Elasticsearch常用运维命令
Elasticsearch 的运维命令主要集中在使用其 RESTful API 上。这些命令可以通过任何 HTTP 客户端（如 curl、Kibana Dev Tools、Postman 等）来执行。
集群健康与状态信息
这是运维中最常用的一组命令，用于快速了解集群的整体状态。
查看集群健康状态
[root@k8s-192-168-1-140 ~]# PASSWORD=$(kubectl get secret quickstart-es-elastic-user -o go-template='{{.data.elastic | base64decode}}')
[root@k8s-192-168-1-140 ~]#
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/health?pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/health?pretty"
{
"cluster_name" : "quickstart",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 39,
"active_shards" : 39,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"unassigned_primary_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
[root@k8s-192-168-1-140 ~]# 查看集群详细状态（包含节点、索引信息）
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/state?pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/state?pretty"
--------略
{
"state" : "STARTED",
"primary" : true,
"node" : "N9j3pRcUR06S4vCsRcdnWw",
"relocating_node" : null,
"shard" : 0,
"index" : ".internal.alerts-observability.metrics.alerts-default-000001",
"allocation_id" : {
"id" : "5onDdIVtS6WBHRBQeCB7PQ"
},
"relocation_failure_info" : {
"failed_attempts" : 0
}
},
{
"state" : "STARTED",
"primary" : true,
"node" : "N9j3pRcUR06S4vCsRcdnWw",
"relocating_node" : null,
"shard" : 0,
"index" : ".ds-ilm-history-7-2025.12.12-000001",
"allocation_id" : {
"id" : "58PpB0LGQ6iabrqO5VLKqw"
},
"relocation_failure_info" : {
"failed_attempts" : 0
}
}
]
}
},
"health" : {
"disk" : {
"high_watermark" : "90%",
"high_max_headroom" : "150gb",
"flood_stage_watermark" : "95%",
"flood_stage_max_headroom" : "100gb",
"frozen_flood_stage_watermark" : "95%",
"frozen_flood_stage_max_headroom" : "20gb"
},
"shard_limits" : {
"max_shards_per_node" : 1000,
"max_shards_per_node_frozen" : 3000
}
}
}
[root@k8s-192-168-1-140 ~]# 查看节点信息（节点角色、负载等）
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/nodes?v&pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/nodes?v&pretty"
ip heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name
172.20.246.81 20 90 2 0.12 0.24 0.30 cdfhilmrstw * quickstart-es-default-0
[root@k8s-192-168-1-140 ~]# 查看所有节点统计信息（CPU，内存，磁盘等）
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_nodes/stats?pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_nodes/stats?pretty"
{
"_nodes" : {
"total" : 1,
"successful" : 1,
"failed" : 0
},
"cluster_name" : "quickstart",
"nodes" : {
"N9j3pRcUR06S4vCsRcdnWw" : {
"timestamp" : 1765552084622,
"name" : "quickstart-es-default-0",
"transport_address" : "172.20.246.81:9300",
"host" : "172.20.246.81",
"ip" : "172.20.246.81:9300",
"roles" : [
"data",
"data_cold",
"data_content",
"data_frozen",
"data_hot",
"data_warm",
"ingest",
"master",
"ml",
"remote_cluster_client",
"transform"
],
"attributes" : {
"k8s_node_name" : "k8s-192-168-1-140",
"transform.config_version" : "10.0.0",
"xpack.installed" : "true",
"ml.allocated_processors" : "4",
"ml.max_jvm_size" : "1073741824",
"ml.config_version" : "12.0.0",
"ml.machine_memory" : "2147483648",
"ml.allocated_processors_double" : "4.0"
},
"indices" : {
"docs" : {
"count" : 704,
"deleted" : 33,
"total_size_in_bytes" : 3277982
},
"shard_stats" : {
"total_count" : 39
},
"store" : {
"size_in_bytes" : 3463658,
"total_data_set_size_in_bytes" : 3463658,
"reserved_in_bytes" : 0
},
---------略
"indexing_pressure" : {
"memory" : {
"current" : {
"combined_coordinating_and_primary_in_bytes" : 0,
"coordinating_in_bytes" : 0,
"primary_in_bytes" : 0,
"replica_in_bytes" : 0,
"all_in_bytes" : 0
},
"total" : {
"combined_coordinating_and_primary_in_bytes" : 17013966,
"coordinating_in_bytes" : 6251254,
"primary_in_bytes" : 17072110,
"replica_in_bytes" : 0,
"all_in_bytes" : 17013966,
"coordinating_rejections" : 0,
