ELK之elasticsearch6.5
官方网站:https://www.elastic.co/guide/en/elasticsearch/reference/current/rpm.html
这里采用rpm的方式安装:
# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.5.4.rpm
elasticsearch依赖java环境,于是在安装之前需要配置java:
# rpm -ivh jdk-8u191-linux-x64.rpm # java -version
java环境安装完成后,安装elasticsearch:
# rpm --install elasticsearch-6.5.4.rpm
elasticsearch的配置文件:
[root@node1 ~]# cd /etc/elasticsearch/ [root@node1 elasticsearch]# ll 总用量 36 -rw-rw----. 1 root elasticsearch 207 12月 23 18:04 elasticsearch.keystore -rw-rw----. 1 root elasticsearch 2869 12月 18 05:21 elasticsearch.yml -rw-rw----. 1 root elasticsearch 3266 12月 18 05:21 jvm.options -rw-rw----. 1 root elasticsearch 12423 12月 18 05:21 log4j2.properties -rw-rw----. 1 root elasticsearch 473 12月 18 05:21 role_mapping.yml -rw-rw----. 1 root elasticsearch 197 12月 18 05:21 roles.yml -rw-rw----. 1 root elasticsearch 0 12月 18 05:21 users -rw-rw----. 1 root elasticsearch 0 12月 18 05:21 users_roles
如果需要修改jvm参数,调整jvm.options这个配置文件就行:默认配置为1g
[root@node1 elasticsearch]# egrep "^-Xms|^-Xmx" jvm.options -Xms1g -Xmx1g
现在将elasticsearch做一下简单的配置如下:
[root@node1 elasticsearch]# egrep -v "^$|^#" elasticsearch.yml cluster.name: es 集群的名字 node.name: node1 节点的名字 path.data: /var/lib/elasticsearch 数据目录 path.logs: /var/log/elasticsearch 日志目录 network.host: 0.0.0.0 服务监听的ip http.port: 9200 服务监听的端口
然后启动elasticsearch服务:
# systemctl daemon-reload # systemctl enable elasticsearch.service # systemctl start elasticsearch.service # systemctl status elasticsearch.service
查看监听状态:
[root@node1 elasticsearch]# netstat -tnlp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 968/sshd tcp6 0 0 :::9200 :::* LISTEN 2756/java tcp6 0 0 :::9300 :::* LISTEN 2756/java tcp6 0 0 :::22 :::* LISTEN 968/sshd
于是单节点的elasticsearch服务配置完成,现在做一些curl的操作,熟悉elasticsearch的一些查询:
1.关于cat API的使用:
[root@node1 elasticsearch]# curl -X GET "localhost:9200/_cat/nodes" 172.16.23.129 32 68 0 0.00 0.04 0.05 mdi * node1 [root@node1 elasticsearch]# curl -X GET "localhost:9200/_cat/nodes?v" ip heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name 172.16.23.129 28 68 2 0.02 0.07 0.05 mdi * node1
由于es集群只有一个节点,所以节点node1也是master节点:
[root@node1 elasticsearch]# curl -X GET "localhost:9200/_cat/master?v" id host ip node q95yZ4W4Tj6PaXyzLZZYDQ 172.16.23.129 172.16.23.129 node1
然后可以根据指定的字段获取结果:
[root@node1 elasticsearch]# curl -X GET "localhost:9200/_cat/nodes?v&h=id,ip,port,v,m" id ip port v m q95y 172.16.23.129 9300 6.5.4 *
指定的字段格式为:h=colume即可:这里的h代表为header
[root@node1 elasticsearch]# curl -X GET "localhost:9200/_cat/nodes?v&h=ram.percent"
ram.percent
69
具体header后面可以过滤哪些colume,请查看官网:https://www.elastic.co/guide/en/elasticsearch/reference/current/cat-nodes.html
查看health:
[root@node1 elasticsearch]# curl -X GET "localhost:9200/_cat/health?v" epoch timestamp cluster status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent 1545561036 10:30:36 es green 1 1 0 0 0 0 0 0 - 100.0%
elasticsearch下重要的index:
[root@node1 elasticsearch]# curl -X GET "localhost:9200/_cat/indices?v" health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
由上面返回结果来看,是没有数据的,表示es这个集群并没有构建索引
2.关于indices API的使用:
2.1创建一个index:
# curl -X PUT "localhost:9200/test1" 创建的索引全部以默认值,默认的shard等等
查看这个index:
[root@node1 elasticsearch]# curl -X GET "localhost:9200/_cat/indices?v" health status index uuid pri rep docs.count docs.deleted store.size pri.store.size yellow open test1 KqGrTZ7GQv6o5jEQPK-wwA 5 1 0 0 1.1kb 1.1kb
创建的index拥有默认的shards个数,5个,可以通过将indeices换为shards进行查看
查看索引test1的具体的默认配置,获取索引test1:
[root@node1 elasticsearch]# curl -X GET "localhost:9200/test1"
