Es common operations and classical case

1 集群操作

1.1 获取集群状态

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cluster/health?pretty'

1.2 Get the exception's index

如果1.1The state of the cluster obtained in is notgreen,而是yellow或者red,Then you need to get the abnormal index to repair it

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/indices?v&health=yellow'

2 索引操作

h= Filter the columns that need to be manipulated
s= 进行聚合,排序等操作

2.1 查看索引,查看状态为yellow

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/indices?v&health=yellow'

2.2 查看索引,Sort by index name

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/indices/?v&s=index'
curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/indices/?v&s=index:desc'

2.3 查看索引,Sort by number of documents

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/indices?v&s=docs.count'
curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/indices?v&s=docs.count:desc'

2.4 查看索引,Sort by storage size

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/indices?v&s=store.size'
curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/indices?v&s=store.size:desc'

2.5 查看索引,按照内存大小排序

curl -XGET 'Content-Type: application/json' 'http://localhost:9200/_cat/indices?v&h=health,index,pri,rep,docs.count,docs.deleted,store.size,pri.store.size,tm&s=tm'
curl -XGET 'Content-Type: application/json' 'http://localhost:9200/_cat/indices?v&h=health,index,pri,rep,docs.count,docs.deleted,store.size,pri.store.size,tm&s=tm:desc'

3 A single index operation

3.1 查看单个索引,查看数据内容

默认输出10行doc

curl -XGET 'Content-Type: application/json' 'http://localhost:9200/[email protected]/_search?pretty'

You can see the data format of a row of data,for subsequent processing and sorting and aggregation

      {
        "_index" : "[email protected]",
        "_type" : "log",
        "_id" : "7DtddIAB-AGo1nv-abnm",
        "_score" : 1.0,
        "_source" : {
          "application-name" : "app-demo",
          "local-ip" : "x.x.x.x",
          "app-id" : "1",
          "offset" : 263273337,
          "instance-id" : "demo-7cf675695c-56t88",
          "ns-id" : "ns-96a79v5b",
          "source" : "/data/app_std/stdout/logs/sys_log.log",
          "message" : "2022-04-30 16:08:38.695 DEBUG 1 --- [pool-1-thread-1] c.t.c.t.sdk.core.remoting.NettyChannel   : return netty channel: NettyChannel [channel=[id: 0x53ef4f24, L:/x.x.x.x:38528 - R:/x.x.x.x:28000]], serializationId: 1",
          "type" : "log",
          "appgp-id" : "gp-xxx",
          "timestamp_es" : "2022-04-30T16:08:40.678+08:00",
          "@timestamp" : "2022-04-30T08:08:39.081Z",
          "fields" : {
            "pipename" : "pipeline"
          },
          "application-id" : "app-xxxx",
          "cluster-id" : "cluster-xxxx"
        }
      }

3.2 查看单个索引,查看数据内容,根据条件过滤

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/[email protected]/_search?pretty' -d '
 {
    "query": {
        "term" : { "appgp-id" : "gp-xxx" }
     }
 }'

3.3 查看单个索引,查看数据内容,根据条件过滤,分页

 curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/[email protected]/_search?pretty' -d '
  {
     "from" : 0, 
     "size" : 10,
     "query": {
         "term" : { "appgp-id" : "gp-xxx" }
      }
  }'

3.4 查看单个索引,查看数据内容,根据条件过滤,按照条件排序

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/[email protected]/_search?pretty' -d '
{
  "from" : 0, 
  "size" : 10,
  "sort" : [
       { "ns-id": "desc" }
   ],
  "query": {
      "term" : { "appgp-id" : "gp-xxx" }
   }
}'

3.5 查看单个索引,查看数据内容,根据条件过滤,按照条件排序, explain原因

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/[email protected]/_search?pretty' -d '
{
  "from" : 0, 
  "size" : 10,
  "sort" : [
       { "ns-id": "desc" }
   ],
  "explain": true,
  "query": {
      "term" : { "appgp-id" : "gp-xxx" }
   }
}'

3.6 查看单个索引,聚合指标,根据tag排序,Get the number of documents sorted

gp_by_tags is the aggregated new indicator,可以任意命名,功能类似myslq的gp by功能

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/[email protected]/_search?pretty'  -d '
{
  "size" : 1,
  "aggs": {
      "gp_by_tags": { 
        "terms" : { 
           "field" : "appgp-id",
            "order" : { "_count" : "desc" },
            "size": 50
        }
      }
   }
}'

3.7 查看单个索引,获取segment情况

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/segments/[email protected]?v&s=prirep,shard'

4 删除索引

4.1 删除索引

直接删除索引,will correspond to the entire indexshardDelete directly from disk,Disk space will be released directly

curl -XDEL -H 'Content-Type: application/json' 'http://localhost:9200/[email protected]'

4.2 删除索引中的文档数据

执行删除操作后,Just mark the document in the index for deletion（后缀增加.del,进行查询后,会自动被mergedelete the corresponding data）,Go next timemerge时,will make a new copyseg（Does not contain deleted onesdoc）,同时.del的seg会被删除,free disk.

scroll_size=5000 一次batch5000
refresh&slices=5 5个切片,增加5个并发
size=1000 1times only delete1000行数据

curl -H 'Content-Type: application/json' 'http://localhost:9200/[email protected]/_delete_by_query?size=138163&scroll_size=500&refresh&slices=5&pretty'  -d '
{
  "query": { 
    "term" : { 
       "appgp-id" : "gp-xxx"
    }
  }
}'