"primary_rejections" : 0,
"replica_rejections" : 0,
"primary_document_rejections" : 0,
"large_operation_rejections" : 0
},
"limit_in_bytes" : 107374182
}
},
"repositories" : ,
"allocations" : {
"shards" : 39,
"undesired_shards" : 0,
"forecasted_ingest_load" : 0.0,
"forecasted_disk_usage_in_bytes" : 3540384,
"current_disk_usage_in_bytes" : 3540384
}
}
}
}关键指标解读：
status: green（健康），yellow（数据完整，但副本未分配），red（数据丢失或主分片缺失），只有一个索引出现red则集群就是red。
number_of_nodes： 集群中节点总数。
unassigned_shards： 未分配的分片数，yellow 或 red 状态的直接原因，集群状态的修复，其实就是修复这里。
检查pending tasks
curl -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/pending_tasks?pretty"
[root@k8s-192-168-1-140 ~]# curl -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/pending_tasks?pretty"
{
"tasks" : [ ]
}
[root@k8s-192-168-1-140 ~]#检查节点统计（包括JVM）
curl -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_nodes/stats/jvm?pretty"
[root@k8s-192-168-1-140 ~]# curl -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_nodes/stats/jvm?pretty"
{
"_nodes" : {
"total" : 1,
"successful" : 1,
"failed" : 0
},
"cluster_name" : "quickstart",
"nodes" : {
"N9j3pRcUR06S4vCsRcdnWw" : {
"timestamp" : 1765556768340,
"name" : "quickstart-es-default-0",
"transport_address" : "172.20.246.81:9300",
"host" : "172.20.246.81",
"ip" : "172.20.246.81:9300",
"roles" : [
"data",
"data_cold",
"data_content",
"data_frozen",
"data_hot",
"data_warm",
"ingest",
"master",
"ml",
"remote_cluster_client",
"transform"
],
"attributes" : {
"k8s_node_name" : "k8s-192-168-1-140",
"transform.config_version" : "10.0.0",
"xpack.installed" : "true",
"ml.allocated_processors" : "4",
"ml.max_jvm_size" : "1073741824",
"ml.config_version" : "12.0.0",
"ml.machine_memory" : "2147483648",
"ml.allocated_processors_double" : "4.0"
},
"jvm" : {
"timestamp" : 1765556768340,
"uptime_in_millis" : 8190447,
"mem" : {
"heap_used_in_bytes" : 367588160,
"heap_used_percent" : 34,
"heap_committed_in_bytes" : 1073741824,
"heap_max_in_bytes" : 1073741824,
"non_heap_used_in_bytes" : 254902992,
"non_heap_committed_in_bytes" : 288817152,
"pools" : {
"CodeHeap 'non-nmethods'" : {
"used_in_bytes" : 2897024,
"max_in_bytes" : 5832704,
"peak_used_in_bytes" : 3078400,
"peak_max_in_bytes" : 5832704
},
"Metaspace" : {
"used_in_bytes" : 188019056,
"max_in_bytes" : 0,
"peak_used_in_bytes" : 188019056,
"peak_max_in_bytes" : 0
},
"CodeHeap 'profiled nmethods'" : {
"used_in_bytes" : 22557696,
"max_in_bytes" : 122908672,
"peak_used_in_bytes" : 47959168,
"peak_max_in_bytes" : 122908672
},
"Compressed Class Space" : {
"used_in_bytes" : 22554848,
"max_in_bytes" : 1073741824,
"peak_used_in_bytes" : 22558024,
"peak_max_in_bytes" : 1073741824
},
"young" : {
"used_in_bytes" : 218103808,
"max_in_bytes" : 0,
"peak_used_in_bytes" : 629145600,
"peak_max_in_bytes" : 0
},
"old" : {
"used_in_bytes" : 142159792,
"max_in_bytes" : 1073741824,
"peak_used_in_bytes" : 142159792,
"peak_max_in_bytes" : 1073741824
},
"survivor" : {
"used_in_bytes" : 7324560,
"max_in_bytes" : 0,
"peak_used_in_bytes" : 54525952,
"peak_max_in_bytes" : 0
},
"CodeHeap 'non-profiled nmethods'" : {
"used_in_bytes" : 18874368,
"max_in_bytes" : 122916864,
"peak_used_in_bytes" : 21230464,
"peak_max_in_bytes" : 122916864
}
}
},
"threads" : {
"count" : 102,
"peak_count" : 107
},
"gc" : {
"collectors" : {
"young" : {
"collection_count" : 49,
"collection_time_in_millis" : 567
},
"G1 Concurrent GC" : {
"collection_count" : 32,
"collection_time_in_millis" : 299
},
"old" : {
"collection_count" : 0,
"collection_time_in_millis" : 0
}
}
},
"buffer_pools" : {
"mapped" : {
"count" : 0,
"used_in_bytes" : 0,
"total_capacity_in_bytes" : 0
},
"direct" : {
"count" : 19,
"used_in_bytes" : 4849681,
"total_capacity_in_bytes" : 4849675
},
