es日常维护
es参考手册地址：
https://www.elastic.co/guide/en/elasticsearch/reference/6.8/indices-get-mapping.html
1.查看es日志
curl -XGET http://10.26.41.60:9200/xdm-logs-2018.08.22?pretty=true
2.删除es日志
curl -XDELETE 'http://10.26.41.60:9200/xdm-logs-2018.08.22?pretty'
3.查询全部,默认返回10条
curl -u elastic:elastic -H "Content-Type: application/json" -XGET '192.168.1.108:19200/app_message_all/_search?pretty' -d '
{
"query": { "match_all": {} }
}'
按照updateTime降序返回第一条
curl -H "Content-Type: application/json" -XGET 'http://10.29.69.243:19200/inoculate/_search?pretty' -d '
{
"query": { "match_all": {} },
"sort": { "updateTime": { "order": "desc" } },
"size": 1
}'
4.查询_id为AWaZRBLvqKSJQKtyjFBL的数据
curl -XPOST '10.26.41.60:9200/xdm-logs-2018.10.22/_search?pretty' -d '
{
"query": { "match": { "_id": "AWaZRBLvqKSJQKtyjFBL" } }
}'
curl -H "Content-Type: application/json" -XPOST 'http://10.29.69.243:19200/inoculate/_search?pretty' -d '
{
"query": { "match": { "childId": "5477456" } }
}'
5.模糊查询
curl -XPOST '10.26.41.60:9200/xdm-logs-2018.10.22/_search?pretty' -d '
{
"query": { "wildcard": { "message": "*2697395*" } }
}'
6.查看所有的index
curl -X GET 'http://10.26.41.60:9200/_cat/indices?v'
kettle入库后进行查询
Select
substr(a,1,instr(a,'2018')-2),
sum(Case When d Like '%gb' Then Substr(d,1,Instr(d,'gb')-1)*1024*1024
When d Like '%mb' Then Substr(d,1,Instr(d,'mb')-1)*1024
When d Like '%kb' Then Substr(d,1,Instr(d,'kb')-1)*1
End) As "kb"
From tb_es_data
Group By
substr(a,1,instr(a,'2018')-2)
7.查看某个index的settings,或者mapping,(pretty=true是指使用易读的方式展现结果)
url -H "Content-Type: application/json" -XGET "http://10.26.41.60:9200/nginx-logs-2018.09.05/_settings?pretty=true"
curl -H "Content-Type: application/json" -XGET "http://10.26.41.60:9200/nginx-logs-2018.09.05/_mappings?pretty=true"
这里可以查看分片数和副本数
{
"db_customer" : {
"settings" : {
"index" : {
"creation_date" : "1544423489873",
"number_of_shards" : "5",
"number_of_replicas" : "1",
"uuid" : "l77jcDHsR9miIuIKs7RBAA",
"version" : {
"created" : "6050099"
},
"provided_name" : "db_customer"
}
}
}
}
创建一个空的index,没有任何的字段
curl -u elastic:elastic -X PUT "192.168.1.108:19200/app_message_all_date?pretty" -H 'Content-Type: application/json' -d'
{}
'
8.获取节点信息
[yeemiao@elk2 etc]$ curl 'http://10.26.41.60:9200/_cat/nodes?v'
9.查看那个是主节点
curl http://192.168.1.134:9200/_cat/master?v
10.设置副本数(这里把单节点的副本数设置为0)
curl -u elastic:elastic -H "Content-Type: application/json" -XPUT 'http://192.168.1.85:9200/db_customer/_settings' -d '{
"number_of_replicas" : 0
}'
11.创建索引并设置其中的mapping的某个字段不进行index
curl -u elastic:elastic -X PUT "192.168.1.85:9200/mytest_index02" -H 'Content-Type: application/json' -d'
{
"mappings": {
"_doc": {
"properties": {
"title": { "type": "text" },
"name": { "type": "text" ,"index": "false" },
"age": { "type": "integer" },
"created": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
}
}
'
12.创建index，然后创建mapping
创建一个新的index
curl -u elastic:elastic -H 'Content-Type: application/json' -XPUT "http://192.168.1.85:9200/productindex01"
创建一个mapping
