大家都知道，Openshift集成了EFK(Elasticsearch + Fluentd + Kibana)作为集群的日志管理平台。我们该怎样去维护ElasticSearch.

  1. 找到ES所在的pod
1
oc get pod -l component=es -o name -n logging | cut -d/ -f2
  1. 查看所有ES索引
1
oc exec $es-pod-name -- curl -s --cert /etc/elasticsearch/secret/admin-cert --key /etc/elasticsearch/secret/admin-key --cacert /etc/elasticsearch/secret/admin-ca https://localhost:9200/_cat/indices?v
  1. 清理所有3月份的ES索引
1
oc exec $es-pod-name -- curl -s --cert /etc/elasticsearch/secret/admin-cert --key /etc/elasticsearch/secret/admin-key --cacert /etc/elasticsearch/secret/admin-ca -XDELETE https://localhost:9200/*.2018.03.*

curl可以加-k这样就不需要--cacert参数

  1. 打开Kibana，显示错误Elasticsearch is still initializing the kibana index
    解决办法：删除kibana的索引，重新进入kibana
1
oc exec $es-pod-name -- curl -s --cert /etc/elasticsearch/secret/admin-cert --key /etc/elasticsearch/secret/admin-key --cacert /etc/elasticsearch/secret/admin-ca -XDELETE https://localhost:9200/.kibana
  1. 确认ES集群的工作状态
1
$ oc exec $es-pod-name -c elasticsearch -- health
  1. 停止ES节点分片平衡
1
$ oc exec $es-pod-name -c elasticsearch -- curl --cert /etc/elasticsearch/secret/admin-cert --key /etc/elasticsearch/secret/admin-key --cacert /etc/elasticsearch/secret/admin-ca -XPUT https://localhost:9200/_cluster/settings -d '{"transient": {"cluster.routing.allocation.enable":"none"}}'

6.开启ES节点分片平衡

1
$ oc exec $es-pod-name -c elasticsearch -- curl --cert /etc/elasticsearch/secret/admin-cert --key /etc/elasticsearch/secret/admin-key --cacert /etc/elasticsearch/secret/admin-ca -XPUT https://localhost:9200/_cluster/settings -d '{"transient": {"cluster.routing.allocation.enable":"all"}}'
  1. ES扩容

OpenShift自带的日志搜索引擎ES服务的扩容