我有 6 个节点集群 3 个主节点,3 个数据节点,并且在 3 个数据节点中我设置了 node.attr.data:warm。它工作正常,但我们认为我们应该添加两个 elasticsearch 节点在同一个集群中,但它们与node.attr.data:warm等其他节点具有不同的属性。我现在面临的问题是索引也分散在温暖的节点中,并且根据warm的定义节点 - it has old indices no writes can be made.
。新索引和系统索引分散到热节点和暖节点中。稍后......我在我的集群中运行以下查询
{
"persistent": {
"cluster.routing.allocation.include.data":"hot"
}
, "transient": {
"cluster.routing.allocation.include.data":"hot"
}
}
系统索引和新索引转移到热节点。当这些索引变旧时,它不会移动到暖节点,尽管我为我的索引设置了 ilm 策略
{
"packetbeat_flow_policy" : {
"version" : 1,
"modified_date" : "2021-02-17T09:17:30.480Z",
"policy" : {
"phases" : {
"warm" : {
"min_age" : "0ms",
"actions" : {
"allocate" : {
"include" : { },
"exclude" : { },
"require" : {
"data" : "warm"
}
},
"set_priority" : {
"priority" : 50
}
}
},
"hot" : {
"min_age" : "0ms",
"actions" : {
"rollover" : {
"max_size" : "50gb",
"max_age" : "2m"
},
"set_priority" : {
"priority" : 100
}
}
},
"delete" : {
"min_age" : "0d",
"actions" : {
"delete" : {
"delete_searchable_snapshot" : true
}
}
}
}
}
}
管道文件
output {
if[agent][type]=="packetbeat"
{
if[type]=="flow"
{
elasticsearch {
hosts => ["http://em1:9200","http://em2:9200"]
manage_template => false
ilm_rollover_alias => "log-pb-flow"
ilm_pattern => "000001"
ilm_policy => "packetbeat_flow"
}
}
}
}
索引模板
{
"packetbeat_flow" : {
"order" : 0,
"index_patterns" : [
"log-pb-flow-*"
],
"settings" : {
"index" : {
"lifecycle" : {
"name" : "packetbeat_flow_policy",
"rollover_alias" : "log-pb-flow"
},
"routing" : {
"allocation" : {
"require" : {
"data" : "hot"
}
}
},
"refresh_interval" : "1s",
"number_of_shards" : "1",
"number_of_replicas" : "1"
}
},
它可以手动移动到暖节点,但我必须使用 ilm。