"mapped - 'non-volatile memory'" : {
"count" : 0,
"used_in_bytes" : 0,
"total_capacity_in_bytes" : 0
}
},
"classes" : {
"current_loaded_count" : 37618,
"total_loaded_count" : 39057,
"total_unloaded_count" : 1439
}
}
}
}
}
[root@k8s-192-168-1-140 ~]#索引管理
简单创建索引
curl -X PUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby?pretty" -H 'Content-Type: application/json' -d'
{
"settings": {
"number_of_shards": 3,
"number_of_replicas": 1
},
"mappings": {
"properties": {
"title": { "type": "text" },
"content": { "type": "text" },
"timestamp": { "type": "date" }
}
}
}
'
[root@k8s-192-168-1-140 ~]# curl -X PUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby?pretty" -H 'Content-Type: application/json' -d'
{
"settings": {
"number_of_shards": 3,
"number_of_replicas": 1
},
"mappings": {
"properties": {
"title": { "type": "text" },
"content": { "type": "text" },
"timestamp": { "type": "date" }
}
}
}
'
{
"acknowledged" : true,
"shards_acknowledged" : true,
"index" : "cby"
}
[root@k8s-192-168-1-140 ~]#查看所有索引（包含文档数、存储大小等）
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/indices?v&pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/indices?v&pretty"
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size dataset.size
green open .internal.alerts-transform.health.alerts-default-000001 a2rSAm8mS-SrwYku3uAYLQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.logs.alerts-default-000001 kfuEckcpSmGERMea6-K7SQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.uptime.alerts-default-000001 LjhwWuZjRlah9zJKu2Q1bQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-ml.anomaly-detection.alerts-default-000001 1T4CZbf5T8SG1goXXn-07w 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.slo.alerts-default-000001 4M4iza7KQCaU2t_y6E5smQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-default.alerts-default-000001 y1re-StiTG-aoC6sSgcGXA 1 0 0 0 249b 249b 249b
green open .internal.alerts-streams.alerts-default-000001 RNM1iJUnSvOpqy4KPNFwBQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.apm.alerts-default-000001 gWZKJICPQtO8-hNQsWfn8A 1 0 0 0 249b 249b 249b
green open .internal.alerts-security.attack.discovery.alerts-default-000001 AW_JMgIZSjaEyHDmQapViA 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.metrics.alerts-default-000001 cPLbEFixQF2tJO7hY0GK4A 1 0 0 0 249b 249b 249b
green open .internal.alerts-ml.anomaly-detection-health.alerts-default-000001 yFWgfEPoQiKnfjYYd_9rfA 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.threshold.alerts-default-000001 OfniPqsZRvWm4p0ybqZfEw 1 0 0 0 249b 249b 249b
green open .internal.alerts-security.alerts-default-000001 4DrPeUpGRcm2VVlK2tytbQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-dataset.quality.alerts-default-000001 1nWfrX_DTKO4VDuLULH9hw 1 0 0 0 249b 249b 249b
yellow open cby Xu_XibxhQGSSdVTvZac3OA 3 1 0 0 681b 681b 681b
green open .internal.alerts-stack.alerts-default-000001 sqLxcGqeS22EbJJ2XBMJvQ 1 0 0 0 249b 249b 249b
[root@k8s-192-168-1-140 ~]#查看特定索引的状态
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/indices/cby?v&pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/indices/cby?v&pretty"
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size dataset.size
yellow open cby Xu_XibxhQGSSdVTvZac3OA 3 1 0 0 681b 681b 681b
[root@k8s-192-168-1-140 ~]#
查看索引的详细统计信息
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_stats?pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_stats?pretty"
{
"_shards" : {
"total" : 6,
"successful" : 3,
"failed" : 0
},
"_all" : {
"primaries" : {
"docs" : {
"count" : 0,
"deleted" : 0,
"total_size_in_bytes" : 0
},
-----略
"dense_vector" : {
"value_count" : 0,
"off_heap" : {
"total_size_bytes" : 0,
"total_veb_size_bytes" : 0,
"total_vec_size_bytes" : 0,
"total_veq_size_bytes" : 0,