curl -u elastic:elastic -H 'Content-Type: application/json' -XPOST "http://192.168.1.85:9200/productindex01/product01/_mapping?pretty" -d '
{
"product01": {
"properties": {
"title": {
"type": "text",
"store": "true"
},
"description": {
"type": "text",
"index": "false"
},
"price": {
"type": "double"
},
"onSale": {
"type": "boolean"
},
"type": {
"type": "integer"
},
"createDate": {
"type": "date"
}
}
}
}
'
添加一个字段:
curl -u elastic:elastic -H 'Content-Type: application/json' -XPOST "http://192.168.1.85:9200/productindex01/product01/_mapping?pretty" -d '{
"product01": {
"properties": {
"amount":{
"type":"integer"
}
}
}
}'
------------------数据库、表、记录操作-----------------------
查看索引(数据库)
curl 'http://192.168.56.91:9200/_cat/indices?v'
创建索引
curl -XPUT 'http://192.168.56.91:9200/db_customer'
添加文档(表)
[esuser@pxc01 ~]$ curl -H "Content-Type: application/json" -XPUT 'http://192.168.56.91:9200/db_customer/tb_test/1' -d '{"name": "huangxueliang"}'
查看刚才添加的文档记录
curl -XGET 'http://192.168.56.91:9200/db_customer/tb_test/1?pretty'
curl -XGET 'http://192.168.56.91:9200/db_customer/tb_test/2?pretty'
curl -XGET 'http://192.168.56.91:9200/db_customer/tb_test/3?pretty'
删除记录
curl -XDELETE 'http://192.168.56.91:9200/db_customer/tb_test/2'
更新文档
curl -H "Content-Type: application/json" -XPOST 'http://192.168.56.91:9200/db_customer/tb_test/1/_update?pretty' -d '
{
"doc":{"name":"myname_update_hxl"}
}'
查看表记录
curl -XGET 'http://10.29.69.243:19200/vacc_update/log/_search?pretty'
红色部分是记录的id
curl -H "Content-Type: application/json" -XPOST 'http://10.29.69.243:19200/vacc_update/log/KxgYJmgBEiGK96VRX--b/_update?pretty' -d '
{
"doc":{"updateTime" : "2018-01-01 00:00:00"}
}'
批处理
curl -H "Content-Type: application/json" -XPOST 'http://192.168.56.91:9200/db_customer/tb_test/_bulk?pretty' -d '
{"index":{"_id":"2"}}
{"name":"zhangsan"}
{"index":{"_id":"3"}}
{"name":"lisi"}
'
查找数据库下的表
curl -XGET "http://192.168.1.134:9200/reservation/_mapping?pretty"
查表里的数据
curl -XGET 'http://192.168.56.91:9200/db_customer/tb_test/_search?pretty'
删除索引
curl -XDELETE 'http://192.168.1.118:9200/db_customer?pretty'
查看mapping的设置
curl -H "Content-Type: application/json" -XGET "http://192.168.1.85:9200/db_customer01/_mappings?pretty=true"
查找某个字段
curl -u elastic:elastic -X GET "192.168.1.85:9200/index_publications/_mapping/_doc/field/title?pretty=true"
添加字段
curl -u elastic:elastic -X PUT "192.168.1.108:19200/app_message_all_date/_mapping/_doc?pretty" -H 'Content-Type: application/json' -d'
{
"properties": {
"email": {
"type": "keyword"
}
}
}
'
-----------------------------------------------------------------用户角色相关------------------------------------------------------------------------
6.8.5版本
添加自定义用户
添加用户
./elasticsearch-users useradd hxl -p 123456 -r superuser
查看用户
./elasticsearch-users list
curl -u hxl:123456 http://192.168.1.63:19200/?pretty
或者是这样查看
查看es的下的用户
curl -u elastic:sdr123 -X GET "http://192.168.1.69:19200/_security/user?pretty"
创建角色
hxlrole只有对包含hxl的index有所有权限
