elasticsearch常用语句

基础操作

基础查看

1、查看集群的健康状态
curl -XGET  "http://10.45.151.227:9200/_cat/health?v"2、查看nodes
curl -u elastic:123456 -XGET 'http://10.45.186.125:9200/_cat/nodes?v'3、查看索引
curl -XGET 'http://10.45.186.155:9200/_cat/indices?pretty'4、创建索引
curl -XPUT  'http://10.45.186.155:9200/gwtest01?pretty'  -H 'Content-Type: application/json' -d '
{
"settings": {
"number_of_shards": "36",
"number_of_replicas": "0"
}
}'5、给索引添加一条数据
curl -XPOST 'http://10.45.186.155:9200/gwtest01/stu/1?pretty' -H 'Content-Type: application/json' -d '
{
"name":"wangfang",
"age":22,
"sex":1
}'6、查询索引所有文档：
curl -XGET  'http://10.45.151.108:9200/test/_search?pretty' -H 'Content-Type: application/json' -d '
{"query": {"match_all": { }}
}'7、删除一个索引
curl -XDELETE 'http://10.45.186.155:9200/gwtest01?pretty'

详细查看

1、查看一个索引的settings[elastic@gwtest156 0]$  curl -XGET 'http://10.45.186.156:9200/gwtest02/_settings?pretty'
{"gwtest02" : {"settings" : {"index" : {"creation_date" : "1634645232394","number_of_shards" : "5",        #主分片数，默认为5，只能在建索引时设置，不能修改"number_of_replicas" : "1",     #设置索引分片副本数，默认为1，可以随时修改"uuid" : "98xWMOHKQUaP1Rl90p7zQA","version" : {"created" : "6030099"},"provided_name" : "gwtest02"}}}
}2、查看一个文档类型的定义mapping
[elastic@gwtest156 ~]$ curl -XGET 'http://10.45.186.156:9200/gwtest02/stu/_mapping?pretty'
{"gwtest02" : {"mappings" : {"stu" : {"properties" : {"age" : {"type" : "long"},"name" : {"type" : "text","fields" : {"keyword" : {"type" : "keyword","ignore_above" : 256}}}3、查看所有shard情况：curl  -XGET 'http://192.168.1.205:9200/_cat/shards/20240313uganda?v'

4、插入索引模板
通过索引名字通配

curl -u rhino:zxsk@34#$ -XPUT "http://10.45.186.73:9200/_template/template_1" -H 'Content-Type: application/json' -d'
{"index_patterns": ["test*"],"settings": {"number_of_shards": 1,"index":{"max_result_window": 100000,"mapping":{"total_fields":{"limit":5000}}}}
}'

常用运维

配置及解决

1、置空分片

查找当前原因：
curl -XGET 10.45.186.72:9200/_cluster/allocation/explain?pretty
{"index": "222222","shard": 6,"primary": true,"current_state": "unassigned","unassigned_info": {"reason": "NODE_LEFT","at": "2019-10-31T17:02:11.258Z","details": "node_left[removedforsecuritybecimparanoid1]","last_allocation_status": "no_valid_shard_copy"},"can_allocate": "no_valid_shard_copy","allocate_explanation": "cannot allocate because a previous copy of the primary shard existed but can no longer be found on the nodes in the cluster","node_allocation_decisions": [{reroute命令
curl -XPOST 10.45.186.72:9200/_cluster/reroute -H 'Content-Type: application/json'  -d '{
"commands" : [
{
"allocate_empty_primary" : {
"index" : "222222",       ---上面查出的index名字
"shard": 6,					----上面查出来的shard id 
"node" : "removedforsecuritybecimparanoid7",    ----往下翻任找一个node name 填入
"accept_data_loss" : true
}
}
]
}'

2、修改节点最大分片数： 将索引每个节点的最大分片数增加至6个

curl -XPUT "http://ip:port/<index_name>/_settings" -H 'Content-Type:application/json' -d '{"routing.allocation.total_shards_per_node": 6}'

3、修改所有副本数： 将索引副本数增加至1

curl -XPUT "http://ip:port/<index_name>/_settings" -H 'Content-Type:application/json' -d '{"number_of_replicas": 1}'

4、开关索引：

关闭索引
curl -XPOST  http://10.45.186.155:9200/gwtest01/_close开启索引
curl -XPOST  http://10.45.186.155:9200/gwtest01/_open

5、动态设置磁盘阈值参数：

curl -XPUT  -H "Content-Type: application/json" http://10.45.151.221:9200/_cluster/settings -d '{"transient" : {"cluster.routing.allocation.disk.watermark.low" : "90%","cluster.routing.allocation.disk.watermark.high" : "95%"}
}'

6、索引只读状态

查看索引是否是只读：
curl -XGET "192.168.42.155:9200/202104?pretty" | grep 'read_only_allow_delete'取消索引只读状态：
curl -XPUT -H "Content-Type: application/json" http://10.127.48.49:9200/202010/_settings -d '{"index.blocks.read_only_allow_delete": false}'