"total_vex_size_bytes" : 0
}
},
"sparse_vector" : {
"value_count" : 0
}
}
}
}
}
[root@k8s-192-168-1-140 ~]# 查看索引的映射（mapping）
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_mapping?pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_mapping?pretty"
{
"cby" : {
"mappings" : {
"properties" : {
"content" : {
"type" : "text"
},
"timestamp" : {
"type" : "date"
},
"title" : {
"type" : "text"
}
}
}
}
}
[root@k8s-192-168-1-140 ~]# 查看索引的设置（settings）
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings?pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings?pretty"
{
"cby" : {
"settings" : {
"index" : {
"routing" : {
"allocation" : {
"include" : {
"_tier_preference" : "data_content"
}
}
},
"number_of_shards" : "3",
"provided_name" : "cby",
"creation_date" : "1765552408698",
"number_of_replicas" : "1",
"uuid" : "Xu_XibxhQGSSdVTvZac3OA",
"version" : {
"created" : "9039002"
}
}
}
}
}
[root@k8s-192-168-1-140 ~]# 删除索引（危险操作！）
curl -XDELETE -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby"
[root@k8s-192-168-1-140 ~]# curl -XDELETE -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby"
{"acknowledged":true}
[root@k8s-192-168-1-140 ~]# 关闭索引（保留数据但不再读写，节省资源）
curl -XPOST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_close"
[root@k8s-192-168-1-140 ~]# curl -XPOST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_close"
{"acknowledged":true,"shards_acknowledged":true,"indices":{"cby":{"closed":true}}}
[root@k8s-192-168-1-140 ~]# 打开索引
curl -XPOST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_open"
[root@k8s-192-168-1-140 ~]# curl -XPOST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_open"
{"acknowledged":true,"shards_acknowledged":true}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]# 修改索引配置（如动态修改副本数）
curl -XPUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings" -H 'Content-Type: application/json' -d' { "number_of_replicas": 2 } '
[root@k8s-192-168-1-140 ~]# curl -XPUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings" -H 'Content-Type: application/json' -d' { "number_of_replicas": 2 } '
{"acknowledged":true}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]# 查看分片分配情况（非常重要！）
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/shards?v&pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/shards?v&pretty"
index shard prirep state docs store dataset ip node
.kibana_search_solution_9.2.2_001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.slo-observability.summary-v3.5 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.kibana_task_manager_9.2.2_001 0 p STARTED 48 90.1kb 90.1kb 172.20.246.81 quickstart-es-default-0
.kibana_usage_counters_9.2.2_001 0 p STARTED 82 64.9kb 64.9kb 172.20.246.81 quickstart-es-default-0
.kibana_alerting_cases_9.2.2_001 0 p STARTED 1 7.5kb 7.5kb 172.20.246.81 quickstart-es-default-0
cby 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
cby 0 r UNASSIGNED
cby 0 r UNASSIGNED
cby 1 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
cby 1 r UNASSIGNED
cby 1 r UNASSIGNED
cby 2 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
cby 2 r UNASSIGNED
cby 2 r UNASSIGNED
.slo-observability.summary-v3.5.temp 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-observability.slo.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.kibana_locks-000001 0 p STARTED 0 3.6kb 3.6kb 172.20.246.81 quickstart-es-default-0
.ds-.edr-workflow-insights-default-2025.12.12-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.kibana_9.2.2_001 0 p STARTED 88 86.4kb 86.4kb 172.20.246.81 quickstart-es-default-0
.ds-ilm-history-7-2025.12.12-000001 0 p STARTED 48 34.7kb 34.7kb 172.20.246.81 quickstart-es-default-0
