1.单节点elasticsearch的配置
# cat /usr/local/elk/elasticsearch/config/elasticsearch.yml
cluster.name: alisz_yt_pixso_cluster node.name: alisz_yt_pixso_elk01 path.data: /data/es/data path.logs: /data/es/logs bootstrap.memory_lock: true network.host: 172.18.10.154 http.port: 9200 cluster.initial_master_nodes: ["172.18.10.154"] transport.tcp.port: 9300 transport.tcp.compress: true path.repo: ["/data/esback/"] cluster.max_shards_per_node: 10000 xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: /usr/local/elk/elasticsearch/config/elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: /usr/local/elk/elasticsearch/config/elastic-certificates.p12
2.程序的管理
# cat /etc/systemd/system/elasticsearch.service
[Unit] Description=elasticsearch [Service] User=elasticsearch LimitNOFILE=500000 LimitNPROC=500000 LimitMEMLOCK=infinity ExecStart=/usr/local/elk/elasticsearch/bin/elasticsearch [Install] WantedBy=multi-user.target
3.因为系统只有单节点，很多分片是没法进行分配的，会导致集群状态为yellow，此时是没法查询数据的
问题：单节点elasticsearch出现大量未分片的
[root:~]# curl -u elastic:pass http://172.18.10.154:9200/_cluster/health?pretty
{ "cluster_name" : "alisz_yt_pixso_cluster", "status" : "yellow", "timed_out" : false, "number_of_nodes" : 1, "number_of_data_nodes" : 1, "active_primary_shards" : 21, "active_shards" : 21, "relocating_shards" : 0, "initializing_shards" : 0, "unassigned_shards" : 20, "delayed_unassigned_shards" : 0, "number_of_pending_tasks" : 0, "number_of_in_flight_fetch" : 0, "task_max_waiting_in_queue_millis" : 0, "active_shards_percent_as_number" : 51.21951219512195 }
# 解决办法：设置现有索引 副本为0
curl -u elastic:pass -X PUT "http://172.18.10.154:9200/_settings" -H 'Content-Type: application/json' -d '{"index":{"number_of_replicas":0}}'
[root~]# curl -u elastic:pass http://172.18.10.154:9200/_cluster/health?pretty
{ "cluster_name" : "alisz_yt_pixso_cluster", "status" : "green", "timed_out" : false, "number_of_nodes" : 1, "number_of_data_nodes" : 1, "active_primary_shards" : 21, "active_shards" : 21, "relocating_shards" : 0, "initializing_shards" : 0, "unassigned_shards" : 0, "delayed_unassigned_shards" : 0, "number_of_pending_tasks" : 0, "number_of_in_flight_fetch" : 0, "task_max_waiting_in_queue_millis" : 0, "active_shards_percent_as_number" : 100.0 }
设置elasticsearch默认模板（之后创建索引副本为0）
curl -u elastic:pass -X PUT 172.18.10.154:9200/_template/log -H 'Content-Type: application/json' -d '{ "template": "*", "settings": { "number_of_shards": 5, "number_of_replicas": "0" } }'
"template": "*" 代表所有 索引
"template": "apple*" 代表生成apple*的索引都会按照这个模板来了
1.单节点elasticsearch的配置
# cat /usr/local/elk/elasticsearch/config/elasticsearch.yml
cluster.name: alisz_yt_pixso_cluster
node.name: alisz_yt_pixso_elk01
path.data: /data/es/data
path.logs: /data/es/logs
bootstrap.memory_lock: true
network.host: 172.18.10.154
http.port: 9200
cluster.initial_master_nodes: ["172.18.10.154"]
transport.tcp.port: 9300
transport.tcp.compress: true
path.repo: ["/data/esback/"]
cluster.max_shards_per_node: 10000
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /usr/local/elk/elasticsearch/config/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/local/elk/elasticsearch/config/elastic-certificates.p12
2.程序的管理
# cat /etc/systemd/system/elasticsearch.service
[Unit]
Description=elasticsearch
[Service]
User=elasticsearch
LimitNOFILE=500000
LimitNPROC=500000
LimitMEMLOCK=infinity
ExecStart=/usr/local/elk/elasticsearch/bin/elasticsearch
[Install]
WantedBy=multi-user.target
3.因为系统只有单节点，很多分片是没法进行分配的，会导致集群状态为yellow，此时是没法查询数据的
问题：单节点elasticsearch出现大量未分片的
[root@alisz-yt-pixso-jaeger01:~]# curl -u elastic:pass http://172.18.10.154:9200/_cluster/health?pretty
{
"cluster_name" : "alisz_yt_pixso_cluster",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 21,
"active_shards" : 21,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 20,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 51.21951219512195
}
# 解决办法：设置现有索引 副本为0
curl -u elastic:pass -X PUT "http://172.18.10.154:9200/_settings" -H 'Content-Type: application/json' -d '{"index":{"number_of_replicas":0}}'
[root@alisz-yt-pixso-jaeger01:~]# curl -u elastic:pass http://172.18.10.154:9200/_cluster/health?pretty
{
"cluster_name" : "alisz_yt_pixso_cluster",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 21,
"active_shards" : 21,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
设置elasticsearch默认模板（之后创建索引副本为0）
curl -u elastic:pass -X PUT 172.18.10.154:9200/_template/log -H 'Content-Type: application/json' -d '{
"template": "*",
"settings": {
"number_of_shards": 5,
"number_of_replicas": "0"
}
}'
"template": "*" 代表所有 索引
"template": "apple*" 代表生成apple*的索引都会按照这个模板来了