elasticsearch5.0.1集群排错的几个思路总结

1.首先查看集群整体健康状态

# curl -XGET http://10.27.35.94:9200/_cluster/health?pretty
{
"cluster_name" : "yunva-es",
"status" : "red",
"timed_out" : false,
"number_of_nodes" : ,
"number_of_data_nodes" : ,
"active_primary_shards" : ,
"active_shards" : ,
"relocating_shards" : ,
"initializing_shards" : ,
"unassigned_shards" : ,
"delayed_unassigned_shards" : ,
"number_of_pending_tasks" : ,
"number_of_in_flight_fetch" : ,
"task_max_waiting_in_queue_millis" : ,
"active_shards_percent_as_number" : 86.26373626373626
}

如果是red状态，说明有节点挂掉，找到挂掉的索引分片和节点

如下例子，可以看到 voice:live:logout 这个索引的0分片都没有分配说明挂掉了，我们可以查看之前正常的时候的分片情况(可以定期将分片的分配情况记录下来)

# curl 10.26.241.237:/_cat/shards
....
voice:live:logout  p STARTED  .9kb 10.27.65.121 yunva_etl_es6
voice:live:logout  r STARTED  .9kb 10.26.241.239 yunva_etl_es3
voice:live:logout  r STARTED  .8kb 10.45.150.115 yunva_etl_es9
voice:live:logout  p STARTED  .8kb 10.25.177.47 yunva_etl_es11
voice:live:logout  p STARTED  .7kb 10.26.241.239 yunva_etl_es3
voice:live:logout  r STARTED  .7kb 10.25.177.47 yunva_etl_es11
voice:live:logout  p STARTED  .2kb 10.27.35.94 yunva_etl_es7
voice:live:logout  r STARTED  .2kb 10.27.78.228 yunva_etl_es5
voice:live:logout 0 p UNASSIGNED
voice:live:logout 0 r UNASSIGNED

定期记录分片的脚本

# cat es_shard.sh
#!/bin/bash

echo $(date +"%Y-%m-%d %H:%M:%S") >> /data/es_shards.txt
curl -XGET http://10.26.241.237:9200/_cat/shards >> /data/es_shards.txt

2.依次查询节点的健康状态，如果哪个节点不返回，或者很慢，可能是内存溢出，需要直接重启该节点

# curl -XGET http://IP:9200/_cluster/health?pretty

内存溢出的典型特征会在elasticsearch/bin目录下产生类似如下文件:

hs_err_pid27186.log
java_pid1151.hprof

3.zabbix添加监控
①如果挂掉自动启动(注意不能是root用户)

自动启动elasticsearch脚本：

# cat /usr/local/zabbix-agent/scripts/start_es.sh

#!/bin/bash
# if elasticsearch process exists kill it
source /etc/profile

count_es=`ps -ef|grep elasticsearch|grep -v grep|wc -l`
if [ $count_es -gt  ];then
ps -ef|grep elasticsearch|grep -v grep|/bin/kill `awk '{print $2}'`
fi
rm -f /data/elasticsearch-5.0./bin/java_pid*.hprof
# start it
su yunva -c "cd /data/elasticsearch-5.0.1/bin && /bin/bash elasticsearch &"

②有hs_err*.log或者hprof文件删除文件然后重启该节点(可以直接触发start_es.sh脚本)

elasticsearch报错监控项:
UserParameter=es_debug,sudo /bin/find /data/elasticsearch-5.0.1/bin/ -name hs_err_pid*.log -o -name java_pid*.hprof|wc -l

java报错的监控项：

UserParameter=java_error,sudo /bin/find /home -name hs_err_pid*.log -o -name java_pid*.hprof -o -name jvm.log|wc -l

③curl -XGET http://IP:9200/_cluster/health?pretty 如果响应时间超过30S重启

for IP in 10.28.50.131 10.26.241.239 10.25.135.215 10.26.241.237 10.27.78.228 10.27.65.121 10.27.35.94 10.30.136.143 10.174.12.230 10.45.150.115 10.25.177.47
do
curl -XGET http://$IP:9200/_cluster/health?pretty
done

4.优化配置：

# 以下配置可以减少当es节点短时间宕机或重启时shards重新分布带来的磁盘io读写浪费

discovery.zen.fd.ping_timeout: 300s
discovery.zen.fd.ping_retries:
discovery.zen.fd.ping_interval: 30s
discovery.zen.ping_timeout: 300s

5.es集群状态检测
UserParameter=es_cluster_status,curl -sXGET http://10.11.117.18:9200/_cluster/health/?pretty | grep "status"|awk -F '[ "]+' '{print $4}'|grep -c 'green'

后续如果有其他方面的一些好的方法也会更新上来

索引修改以后，需要刷新index表达式，否则无法正常识别