ELK 的ES常用的运维命令

题外话

如需转载文章请标明出处，因为我的很多文章一般是会进行更新的。也避免百度搜出来一大推相似的文章，却找不到原创博主。

 ES的license由trial更改为为basic

## 查看
curl -u elastic:zhoulong -X DELETE http://127.0.0.1:9200/_license?pretty

### 修改成basic认证
curl -H "Content-type:application/json" -X POST http://localhost:9200/_xpack/license/start_basic?acknowledge=true -u elastic:xxx

shell 操作索引

## 查看索引
curl 10.125.20.48:9200/_cat/indices

## 查看集群健康状态
curl -s http://10.125.20.48:9200/_cat/health?v

# 创建索引
curl -XPUT 10.125.20.48:9200/knight

## 删除索引
curl -XDELETE http://localhost:9200/twitter

## 重命名索引,在这之前先创建dest索引
curl -H "Content-Type:application/json"  -XPOST 'http://10.125.20.48:9200/_reindex' -d '
{
  "source": {
    "index": "knight"
  },
  "dest": {
    "index": "test_knight"
  }
}'

##  查看进度
curl 10.125.20.48:9200/_tasks?detailed=true&actions=*reindex

## 单机版索引是red的情况的思路
# 如果是red的索引, 可以先复制到新的索引上去(前提是先创建索引),那样新的索引就有数据了
# 然后删除掉是red的索引,然后再创建名为之前为red的索引。
#  然后再复制数据过来即可

写入数据

## knight是索引,_doc是类型,不指定id 
POST knight/_doc
{
  "name":"tom",
  "city":"cs"
  
}

##  使用shell进行操作
curl -s -H "Content-Type:application/json"  -XPOST 'http://10.125.20.48:9200/knight/_doc' -d '{"name":"tom","age":32}'

查询 UNASSIGNED的索引

curl -s -u elastic:xxoo "http://127.0.0.1:9200/_cat/shards"|grep UNASSIGNED|egrep -v "^\."

或者你也可以这样查询UNASSIGNED 的个数：

GET _cat/allocation?v

默认情况下，ES会自动将未分配的shards，分配到各node上。使用以下命令确定自动分配分片的功能是打开的。

GET _cluster/settings?pretty

{
  "persistent" : {
    "xpack" : {
      "monitoring" : {
        "collection" : {
          "enabled" : "true"
        }
      }
    }
  },
  "transient" : {
    "cluster" : {
      "max_shards_per_node" : "900000"
    }
  }
}

从上图中我们没有看到自动分片已经打开，所以我们可以使用如下命令来开启自动分配。

PUT _cluster/settings
{
  "transient":{
    "cluster.routing.allocation.enable" : "all"
  }
}

再次查看：

GET _cluster/settings

{
  "persistent" : {
    "xpack" : {
      "monitoring" : {
        "collection" : {
          "enabled" : "true"
        }
      }
    }
  },
  "transient" : {
    "cluster" : {
      "routing" : {
        "allocation" : {
          "enable" : "all"
        }
      },
      "max_shards_per_node" : "900000"
    }
  }
}

如果想要永久生效，可以这样改成 persistent 形式

PUT _cluster/settings
{
  "persistent":{
    "cluster.routing.allocation.enable" : "all"
  }
}

删除 UNASSIGNED 索引脚本

#!/bin/bash
for line in `cat xx.txt`
do
    #echo "aaa/$line"
    curl -u elastic:xxoo -XDELETE "192.168.0.3:9200/$line"
    echo -e "\n"

done

一次性删除多天之前的日志脚本

#!/bin/bash
# 本文博客地址： https://knight.blog.csdn.net/article/details/107957840

for line in {30..35}
do
    riqi=$(date -d "$line days ago" +"%Y.%m.%d")
    #echo $riqi
    curl -s -u elastic:xxoo -XDELETE "http://192.168.0.6:9200/*${riqi}*"
    echo "\n"
    sleep 1
    
done

查看状态是red的索引

curl -s -u oo:xx "http://$host:9200/_cat/indices"|grep red

对副本分片不可用的索引进行设置，从而消除 Red 或者 Yellow 状态。

先查找：

GET _cat/shards?h=index,shard,prirep,state,unassigned.reason

对某一个索引的状态进行查询

GET xxoo/_settings

对某一个索引设置副本数为0.

PUT xxoo/_settings
{
  "number_of_replicas": 0
}

那么如何在shell 中进行执行了？

indexname="hhh"
curl -H "Content-Type: application/json" -s -u xx:00 -XPUT "http://$host:9200/$indexname/_settings" -d '{"number_of_replicas":0}'

在shell中如何循环执行了？

#!/bin/bash
host="10.19.19.248"

for line in `cat xx.txt`
do
    #echo "aaa/$line"
    curl -H "Content-Type: application/json" -s -u xx:00  -XPUT "http://$host:9200/$line/_settings" -d '{"number_of_replicas":0}'
    echo -e "\n"
 
done