Openshift中集群ElasticSearch的运维

大家都知道，Openshift集成了EFK(Elasticsearch + Fluentd + Kibana)作为集群的日志管理平台。我们该怎样去维护ElasticSearch.

1. 找到ES所在的pod

oc get pod -l component=es -o name -n logging | cut -d/ -f2

2. 查看所有ES索引

oc exec $es-pod-name -- curl -s --cert /etc/elasticsearch/secret/admin-cert --key /etc/elasticsearch/secret/admin-key --cacert /etc/elasticsearch/secret/admin-ca https://localhost:9200/_cat/indices?v

3. 清理所有3月份的ES索引

oc exec $es-pod-name -- curl -s --cert /etc/elasticsearch/secret/admin-cert --key /etc/elasticsearch/secret/admin-key --cacert /etc/elasticsearch/secret/admin-ca -XDELETE https://localhost:9200/*.2018.03.*

curl可以加-k这样就不需要--cacert参数

4. 打开Kibana，显示错误Elasticsearch is still initializing the kibana index
   解决办法：删除kibana的索引，重新进入kibana

oc exec $es-pod-name -- curl -s --cert /etc/elasticsearch/secret/admin-cert --key /etc/elasticsearch/secret/admin-key --cacert /etc/elasticsearch/secret/admin-ca -XDELETE https://localhost:9200/.kibana

5. 确认ES集群的工作状态

$ oc exec $es-pod-name -c elasticsearch -- health

6. 停止ES节点分片平衡

$ oc exec $es-pod-name -c elasticsearch -- curl --cert /etc/elasticsearch/secret/admin-cert --key /etc/elasticsearch/secret/admin-key --cacert /etc/elasticsearch/secret/admin-ca -XPUT https://localhost:9200/_cluster/settings -d '{"transient": {"cluster.routing.allocation.enable":"none"}}'

6.开启ES节点分片平衡

$ oc exec $es-pod-name -c elasticsearch -- curl --cert /etc/elasticsearch/secret/admin-cert --key /etc/elasticsearch/secret/admin-key --cacert /etc/elasticsearch/secret/admin-ca -XPUT https://localhost:9200/_cluster/settings -d '{"transient": {"cluster.routing.allocation.enable":"all"}}'

7. ES扩容

OpenShift自带的日志搜索引擎ES服务的扩容