Elasticsearch滚动索引

随着业务支撑，es中日志索引中数据越来越大，查询效率下降，TB基本数据必须要对索引进行优化，优化第一步就是滚动索引

创建索引模板

PUT http://ip:9200/_template/test_idx_tpl

{
    "settings": {
      "index": {
        "lifecycle": {
          "name": "test_idx_life_cycle",
          "rollover_alias": "test_idx_write_alias"
        },
        "routing": {
          "allocation": {
            "include": {
              "_tier_preference": "data_content"
            }
          }
        },
        "analysis": {
          "analyzer": {
            "ip_analyzer": {
              "pattern": "[.]",
              "type": "pattern"
            }
          }
        },
        "number_of_shards": "6",
        "number_of_replicas": "0"
      }
    },
    "mappings": {
      "dynamic_templates": [],
      "properties": {
        "end_time": {
          "type": "date",
          "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_second"
        },
        "reuslt": {
          "type": "text"
        },
        "atime": {
          "type": "date",
          "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_second"
        },
        "protocol": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        }
      }
    },
    "aliases": {
      "test_idx_alias": {}
    }
  }