Elasticsearch——Rollover的正确使用姿势

一、常见报错信息

代码语言：json复制

# kibana-Index Management页面报错
Index lifecycle error
illegal_argument_exception: index.lifecycle.rollover_alias [niosec-endpointsecurity-huorong-all] does not point to index [niosec-endpointsecurity-huorong-prod]

Index lifecycle error
illegal_argument_exception: index.lifecycle.rollover_alias [niosec-endpointsecurity-huorong-prod] does not point to index [niosec-endpointsecurity-huorong-prod]

二、操作步骤

https://www.elastic.co/guide/en/elasticsearch/reference/7.17/ilm-rollover.html

https://www.elastic.co/guide/en/elasticsearch/reference/7.17/indices-rollover-index.html#roll-over-index-alias-with-write-index

• The index name must match the pattern ^.*-d $, for example (my-index-000001). The index.lifecycle.rollover_alias must be configured as the alias to roll over. The index must be the write index for the alias.

1. 创建索引（索引名称必须得满足以上3个条件）

代码语言：json复制

# 创建索引并指定lifecycle与aliases属性
PUT 
{
  "settings": {
    "index.lifecycle.name": "my_policy",
    "index.lifecycle.rollover_alias": "my_data"
  },
  "aliases": {
    "my_data": {
      "is_write_index": true
    }
  }
}
# 返回
{
  "acknowledged" : true,
  "shards_acknowledged" : true,
  "index" : "my-index-2023.03.09-000001"
}

___

• 如果是已有index名称(xxxxxx)不满足条件，则需要reindex其到xxxxxx-000001

代码语言：json复制

POST _reindex
{
  "source": {
    "index": "xxxxxx"
  },
  "dest": {
    "index": "xxxxxx-000001"
  }
}
# 对其设置lifecycle属性
PUT xxxxxx-000001/_settings
{
  "index.lifecycle.name": "my_policy",
  "index.lifecycle.rollover_alias": "my_data"
}
# 对其添加aliases
PUT xxxxxx-000001/_aliases/my_data
{
    "is_write_index": true
}

https://www.elastic.co/guide/en/elasticsearch/reference/7.17/ilm-rollover.html

2. 创建生命周期策略

代码语言：json复制

PUT _ilm/policy/my_policy/
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover" : {
            "max_primary_shard_size": "50GB"
          }
        }
      }
    }
  }
}

具体滚动策略根据业务需要自行选择 https://www.elastic.co/guide/en/elasticsearch/reference/7.17/ilm-rollover.html

3. 验证rollover api

代码语言：json复制

# 写入一条数据
PUT my-index-000001/_doc/1
{
  "name": "weldon",
  "address": "陕西省西安市"
}
# 返回
{
  "_index" : "my-index-000001",
  "_type" : "_doc",
  "_id" : "1",
  "_version" : 1,
  "result" : "created",
  "_shards" : {
    "total" : 2,
    "successful" : 2,
    "failed" : 0
  },
  "_seq_no" : 0,
  "_primary_term" : 1
}

# 验证当前索引设置、alias指向
GET _cat/indices/my-index*?v
GET my-index-000001/_settings
GET my-index-000001/_alias
GET _alias/my_data
# 返回见下图

# 执行rollover apiapi，我这里max_docs指定的是1哦（因为我只写入了1条数据），如果指定为2则不满足rollover条件，conditions返回就为false
POST my_data/_rollover
{
  "conditions": {
    "max_docs": 1
  }
}
# 返回
{
  "acknowledged" : true,
  "shards_acknowledged" : true,
  "old_index" : "my-index-000001",
  "new_index" : "my-index-000002",
  "rolled_over" : true,
  "dry_run" : false,
  "conditions" : {
    "[max_docs: 1]" : true
  }
}

https://www.elastic.co/guide/en/elasticsearch/reference/7.17/indices-rollover-index.html#roll-over-index-alias-with-write-index

rollover前GET _cat/indices/my-index*?v

rollover后GET _cat/indices/my-index*?v

ElasticsearchServicees 生命周期 elasticSerach rollover ilm

0 人点赞