段操作

1、查看整个集群的状态, 其中segments.count 为段总数

curl -XGET 'http://10.45.151.221:9200/_cluster/stats?pretty'

2、查看每个段，计算行数，统计总个数

curl -XGET http://10.45.151.221:9200/_cat/segments?pretty|wc -l

3、查看具体某个索引段个数

curl -XGET http://10.45.151.221:9200/zxsk_owls45_20230418/_stats?pretty

4、强制段合并命令，将每个shard段合并为1个：

curl -XPOST 'http://10.45.151.221:9200/zxsk_owls45_20230418/_forcemerge?max_num_segments=1'

5、查看段内存情况：

curl -XGET -u  elastic:elastic  "http://10.45.151.227:9200/_cat/nodes?v&h=ip,name,ram.percent,port,sm"

其中sm 即为segment memory

用户相关

1、查看用户

curl  -u zxsk:sinovatio  -XGET 'http://10.45.187.119:9200/_security/user?pretty'

2、查看角色

curl  -u zxsk:sinovatio  -XGET 'http://10.45.187.119:9200/_security/role?pretty'

3、删除role

curl -XDELETE -u elastic:123456 "http://10.45.187.118:9200/_security/role/gwtest_role" 

4、创建role（该role拥有集群的只读操作，索引的增删改写操作）：

curl -XPOST -u elastic:123456 "http://10.45.187.118:9200/_security/role/gwtest_role" -H 'Content-Type: application/json' -d '{ "cluster": ["all"],"indices": [{ "names": [ "*" ],
"privileges": ["all"]}],"run_as": [ "other_user" ], "metadata" :{"version" : 1}}'curl -XPOST -u elastic:123456 "http://10.45.187.118:9200/_security/role/gwtest_role" -H 'Content-Type: application/json' -d '{ "cluster": ["monitor"],"indices": [{ "names": [ "*" ],
"privileges": ["write","read","index","create_index","monitor","delete"]}],"run_as": [ "other_user" ], "metadata" :{"version" : 1}}'curl -XPOST -u elastic:123456 "http://10.45.187.118:9200/_security/role/gwtest_role" -H 'Content-Type: application/json' -d '{ "cluster": ["monitor"],"indices": [{ "names": [ "^[^.].*" ],"privileges": ["all"]}],"run_as": [ "other_user" ], "metadata" :{"version" : 1}}'curl -XPOST -u elastic:123456 "http://10.45.187.118:9200/_security/role/gwtest_role" -H 'Content-Type: application/json' -d '{ "cluster": ["monitor"],"indices": [{ "names": [ "*" ],
"privileges": ["write","read","index","create_index","monitor","delete","delete_index"]}],"run_as": [ "other_user" ], "metadata" :{"version" : 1}}'curl -XPOST -u elastic:123456 "http://10.45.187.118:9200/_security/role/gwtest_role" -H 'Content-Type: application/json' -d '{ "cluster": ["monitor"],"indices": [{ "names": [ "gwtest02" ],"privileges": ["read"]},{ "names": [ "*" ],"privileges": ["all"]}],"run_as": [ "other_user" ], "metadata" :{"version" : 1}}'

5、创建用户例子：

1、创建一个所有索引的只读role，名为normal_user_1
curl -XPOST -u elastic:${ESPASSWD} "http://${ES_CURLHOST}:9200/_security/role/normal_user_1" -H 'Content-Type: application/json' -d '{ "cluster": ["monitor","manage_index_templates"],"indices": [{ "names": [ "a*","b*","c*","d*","e*","f*","g*","h*","i*","j*","k*","l*","m*","n*","o*","p*","q*","r*","s*","t*","u*","v*","w*","x*","y*","z*","0*","1","2*","3*","4*","5*","6*","7*","8*","9*" ],"privileges": ["read"]}],"run_as": [ "other_user" ], "metadata" :{"version" : 1}}' 2、创建一个以gwtest 开头索引名 全部权限的role，名为normal_user_2
curl -XPOST -u elastic:elastic "http://10.45.151.227:9200/_security/role/normal_user_2" -H 'Content-Type: application/json' -d '{ "cluster": ["monitor"],"indices": [{ "names": [ "gwtest*"],"privileges": ["all"]}],"run_as": [ "other_user" ], "metadata" :{"version" : 1}}' 3、创建用户
curl -XPOST -u elastic:elastic "http://10.45.151.227:9200/_security/user/test" -H 'Content-Type: application/json' -d '{ "password": "用户密码", "roles": ["normal_user_1","normal_user_2"] }'

扩容缩容

1、删除节点

curl -XPOST 10.45.186.72:9200/_cluster/reroute -H 'Content-Type: application/json'  -d '
{"transient": {"cluster.routing.allocation.exclude._ip": "10.10.0.1"}
}'

参数优化

discovery_zen_minimum_master_nodes    master数量/2 +1 
Gateway Recover After Nodes        master+计算节点数（每台服务器上es进程数*服务器数量） -1
node_max_local_storage_nodes      改为1