{"test1":{"aliases":{},"mappings":{},"settings":{"index":{"creation_date":"1545561578119","number_of_shards":"5","number_of_replicas":"1","uuid":"KqGrTZ7GQv6o5jEQPK-wwA","version":{"created":"6050499"},"provided_name":"test1"}}}}[root@node1 elasticsearch]#
由于上面的结果不利于查看,于是使用python的json工具转化一下:
[root@node1 elasticsearch]# curl -X GET "localhost:9200/test1" |python -m json.tool
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 229 100 229 0 0 6870 0 --:--:-- --:--:-- --:--:-- 7387
{
"test1": {
"aliases": {},
"mappings": {},
"settings": {
"index": {
"creation_date": "1545561578119",
"number_of_replicas": "1",
"number_of_shards": "5",
"provided_name": "test1",
"uuid": "KqGrTZ7GQv6o5jEQPK-wwA",
"version": {
"created": "6050499"
}
}
}
}
}
可以看见上面依然显示不是很友好,有下载的状态,curl的参数-s静默输出:
[root@node1 elasticsearch]# curl -X GET "localhost:9200/test1" -s|python -m json.tool
{
"test1": {
"aliases": {},
"mappings": {},
"settings": {
"index": {
"creation_date": "1545561578119",
"number_of_replicas": "1",
"number_of_shards": "5",
"provided_name": "test1",
"uuid": "KqGrTZ7GQv6o5jEQPK-wwA",
"version": {
"created": "6050499"
}
}
}
}
}
可以看出索引test1的shards数为5个,replicas数为1个等等信息
获取索引test1中结果的某指定字段:
[root@node1 elasticsearch]# curl -X GET "localhost:9200/test1/_settings" -s|python -m json.tool
{
"test1": {
"settings": {
"index": {
"creation_date": "1545561578119",
"number_of_replicas": "1",
"number_of_shards": "5",
"provided_name": "test1",
"uuid": "KqGrTZ7GQv6o5jEQPK-wwA",
"version": {
"created": "6050499"
}
}
}
}
}
[root@node1 elasticsearch]# curl -X GET "localhost:9200/test1/_mappings" -s|python -m json.tool
{
"test1": {
"mappings": {}
}
}
2.2删除索引
[root@node1 elasticsearch]# curl -X DELETE "localhost:9200/test1"
{"acknowledged":true}[root@node1 elasticsearch]#
3._cluster API查询:
[root@node1 elasticsearch]# curl -X GET "localhost:9200/_cluster/health" -s |python -m json.tool
{
"active_primary_shards": 5,
"active_shards": 5,
"active_shards_percent_as_number": 50.0,
"cluster_name": "es",
"delayed_unassigned_shards": 0,
"initializing_shards": 0,
"number_of_data_nodes": 1,
"number_of_in_flight_fetch": 0,
"number_of_nodes": 1,
"number_of_pending_tasks": 0,
"relocating_shards": 0,
"status": "yellow",
"task_max_waiting_in_queue_millis": 0,
"timed_out": false,
"unassigned_shards": 5
}
[root@node1 elasticsearch]# curl -X GET "localhost:9200/_cluster/health/test1" -s |python -m json.tool
{
"active_primary_shards": 5,
"active_shards": 5,
"active_shards_percent_as_number": 50.0,
"cluster_name": "es",
"delayed_unassigned_shards": 0,
"initializing_shards": 0,
"number_of_data_nodes": 1,
"number_of_in_flight_fetch": 0,
"number_of_nodes": 1,
"number_of_pending_tasks": 0,
"relocating_shards": 0,
"status": "yellow",
"task_max_waiting_in_queue_millis": 0,
"timed_out": false,
"unassigned_shards": 5
}
[root@node1 elasticsearch]# curl -X GET "localhost:9200/_cluster/health/test1?level=shards" -s |python -m json.tool
如果不想-s |python -m json.tool,那么还有一种方式格式化输出:
[root@node1 elasticsearch]# curl -X GET "localhost:9200/test1?human&pretty"
{
"test1" : {
"aliases" : { },
"mappings" : { },
"settings" : {
"index" : {
"creation_date_string" : "2018-12-23T11:04:48.982Z",
"number_of_shards" : "5",
"provided_name" : "test1",
"creation_date" : "1545563088982",
"number_of_replicas" : "1",
"uuid" : "ZAjj9y_sSPmGz8ZscIXUsA",
"version" : {
"created_string" : "6.5.4",
"created" : "6050499"
}
}
}
}
}
需要在后面加上?human&pretty
或者直接在后面加上?pretty:
[root@master ~]# curl -XGET localhost:9200/_cluster/health?pretty
{
"cluster_name" : "estest",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 3,
"number_of_data_nodes" : 3,
"active_primary_shards" : 5,
"active_shards" : 10,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