.internal.alerts-observability.apm.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-observability.threshold.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-stack.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-transform.health.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-dataset.quality.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-streams.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-observability.uptime.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.ds-.logs-elasticsearch.deprecation-default-2025.12.12-000001 0 p STARTED 4 34.6kb 34.6kb 172.20.246.81 quickstart-es-default-0
.apm-agent-configuration 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-observability.metrics.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.slo-observability.sli-v3.5 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-ml.anomaly-detection.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.kibana_security_solution_9.2.2_001 0 p STARTED 6 61.4kb 61.4kb 172.20.246.81 quickstart-es-default-0
.internal.alerts-default.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-security.attack.discovery.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-security.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.kibana_ingest_9.2.2_001 0 p STARTED 143 294.3kb 294.3kb 172.20.246.81 quickstart-es-default-0
.internal.alerts-observability.logs.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.ds-.kibana-event-log-ds-2025.12.12-000001 0 p STARTED 1 6.3kb 6.3kb 172.20.246.81 quickstart-es-default-0
.kibana-siem-rule-migrations-integrations 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.kibana_analytics_9.2.2_001 0 p STARTED 5 1.7mb 1.7mb 172.20.246.81 quickstart-es-default-0
.security-profile-8 0 p STARTED 1 19.9kb 19.9kb 172.20.246.81 quickstart-es-default-0
.kibana_security_session_1 0 p STARTED 2 13.6kb 13.6kb 172.20.246.81 quickstart-es-default-0
.apm-custom-link 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-ml.anomaly-detection-health.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.apm-source-map 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.security-7 0 p STARTED 288 771.8kb 771.8kb 172.20.246.81 quickstart-es-default-0
.kibana-siem-rule-migrations-prebuiltrules 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
[root@k8s-192-168-1-140 ~]# 查看未分配的分片及原因
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/shards?v&h=index,shard,prirep,state,unassigned.reason&s=state&pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/shards?v&h=index,shard,prirep,state,unassigned.reason&s=state&pretty"
index shard prirep state unassigned.reason
cby 0 r UNASSIGNED INDEX_REOPENED
cby 0 r UNASSIGNED REPLICA_ADDED
cby 1 r UNASSIGNED INDEX_REOPENED
cby 1 r UNASSIGNED REPLICA_ADDED
cby 2 r UNASSIGNED INDEX_REOPENED
cby 2 r UNASSIGNED REPLICA_ADDED
.kibana_search_solution_9.2.2_001 0 p STARTED
.slo-observability.summary-v3.5 0 p STARTED
.kibana_task_manager_9.2.2_001 0 p STARTED
.kibana_usage_counters_9.2.2_001 0 p STARTED
.kibana_alerting_cases_9.2.2_001 0 p STARTED
cby 0 p STARTED
cby 1 p STARTED
cby 2 p STARTED
.slo-observability.summary-v3.5.temp 0 p STARTED
.internal.alerts-observability.slo.alerts-default-000001 0 p STARTED
.kibana_locks-000001 0 p STARTED
.ds-.edr-workflow-insights-default-2025.12.12-000001 0 p STARTED
.kibana_9.2.2_001 0 p STARTED
.ds-ilm-history-7-2025.12.12-000001 0 p STARTED
.internal.alerts-observability.apm.alerts-default-000001 0 p STARTED
.internal.alerts-observability.threshold.alerts-default-000001 0 p STARTED
.internal.alerts-stack.alerts-default-000001 0 p STARTED
.internal.alerts-transform.health.alerts-default-000001 0 p STARTED
.internal.alerts-dataset.quality.alerts-default-000001 0 p STARTED
.internal.alerts-streams.alerts-default-000001 0 p STARTED
