elasticsearch常用操作

查看集群的状态

curl -s -u elastic:password -X GET http://{{host}}:9200/_cluster/health?pretty=true
{
  "cluster_name" : "es",
  "status" : "yellow",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "active_primary_shards" : 204,
  "active_shards" : 204,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 181,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 52.98701298701298
}

状态说明：

• red：表示状态集群不可用，表示主分片的数据不完整，通常由于某个索引的主分片为unssigned，需要针对分片未分配的具体原因进行解决。
• yellow：表示所有主分片可用，但副本分片不完整，最常见的场景是部署单节点时，由于ES默认有一个副本，主分片和副本不能在同一个节点上，所以副本就是unassigned状态。

查看分片未分配的具体原因

curl -s -u elastic:password -X GET http://{{host}}:9200/_cluster/allocation/explain?pretty
{
  "note" : "No shard was specified in the explain API request, so this response explains a randomly chosen unassigned shard. There may be other unassigned shards in this cluster which cannot be assigned for different reasons. It may not be possible to assign this shard until one of the other shards is assigned correctly. To explain the allocation of other shards (whether assigned or unassigned) you must specify the target shard in the request to this API.",
  "index" : "2022-09-19",
  "shard" : 0,
  "primary" : false,
  "current_state" : "unassigned",
  "unassigned_info" : {
    "reason" : "CLUSTER_RECOVERED",
    "at" : "2022-10-24T06:43:35.247Z",
    "last_allocation_status" : "no_attempt"
  },
  "can_allocate" : "no",
  "allocate_explanation" : "cannot allocate because allocation is not permitted to any of the nodes",
  "node_allocation_decisions" : [
    {
      "node_id" : "Nd92ablSRhqhD7E04Q9URg",
      "node_name" : "elasticsearch-0",
      "transport_address" : "122.20.3.18:9300",
      "node_attributes" : {
        "ml.machine_memory" : "16656502784",
        "xpack.installed" : "true",
        "transform.node" : "true",
        "ml.max_open_jobs" : "512",
        "ml.max_jvm_size" : "1073741824",
        "tag" : "cold"
      },
      "node_decision" : "no",
      "deciders" : [
        {
          "decider" : "same_shard",
          "decision" : "NO",
          "explanation" : "a copy of this shard is already allocated to this node [[2022-09-19][0], node[Nd92ablSRhqhD7E04Q9URg], [P], s[STARTED], a[id=uFsMaIF8Rgq-BxrplZqSSQ]]"
        },
        {
          "decider" : "shards_limit",
          "decision" : "NO",
          "explanation" : "too many shards [1] allocated to this node for index [2022-09-19], index setting [index.routing.allocation.total_shards_per_node=1]"
        }
      ]
    }
  ]
}

这种情况，我们一般做法是删除对应的indice（生产环境谨慎操作）

# 查看UNASSIGNED的indices
curl -s -u elastic:password -X GET http://{{host}}9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason |grep UNASSIGNED
# 删除UNASSIGNED的indices
curl -s -u  elastic:password -X DELETE http://$BK_ES7_IP:9200/$indices_name/

这里以上面的一种示例进行说明，可以看出返回的原因为集群默认的index.routing.allocation.total_shards_per_node=1，单个节点上最大能分配的分片是1个，导致此节点上无法分配额外的分片，副本分片缺失，集群状态为yellow。
这里有集群状态原因的常见几种reason说明：

* INDEX_CREATED：由于创建索引的API导致未分配。
* CLUSTER_RECOVERED ：由于完全集群恢复导致未分配。
* INDEX_REOPENED ：由于打开open或关闭close一个索引导致未分配。
* DANGLING_INDEX_IMPORTED ：由于导入dangling索引的结果导致未分配。
* NEW_INDEX_RESTORED ：由于恢复到新索引导致未分配。
* EXISTING_INDEX_RESTORED ：由于恢复到已关闭的索引导致未分配。
* REPLICA_ADDED：由于显式添加副本分片导致未分配。
* ALLOCATION_FAILED ：由于分片分配失败导致未分配。
* NODE_LEFT ：由于承载该分片的节点离开集群导致未分配。
* REINITIALIZED ：由于当分片从开始移动到初始化时导致未分配（例如，使用影子shadow副本分片）。
* REROUTE_CANCELLED ：作为显式取消重新路由命令的结果取消分配。
* REALLOCATED_REPLICA ：确定更好的副本位置被标定使用，导致现有的副本分配被取消，出现未分配

查看某个索引的数据

curl -s -u  elastic:password -XGET http://$BK_ES7_IP:9200/$indices_name/_search | jq .