curl -XPOST -u hxl:123456 '192.168.1.63:19200/_xpack/security/role/hxlrole' -H "Content-Type: application/json" -d '{"cluster":["all"],"indices":[{"names":["hxl*"],"privileges":["all"]}]}'
查看刚才创建的角色
curl -XGET -u hxl:123456 '192.168.1.63:19200/_xpack/security/role/hxlrole?pretty'
{
"hxlrole" : {
"cluster" : [
"all"
],
"indices" : [
{
"names" : [
"hxl*"
],
"privileges" : [
"all"
],
"allow_restricted_indices" : false
}
],
"applications" : [ ],
"run_as" : [ ],
"metadata" : { },
"transient_metadata" : {
"enabled" : true
}
}
}
创建只读角色(对所有的index可读)
curl -u elastic:elastic -XPOST '192.168.56.111:19200/_xpack/security/role/role_readonly' -H "Content-Type: application/json" -d '{"cluster":["all"],"indices":[{"names":["*"],"privileges":["read","view_index_metadata","monitor"]}]}'
创建用户，角色就是上面创建的只读角色
curl -u elastic:elastic -X POST "192.168.56.111:19200/_security/user/hxlreadonly?pretty" -H 'Content-Type: application/json' -d'
{
"password" : "123456",
"roles" : [ "role_readonly" ],
"full_name" : "Jack Nicholson",
"email" : "jacknich@example.com",
"metadata" : {
"intelligence" : 7
}
}'
查看用户
curl -u elastic:elastic -X GET "192.168.56.111:19200/_security/user/hxlreadonly?pretty"
1.创建角色,该角色拥有以hxl开头,hz开头的所有权限,下面的登陆用户hxl是超级用户
curl -X POST -u hxl:123456 "192.168.1.63:19200/_xpack/security/role/myrole?pretty" -H 'Content-Type: application/json' -d'
{
"cluster": ["all"],
"indices": [
{
"names": [ "hxl*", "hz*" ],
"privileges": ["all"],
"allow_restricted_indices" : true ##看情况加上,默认是false
}
]
}'
2.查看角色
$ curl -XGET -u hxl:123456 '192.168.1.63:19200/_xpack/security/role/myrole?pretty'
{
"myrole" : {
"cluster" : [
"all"
],
"indices" : [
{
"names" : [
"hxl*",
"hz*",
"jf*"
],
"privileges" : [
"all"
],
"allow_restricted_indices" : false
}
],
"applications" : [ ],
"run_as" : [ ],
"metadata" : { },
"transient_metadata" : {
"enabled" : true
}
}
}
3.创建用户,并把刚才创建的角色赋予该用户
cd /usr/local/services/elasticsearch/bin
[hxl@hadoop-slave1 bin]$ ./elasticsearch-users useradd hxl03 -p 123456 -r myrole
Warning: The following roles [myrole] are not in the [/usr/local/services/elasticsearch/config/roles.yml] file. Make sure the names are correct. If the names are correct and the roles were created using the API please disregard this message. Nonetheless the user will still be associated with all specified roles
Known roles: [kibana_dashboard_only_user, apm_system, watcher_admin, logstash_system, rollup_user, kibana_user, machine_learning_user, beats_admin, remote_monitoring_agent, machine_learning_admin, watcher_user, rollup_admin, snapshot_user, monitoring_user, beats_system, reporting_user, kibana_system, logstash_admin, transport_client, remote_monitoring_collector, superuser, ingest_admin]
[hxl@hadoop-slave1 bin]$
好像使用该api不能定义自己创建的角色
使用另外一种方式创建用户
curl -u hxl:123456 -X POST "192.168.1.63:19200/_security/user/uhxl?pretty" -H 'Content-Type: application/json' -d'
{
"password" : "123456",
"roles" : [ "myrole" ],
"full_name" : "Jack Nicholson",
"email" : "jacknich@example.com",
"metadata" : {