.internal.alerts-observability.uptime.alerts-default-000001 0 p STARTED
.ds-.logs-elasticsearch.deprecation-default-2025.12.12-000001 0 p STARTED
.apm-agent-configuration 0 p STARTED
.internal.alerts-observability.metrics.alerts-default-000001 0 p STARTED
.slo-observability.sli-v3.5 0 p STARTED
.internal.alerts-ml.anomaly-detection.alerts-default-000001 0 p STARTED
.kibana_security_solution_9.2.2_001 0 p STARTED
.internal.alerts-default.alerts-default-000001 0 p STARTED
.internal.alerts-security.attack.discovery.alerts-default-000001 0 p STARTED
.internal.alerts-security.alerts-default-000001 0 p STARTED
.kibana_ingest_9.2.2_001 0 p STARTED
.internal.alerts-observability.logs.alerts-default-000001 0 p STARTED
.ds-.kibana-event-log-ds-2025.12.12-000001 0 p STARTED
.kibana-siem-rule-migrations-integrations 0 p STARTED
.kibana_analytics_9.2.2_001 0 p STARTED
.security-profile-8 0 p STARTED
.kibana_security_session_1 0 p STARTED
.apm-custom-link 0 p STARTED
.internal.alerts-ml.anomaly-detection-health.alerts-default-000001 0 p STARTED
.apm-source-map 0 p STARTED
.security-7 0 p STARTED
.kibana-siem-rule-migrations-prebuiltrules 0 p STARTED
[root@k8s-192-168-1-140 ~]#
清除节点的缓存
curl -XPOST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_cache/clear"
[root@k8s-192-168-1-140 ~]# curl -XPOST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_cache/clear"
{"_shards":{"total":9,"successful":3,"failed":0}}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]# 清除所有的缓存
curl -XPOST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cache/clear?pretty"
[root@k8s-192-168-1-140 ~]# curl -XPOST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cache/clear?pretty"
{
"_shards" : {
"total" : 21,
"successful" : 18,
"failed" : 0
}
}
[root@k8s-192-168-1-140 ~]#
将节点排除出集群（下线节点）
curl -XPUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/settings" -H 'Content-Type: application/json' -d' { "transient": { "cluster.routing.allocation.exclude._name": "node-name-to-remove" } } '查看正在运行的任务（如 _forcemerge, reindex）
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/tasks?v&pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/tasks?v&pretty"
action task_id parent_task_id type start_time timestamp running_time ip node
geoip-downloader[c] N9j3pRcUR06S4vCsRcdnWw:340 cluster:1 persistent 1765548603189 14:10:03 1.2h 172.20.246.81 quickstart-es-default-0
health-node[c] N9j3pRcUR06S4vCsRcdnWw:350 cluster:2 persistent 1765548603882 14:10:03 1.2h 172.20.246.81 quickstart-es-default-0
cluster:monitor/tasks/lists N9j3pRcUR06S4vCsRcdnWw:53136 - transport 1765553067275 15:24:27 498micros 172.20.246.81 quickstart-es-default-0
cluster:monitor/tasks/lists[n] N9j3pRcUR06S4vCsRcdnWw:53137 N9j3pRcUR06S4vCsRcdnWw:53136 transport 1765553067275 15:24:27 420.9micros 172.20.246.81 quickstart-es-default-0
[root@k8s-192-168-1-140 ~]# 查看热点线程（用于诊断性能问题）
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_nodes/hot_threads?pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_nodes/hot_threads?pretty"
::: {quickstart-es-default-0}{N9j3pRcUR06S4vCsRcdnWw}{ob3LpO08ReyXSUqr6OkHDQ}{quickstart-es-default-0}{172.20.246.81}{172.20.246.81:9300}{cdfhilmrstw}{9.2.2}{8000099-9039002}{k8s_node_name=k8s-192-168-1-140, transform.config_version=10.0.0, xpack.installed=true, ml.allocated_processors=4, ml.max_jvm_size=1073741824, ml.config_version=12.0.0, ml.machine_memory=2147483648, ml.allocated_processors_double=4.0}
Hot threads at 2025-12-12T16:31:15.859Z, interval=500ms, busiestThreads=3, ignoreIdleThreads=true:
[root@k8s-192-168-1-140 ~]# 查看集群设置
curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/settings?pretty"
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/settings?pretty"
{
