标签: elastic-stack

我正在运行 ElasticSearch 版本 6.2.3，并且我将文件中的堆大小增加到 4GB config\jvm.options。然后重新启动我的 ES，我如何确保我的 ES 正在使用修改后的堆大小运行。有没有命令可以验证ES的堆大小。

我正在 Windows 机器上运行我的 ES。

请找到我的配置详细信息。

## JVM configuration

################################################################
## IMPORTANT: JVM heap size
################################################################
##
## You should always set the min and max JVM heap
## size to the same value. For example, to set
## the heap to 4 GB, set:
##
## -Xms2g
## -Xmx2g
##
## See https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html
## for more information
##
################################################################

# Xms represents the initial size of total heap space
# …

我正在运行ELK 堆栈的实现，它非常简单且易于配置。

我可以使用 netcat 将 TCP 输入推送到堆栈，如下所示：

nc localhost 5000 < /Users/me/path/to/logs/appOne.log
nc localhost 5000 < /Users/me/path/to/logs/appOneStackTrace.log
nc localhost 5000 < /Users/me/path/to/logs/appTwo.log
nc localhost 5000 < /Users/me/path/to/logs/appTwoStackTrace.log

但我无法让 Logstash 读取我在配置中指定的文件路径：

input {
        tcp {
        port => 5000
    }

        file {
                path => [
                    "/Users/me/path/to/logs/appOne.log",
                    "/Users/me/path/to/logs/appOneStackTrace.log",
                    "/Users/me/path/to/logs/appTwo.log",
                    "/Users/me/path/to/logs/appTwoStackTrace.log"
                ]
                type => "log"
                start_position => "beginning"
        }
}

output {
    elasticsearch {
        hosts => "elasticsearch:9200"
    }
}

以下是有关 Logstash 输入的堆栈的启动输出：

logstash_1       | [2019-01-28T17:44:33,206][INFO ][logstash.inputs.tcp      ] Starting tcp input listener {:address=>"0.0.0.0:5000", …

Elasticsearch 官方文档中有这样写Any reserved character can be escaped with a backslash "\*" including a literal backslash character: "\\"。

你能解释一下为什么这样查询吗

{
                    "query": {
                        "bool": {
                            "must": [
                                {
                                    "regexp": {
                                        "path": ".*test\/test.txt.*"
                                    }
                                },
                                {
                                    "match": {
                                        "user_id": 1
                                    }
                                }
                            ]
                        }
                    }
                }

找不到这样的索引

{
                "_index": "pictures",
                "_type": "picture",
                "_id": "wiskQ2kBi923Omj4U",
                "_score": 1,
                "_source": {
                    "user_id": 1,
                    "tag": [],
                    "text": "some text",
                    "path": "test/test.txt"
                }
            }

我正在使用高级 java rest 客户端（6.5），我需要根据某个日期范围过滤数据-让，我在同一索引中有这 4 个文档（添加了邮递员图像），而在 2 个文档中我没有 publish_date和 publish_end_date 字段，所以当我放置一个范围时，我需要介于这些范围和没有这些范围字段的文档之间的文档。

JSON 值

我从这个问题中得到了一些帮助 - 在 startDate 和 endDate 之间的 ElasticSearch (2.2) Java 过滤器如果存在，因为不推荐使用QueryBuilders.missingQuery所以我使用mustNot(QueryBuilders.existsQuery)通过从这里获取参考但它不起作用，我我没有得到结果。

当我只使用如下所示的范围查询时，它的工作正常 -

BoolQueryBuilder startDateQuery = new BoolQueryBuilder()
           .must(QueryBuilders.rangeQuery("publish_date").lte("now"));
BoolQueryBuilder endDateQuery = new BoolQueryBuilder()
          .must(QueryBuilders.rangeQuery("publish_end_date").gte("now"));

当我只使用如下所示的 mustNot 查询时，我得到了想要的结果-

BoolQueryBuilder startDateQuery = new BoolQueryBuilder()
           .mustNot(QueryBuilders.existsQuery("publish_date"));
BoolQueryBuilder endDateQuery = new BoolQueryBuilder()
          .mustNot(QueryBuilders.existsQuery("publish_end_date"));

但问题是当我结合下面的两个查询时，我没有得到任何结果（得到一个空数组）-

BoolQueryBuilder startDateQuery = new BoolQueryBuilder()
           .must(QueryBuilders.rangeQuery("publish_date").lte("now"))
           .mustNot(QueryBuilders.existsQuery("publish_date"));
BoolQueryBuilder endDateQuery = new BoolQueryBuilder()
          .must(QueryBuilders.rangeQuery("publish_end_date").gte("now"))
          .mustNot(QueryBuilders.existsQuery("publish_end_date"));

