaults=true
  • elasticsearch设置密码

    1
    ./bin/elasticsearch-setup-passwords interactive
  • 查看es集群恢复情况

    1
    http://10.138.1.1:9200/_cluster/allocation/explain?pretty