"persistent" : ,
"transient" :
}
[root@k8s-192-168-1-140 ~]# 在索引中插入内容指定ID
curl -X POST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_doc/123" -H 'Content-Type: application/json' -d'
{
"name": "Snow Crash",
"author": "Neal Stephenson",
"release_date": "1992-06-01",
"page_count": 470
}
'
[root@k8s-192-168-1-140 ~]# curl -X POST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_doc/123" -H 'Content-Type: application/json' -d'
{
"name": "Snow Crash",
"author": "Neal Stephenson",
"release_date": "1992-06-01",
"page_count": 470
}
'
{"_index":"cby","_id":"123","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":0,"_primary_term":3}
在索引中插入内容随机ID
curl -X POST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_doc/" -H 'Content-Type: application/json' -d'
{
"name": "Snow Crash",
"author": "Neal Stephenson",
"release_date": "1992-06-01",
"page_count": 470
}
'
[root@k8s-192-168-1-140 ~]# curl -X POST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_doc/" -H 'Content-Type: application/json' -d'
{
"name": "Snow Crash",
"author": "Neal Stephenson",
"release_date": "1992-06-01",
"page_count": 470
}
'
{"_index":"cby","_id":"ByNRE5sBdx0sYBy0kiOe","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":0,"_primary_term":3}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]#
统计索引中的量
curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_count'
[root@k8s-192-168-1-140 ~]# curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_count'
{"count":2,"_shards":{"total":3,"successful":3,"skipped":0,"failed":0}}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]#
查询索引中的数据内容
curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_search?pretty'
[root@k8s-192-168-1-140 ~]# curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_search?pretty'
{
"took" : 8,
"timed_out" : false,
"_shards" : {
"total" : 3,
"successful" : 3,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 2,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "cby",
"_id" : "123",
"_score" : 1.0,
"_source" : {
"name" : "Snow Crash",
"author" : "Neal Stephenson",
"release_date" : "1992-06-01",
"page_count" : 470
}
},
{
"_index" : "cby",
"_id" : "ByNRE5sBdx0sYBy0kiOe",
"_score" : 1.0,
"_source" : {
"name" : "Snow Crash",
"author" : "Neal Stephenson",
"release_date" : "1992-06-01",
"page_count" : 470
}
}
]
}
}
[root@k8s-192-168-1-140 ~]#
删除指定索引中的数据内容
curl -X DELETE -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_doc/123"
[root@k8s-192-168-1-140 ~]# curl -X DELETE -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_doc/123"
{"_index":"cby","_id":"123","_version":2,"result":"deleted","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":1,"_primary_term":3}
[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]# curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_search?pretty'
{
"took" : 25,
"timed_out" : false,
"_shards" : {
"total" : 3,
"successful" : 3,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "cby",
"_id" : "ByNRE5sBdx0sYBy0kiOe",
"_score" : 1.0,
"_source" : {
"name" : "Snow Crash",
"author" : "Neal Stephenson",
"release_date" : "1992-06-01",
"page_count" : 470
}
}
]
}
}
[root@k8s-192-168-1-140 ~]#
设检查索引统计
curl -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/indices?v&s=index"
[root@k8s-192-168-1-140 ~]# curl -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/indices?v&s=index"
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size dataset.size
green open .internal.alerts-dataset.quality.alerts-default-000001 1nWfrX_DTKO4VDuLULH9hw 1 0 0 0 249b 249b 249b
green open .internal.alerts-default.alerts-default-000001 y1re-StiTG-aoC6sSgcGXA 1 0 0 0 249b 249b 249b
green open .internal.alerts-ml.anomaly-detection-health.alerts-default-000001 yFWgfEPoQiKnfjYYd_9rfA 1 0 0 0 249b 249b 249b