"intelligence" : 7
}
}'
查看用户
curl -u hxl:123456 -X GET "192.168.1.63:19200/_security/user/uhxl?pretty"
curl -u hxl:123456 -X GET "192.168.1.63:19200/_security/user/uhxl?pretty"
{
"uhxl" : {
"username" : "uhxl",
"roles" : [
"myrole"
],
"full_name" : "Jack Nicholson",
"email" : "jacknich@example.com",
"metadata" : {
"intelligence" : 7
},
"enabled" : true
}
}
使用新创建的用户执行相应命令
curl -u uhxl:123456 http://192.168.1.63:19200/?pretty
4.修改角色
在之前的角色加上拥有jf开头的索引
curl -X POST -u hxl:123456 "192.168.1.63:19200/_xpack/security/role/myrole?pretty" -H 'Content-Type: application/json' -d'
{
"cluster": ["all"],
"indices": [
{
"names": [ "hxl*", "hz*","jf*" ],
"privileges": ["all"]
}
]
}'
5.用户修改角色
这里加上角色myrole01
curl -X POST -u hxl:123456 "192.168.1.63:19200/_xpack/security/role/myrole01?pretty" -H 'Content-Type: application/json' -d'
{
"cluster": ["all"],
"indices": [
{
"names": [ "kk*", "hz*","jf*" ],
"privileges": ["all"],
"allow_restricted_indices" : true ##看情况加上,默认是false
}
]
}'
curl -u hxl:123456 -X POST "192.168.1.63:19200/_security/user/uhxl?pretty" -H 'Content-Type: application/json' -d'
{
"password" : "123456",
"roles" : [ "myrole","myrole01" ],
"full_name" : "Jack Nicholson",
"email" : "jacknich@example.com",
"metadata" : {
"intelligence" : 7
}
}'
6.查看所有的角色
curl -u hxl:123456 -X GET "192.168.1.63:19200/_xpack/security/role?pretty"
8.0版本
curl -u elastic:elastic -X GET "192.168.1.134:19200/_security/role?pretty"
9.修改密码
curl -H "Content-Type:application/json" -XPUT -u elastic:sdr123 'http://192.168.1.134:19200/_xpack/security/user/elastic/_password' -d '{ "password" : "elastic" }'
-----------------------------------------------------------------------------------------------------------------------------------------------
查看备份设置
curl -u elastic:testtest -X GET "10.7.81.130:19200/_snapshot/esbackup?pretty"
查看所有的备份
curl -u elastic:testtest -X GET "10.7.81.130:19200/_snapshot/esbackup/_all?pretty"
curl -u elastic:testtest -X GET "10.7.81.130:19200/_snapshot/esbackup/_all?pretty"
查看索引的记录总数
curl -H "Content-Type: application/json" -XGET 'http://192.168.1.135:19200/_cat/count/metric?v&format=json&pretty'
查询符合条件的记录数
curl -H "Content-Type: application/json" -XPOST 'http://192.168.1.135:19200/metric_pl/_count?pretty' -d '
{
"query": { "match": {"month": "2022-03-25"} }
}'
更新符合条件的记录
curl -H "Content-Type: application/json" -XPOST 'http://192.168.1.135:19200/metric_pl/_update_by_query?pretty' -d '
{
"query": { "match": {"month": "2022-03-25"} },
"script": {
"source": "ctx._source.rt =777"
}
}'
将月份month=2022-03-25 的记录 rt字段更新为777
###############################性能部分####################################
1.查看什么线程在消耗CPU
curl -u elastic:123456 -X GET "192.168.1.69:19200/_nodes/hot_threads?pretty=true"
2.查看磁盘空间使用率
curl -u elastic:密码 -X GET "192.168.1.69:19200/_cat/allocation?v"
3.查看分片情况:
curl -u elastic:123456 -X GET "ip:9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason?v"
4.分片具体原因:
curl -u elastic:123456 -X GET "ip:9200/_cluster/allocation/explain?pretty"