4.3 执行forcemerge,free disk

curl -XPOST -H "Content-Type: application/json" 'http://localhost:9200/[email protected]/_forcemerge?only_expunge_deletes=true&max_num_segments=1&pretty'

4.4 查看merge情况

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/indices/?s=segmentsCount:desc&v&h=index,segmentsCount,segmentsMemory,memoryTotal,mergesCurrent,mergesCurrentDocs,storeSize,p,r'

4.5 查看merge任务情况

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_tasks?detailed=true&actions=*forcemerge'

5 分片操作

5.1 查看分片,Sort by index name

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/shards/?v&s=index'
curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/shards/?v&s=index:desc'

5.2 查看分片,Sort by number of documents

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/shards?v&s=docs'
curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/shards?v&s=docs:desc'

5.2 查看分片,Sort by storage size

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/shards?v&s=store'
curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/shards?v&s=store:desc'

5.3 查看分片,Get no assigned reason

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason'

6 节点操作

6.1Get the disk information of the node

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_cat/allocation?v'

6.2 查看esThe disk water level configuration

curl -H 'Content-Type: application/json' -XGET 'http://localhost:9200/_cluster/settings?pretty'

If not configured separately,The rules are restricted according to the default value

3A critical disk usage watermark

6.2.1 低警戒水位线——默认为磁盘容量的85％.

cluster.routing.allocation.disk.watermark.low

Elasticsearch不会将分片分配给使用磁盘超过85％的节点.它也可以设置为绝对字节值（如500mb）,以防止Elasticsearch在小于指定的可用空间量时分配分片.此设置不会影响新创建的索引的主分片,Or specifically any shards that have never been allocated before.

6.2.2 高警戒水位线——默认为磁盘容量的90％.

cluster.routing.allocation.disk.watermark.high 

ElasticsearchWill try to exceed from disk usage90％的节点重新分配分片.它也可以设置为绝对字节值,以便在节点小于指定的可用空间量时将其从节点重新分配.此设置会影响所有分片的分配,无论先前是否分配.

6.2.3 洪水警戒水位线——默认为磁盘容量的95％

cluster.routing.allocation.disk.watermark.flood_stage

Elasticsearch对每个索引强制执行只读索引块（index.blocks.read_only_allow_delete）.这是防止节点耗尽磁盘空间的最后手段.Once there is enough free disk space to allow the indexing operation to continue,The index block must be freed manually.

6.3 Set the disk usage watermark

curl -XPUT -H 'Content-Type: application/json' 'http://localhost:9200/_cluster/settings?pretty' -d '{
"transient" : {
    "cluster.routing.allocation.disk.watermark.low": "60%",
    "cluster.routing.allocation.disk.watermark.high" : "70%",
    "cluster.info.update.interval" : "1m",
	"cluster.routing.allocation.disk.watermark.flood_stage": "80%"
    }
}'

6.6 获取es索引只读

when the disk usage 洪水警戒水位线 后,eswill make the index read-only by itself,for self-protection.And after disk usage recovers,Nor will it automatically recover,Manual recovery is required

curl -XGET -H 'Content-Type: application/json' 'http://localhost:9200/_all/_settings?pretty'|grep '"read_only_allow_delete" : "true"'

6.7 Remove read-only restrictions

After disk usage recovers,Requires manual cancellation of the read-only configuration,否则esStill unable to write data normally

curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'

6.8 触发重新分配

If partially indexed/shard异常,and after the allotted number of retries has been exceeded,The system still cannot recover. The reallocation needs to be manually retriggered,for the purpose of recovery

curl -H 'Content-Type: application/json' -XPOST http://localhost:9200/_cluster/reroute?retry_failed=true

7 常见场景

7.1 磁盘使用率过高,Indexes or documents need to be deleted to reduce disk usage

1. Sort by storage sizeFind the index with the highest disk usage,And delete or delete documents for the index
2. 根据实际情况,Delete indexes with high disk usage,free disk.
3. 根据实际情况,If you can't drop the index directly,而根据需要删除索引中的文档数据,并进行执行forcemerge,free disk

7.2 删除文档后,Disk usage did not drop

1. Document deletion process,Data is not deleted directly from the disk.Instead, the documents that need to be deleted are marked.del
2. Deleted documents can still be queried,But it will be filtered out,因此对于客户端来说,无法查看数据,But the actual disk usage didn't drop
3. Need to wait for next timemerge后,会将对应的segmentCopy a new one out（不包含已经删除的文档）,并将老的segment删除,Only then will the disk be released
4. If you want to free up the disk quickly,可以执行forcemerge,free disk

7.3 The disk used to be full,But after the usage is restored,es依然提示readonly

1. When disk usage is exceeded洪水警戒水位线——默认为磁盘容量的95％
2. es会自动设置readonlyfor self-protection,可以通过获取es索引只读获取状态.
3. If the disk usage has recovered,It needs to be set manuallyRemove read-only restrictions,The cluster can become writable again.
4. 通常情况下,Disk recovery time is slow,Therefore, it is not normal to have some indexes,需要人工Trigger index reallocation,Thereby automatically recovering

参考文档

1. 官方文档