索引別名deflector的異常處理
官方推薦處理步驟
Stop all Graylog nodes
(OPTIONAL) If you want to keep the already ingested messages, reindex them into the Elasticsearch index with the greatest number, e. g. graylog_23 if you want to fix the deflector graylog_deflector, via the Elasticsearch Reindex API.
Delete the graylog_deflector index via the Elasticsearch Delete Index API.
Add action.auto_create_index: false to the configuration files of all Elasticsearch nodes in your cluster and restart these Elasticsearch nodes, see Elasticsearch Index API - Automatic Index Creation and Creating an Index for details.
Start the Graylog master node.
Manually rotate the active write index of the index set on the System / Indices / Index Set page in the Maintenance dropdown menu.
(OPTIONAL) Start all remaining Graylog slave nodes.
實際可行操作
一般出現索引別名異常時，一般是Graylog和Elasticsearch的連接出現異常或者Elasticsearch集群本身異常，導致別名和實際索引掛載異常導致。
所以處理起來，也是按照這個思路，首先關閉es的自動創建索引，以防刪除掛載別名異常索引后，自動又新建一個，陷入循環；其次，刪除異常的別名對應索引；然后手動進行索引輪換，查看無問題；最后打開索引的自動創建，Graylog恢復正常。
-
禁用自動創建索引：
curl -s -XPUT -u elastic 'http://127.0.0.1:9200/_cluster/settings' -d '{"transient":{"action.auto_create_index":"false"}}' -
刪除最新索引名稱或者通過
http://127.0.0.1:9200/_cat/aliases查看別名對應的索引名稱：curl -XDELETE -u elastic 'http://10.10.238.178:9200/INDEX_NAME' -
手動輪換索引（
66d435e168e94f0cb77cd14e索引集id）：curl -u admin:admin -XPOST -H 'X-Requested-By: XMLHttpRequest' 'http://127.0.0.1/api/cluster/deflector/66d435e168e94f0cb77cd14e/cycle' -
開啟自動創建索引：
curl -s -XPUT -u elastic 'http://127.0.0.1:9200/_cluster/settings' -d '{"transient":{"action.auto_create_index":"true"}}'
Elasticsearch的索引分片數限制解除
報錯
Validation Failed: 1: this action would add [1] total shards, but this cluster currently has [6000]/[6000] maximum shards open.
解除
curl -XPUT http://localhost:9200/_cluster/settings
-u elastic:password
-H “Content-Type: application/json”
-d ‘{“transient”:{“cluster”:{“max_shards_per_node”:10000}}}’
優化
Elasticsearch推薦分片大小在30-50G之間，一定要人為進行干預優化，太多的小分片，也不利于集群故障后的分片速度，也會影響一定的查詢和寫入性能。
)
)