green open .internal.alerts-ml.anomaly-detection.alerts-default-000001 1T4CZbf5T8SG1goXXn-07w 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.apm.alerts-default-000001 gWZKJICPQtO8-hNQsWfn8A 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.logs.alerts-default-000001 kfuEckcpSmGERMea6-K7SQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.metrics.alerts-default-000001 cPLbEFixQF2tJO7hY0GK4A 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.slo.alerts-default-000001 4M4iza7KQCaU2t_y6E5smQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.threshold.alerts-default-000001 OfniPqsZRvWm4p0ybqZfEw 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.uptime.alerts-default-000001 LjhwWuZjRlah9zJKu2Q1bQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-security.alerts-default-000001 4DrPeUpGRcm2VVlK2tytbQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-security.attack.discovery.alerts-default-000001 AW_JMgIZSjaEyHDmQapViA 1 0 0 0 249b 249b 249b
green open .internal.alerts-stack.alerts-default-000001 sqLxcGqeS22EbJJ2XBMJvQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-streams.alerts-default-000001 RNM1iJUnSvOpqy4KPNFwBQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-transform.health.alerts-default-000001 a2rSAm8mS-SrwYku3uAYLQ 1 0 0 0 249b 249b 249b
yellow open cby zKsFpdUaTJaO0MBUyQ-O4g 3 1 1 0 6.7kb 6.7kb 6.7kb
[root@k8s-192-168-1-140 ~]#
查询指定字段为某值的数据
curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_search?q=page_count:470'
[root@k8s-192-168-1-140 ~]# curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_search?q=page_count:470'
{"took":1,"timed_out":false,"_shards":{"total":3,"successful":3,"skipped":0,"failed":0},"hits":{"total":{"value":1,"relation":"eq"},"max_score":1.0,"hits":[{"_index":"cby","_id":"ByNRE5sBdx0sYBy0kiOe","_score":1.0,"_source":
{
"name": "Snow Crash",
"author": "Neal Stephenson",
"release_date": "1992-06-01",
"page_count": 470
}
}]}}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]#
重置refesh_interval
curl -X PUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings" -H "Content-Type: application/json" -d'{"refresh_interval": null}'
[root@k8s-192-168-1-140 ~]# curl -X PUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings" -H "Content-Type: application/json" -d'{"refresh_interval": null}'
{"acknowledged":true}
[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings?pretty"
{
"cby" : {
"settings" : {
"index" : {
"routing" : {
"allocation" : {
"include" : {
"_tier_preference" : "data_content"
}
}
},
"number_of_shards" : "3",
"provided_name" : "cby",
"creation_date" : "1765552854698",
"number_of_replicas" : "1",
"uuid" : "zKsFpdUaTJaO0MBUyQ-O4g",
"version" : {
"created" : "9039002"
}
}
}
}
}
[root@k8s-192-168-1-140 ~]# 设置refesh_interval时间
curl -X PUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings" -H "Content-Type: application/json" -d'{"refresh_interval": "30s"}'
[root@k8s-192-168-1-140 ~]# curl -X PUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings" -H "Content-Type: application/json" -d'{"refresh_interval": "30s"}'
{"acknowledged":true}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings?pretty"
{
"cby" : {
"settings" : {
"index" : {
"routing" : {
"allocation" : {
"include" : {
"_tier_preference" : "data_content"
}
}
},
"refresh_interval" : "30s",
"number_of_shards" : "3",
"provided_name" : "cby",
"creation_date" : "1765552854698",
"number_of_replicas" : "1",
"uuid" : "zKsFpdUaTJaO0MBUyQ-O4g",
"version" : {
"created" : "9039002"
}
}
}
}
}
[root@k8s-192-168-1-140 ~]#
关于
https://www.oiox.cn/index.php/start-page.html
CSDN、GitHub、知乎、开源中国、思否、掘金、简书、华为云、阿里云、腾讯云、哔哩哔哩、今日头条、新浪微博、个人博客
全网可搜《小陈运维》
文章主要发布于微信公众号：《Linux运维交流社区》
评论 (0)