jpuyy的网志

Category: Elasticsearch

  • es 调整每个 node 最大 shard 数量

    新集群 5 台机器

    Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [4999]/[5000] maximum shards open;

    默认每个node 1000个，则最多 5000 个 shard，满了导致不能创建新的 es index

    {
  "persistent" : {
    "cluster" : {
      "max_shards_per_node" : "100000"
    },
    "search" : {
      "max_buckets" : "50000"
    }
  },
  "transient" : {
    "cluster" : {
      "max_shards_per_node" : "100000"
    },
    "search" : {
      "max_buckets" : "50000"
    }
  }
}

  • elasticsearch 笔记

    查看索引

    http://127.0.0.1:9200/_cat/indices

    查看节点

    http://10.18.19.93:9200/_nodes

    查看 mappings

    http://10.18.19.70:9200/_mappings

    查看健康状态

    _cluster/health

    每个 index 状态

    _cluster/health?level=indices

    删除 index

    curl -XDELETE 1.2.3.4:9200/notification_msgcount_logs-2019.24

    按存储大小排序

    curl -XGET 'http://127.0.0.1:9200/_cat/indices/_all?v&s=store.size'

    查看未分配 shard 的原因
    GET _cluster/allocation/explain?pretty

    FORBIDDEN/12/index read-only 报错
    es磁盘已满而无法索引更多文档，则elasticsearch将切换为只读。它确保了只读查询的可用性。

    blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];: [cluster_block_exception] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];
    进行 index 的删除的同时。Elasticsearch不会自动切换回来，可以使用如下方法切换回正常模式：

    PUT _settings
    {
    “index.blocks.read_only_allow_delete”: “false”
    }

    # 检查

    GET _settings