第九章 ELK常见报错及解决

一、常见报错:shared小了

1.报错

#ES日志报错：
Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [4999]/[5000] maximum shards open;

2.解决

# 集群分片设置成20000，根据情况而设置
[root@ES-Log-1 ~]#  curl -XPUT -H "Content-Type:application/json" http://172.16.1.24:9200/_cluster/settings -d '{"transient":{"cluster":{"max_shards_per_node":20000}}}'

二、常见报错：通配符模糊匹配删除索引失败

1.报错

[root@ES-Log-1 ~]# curl -X DELETE 'http://172.16.1.24:9200/jdxiyu-afanti-console-1135-*'
{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "Wildcard expressions or all indices are not allowed"
      }
    ],
    "type" : "illegal_argument_exception",
    "reason" : "Wildcard expressions or all indices are not allowed"
  },
  "status" : 400
}

2.解决

# 开启通配符模糊匹配删除索引
[root@ES-Log-1 ~]# curl -XPUT -H "Content-Type:application/json" http://172.16.1.24:9200/_cluster/settings -d '{"persistent": {"action.destructive_requires_name": false}}}'

三、常见报错：ES删除索引报错

1.报错

如果elasticsearch删除索引报错
[root@ES-Log-1 ~]# curl -X DELETE 'http://172.16.1.24:9200/jdxiyu-afanti-console-1135-*'
{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"text is empty"}],"type":"illegal_argument_exception","reason":"text is empty"},"status":400}

是因为你使用是root删除，要用elasticsearch删除，这种情况多为rpm形式安装

2.解决

#1.删除索引命令
[root@ES-Log-1 ~]# sudo -u elasticsearch sh -c "curl -X DELETE 'http://172.16.1.24:9200/jdxiyu-afanti-console-1135-*'"
{"acknowledged":true}

#2.查看索引命令
[root@ES-Log-1 ~]# sudo -u elasticsearch sh -c "curl -X  GET http://172.16.1.24:9200/_cat/indices"

注：集群只要在其中一台删除即可