我想要结果 3 中的所有 …

我可以通过传递索引名称、类型和 id 来删除文档，如下所示-

DeleteRequest deleteRequest = new DeleteRequest(data.getIndexName(),data.getType(),data.getUniqueId());

    DeleteResponse deleteResponse = client.delete(deleteRequest);

但是当我尝试通过仅给出索引名称来删除索引时，如下所示-（根据本文档）

DeleteRequest deleteRequest = new DeleteRequest(allData.getIndexName());

    DeleteResponse deleteResponse = client.delete(deleteRequest);

得到-

org.elasticsearch.action.ActionRequestValidationException: Validation Failed: 1: type is missing;2: id is missing;

我尝试过类似的另一种方法（参考）

DeleteIndexRequest request = new DeleteIndexRequest(allData.getIndexName());
    AcknowledgedResponse deleteIndexResponse = client.indices().delete(request, RequestOptions.DEFAULT);

得到：

java.lang.NoSuchMethodError: 
at org.elasticsearch.client.IndicesClient.delete(IndicesClient.java:93) ~[elasticsearch-rest-high-level-client-6.5.4.jar:6.4.3]

我正在使用这个依赖项：

<dependency>
       <groupId>org.elasticsearch.client</groupId>
       <artifactId>elasticsearch-rest-high-level-client</artifactId>
       <version>6.5.4</version>
</dependency>

mvn依赖：树

[INFO] \- org.elasticsearch.client:elasticsearch-rest-high-level- 
client:jar:6.5.4:compile
[INFO]    +- org.elasticsearch:elasticsearch:jar:6.4.3:compile
[INFO]    |  +- org.elasticsearch:elasticsearch-core:jar:6.4.3:compile
[INFO]    |  +- org.elasticsearch:elasticsearch-secure- 
sm:jar:6.4.3:compile
[INFO]    |  +- org.elasticsearch:elasticsearch-x- …

我正在尝试使用 ELK 来可视化我的日志文件。我尝试了不同的设置：

1. Logstash 文件输入插件https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html
2. Logstash Beats 输入插件https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html带有 Filebeat Logstash 输出https://www.elastic.co/guide/en/beats/filebeat /current/logstash-output.html
3. Filebeat Elasticsearch 输出https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html

有人可以列出他们的差异以及何时使用哪种设置？如果不是这里，请把我指向正确的地方，比如超级用户或 DevOp 或服务器故障。

我的 ElasticSearch 6.5.2 索引看起来像：

      {
    "_index" : "searches",
    "_type" : "searches",
    "_id" : "cCYuHW4BvwH6Y3jL87ul",
    "_score" : 1.0,
    "_source" : {
      "querySearched" : "telecom",
    }
  },
  {
    "_index" : "searches",
    "_type" : "searches",
    "_id" : "cSYuHW4BvwH6Y3jL_Lvt",
    "_score" : 1.0,
    "_source" : {
      "querySearched" : "telecom",
    }
  },
  {
    "_index" : "searches",
    "_type" : "searches",
    "_id" : "eCb6O24BvwH6Y3jLP7tM",
    "_score" : 1.0,
    "_source" : {
      "querySearched" : "industry",
    }

我想要一个返回这个结果的查询：

"result": 
{
"querySearched" : "telecom",
"number" : 2
},
{
"querySearched" : "industry", …

我收到警报，指出 elasticsearch 有 2 个未分配的分片。我进行了以下 api 调用以收集更多详细信息。

    curl -s http://localhost:9200/_cluster/allocation/explain | python -m json.tool

下面的输出

    "allocate_explanation": "cannot allocate because allocation is not permitted to any of the nodes",
    "can_allocate": "no",
    "current_state": "unassigned",
    "index": "docs_0_1603929645264",
    "node_allocation_decisions": [
        {
            "deciders": [
                {
                    "decider": "max_retry",
                    "decision": "NO",
                    "explanation": "shard has exceeded the maximum number of retries [5] on failed allocation attempts - manually call [/_cluster/reroute?retry_failed=true] to retry, [unassigned_info[[reason=ALLOCATION_FAILED], at[2020-10-30T06:10:16.305Z], failed_attempts[5], delayed=false, details[failed shard on node [o_9jyrmOSca9T12J4bY0Nw]: failed recovery, failure RecoveryFailedException[[docs_0_1603929645264][0]: Recovery failed from …