确定elk中的数据存储的位置-和增加集群节点

2312321

可见由 配置文件path.data决定

[iyunv@master etc]# cat /usr/local/elasticsearch/config/elasticsearch.yml  | egrep -v "^$|^#"
path.data: /tmp/elasticsearch/data
path.logs: /tmp/elasticsearch/logs
network.host: 192.168.100.10
network.port: 9200


[iyunv@master etc]# du -s /tmp/elasticsearch/data/  
4384    /tmp/elasticsearch/data/
[iyunv@master etc]# du -s /tmp/elasticsearch/data/
8716    /tmp/elasticsearch/data/

如果是rpm安装的elasticsearch(简称)可以/etc/init.d/elasticsearch  中设置: data 和log的位置

1 2 3 4 5 6 7 8 9

35 ES_USER="elasticsearch" 36 ES_GROUP="elasticsearch" 37 ES_HOME="/usr/share/elasticsearch" 38 MAX_OPEN_FILES=65535 39 MAX_MAP_COUNT=262144 40 LOG_DIR="/data2/elk/elasticsearch/log/elasticsearch" 41 DATA_DIR="/data2/elk/elasticsearch/data/elasticsearch" 42 CONF_DIR="/etc/elasticsearch" 43

配置集群:
没有集群的时候，默认的数据目录结构是:

[iyunv@master etc]# ls /tmp/elasticsearch/data/elasticsearch/   
nodes

【配置集群的前提 hosts 解析】

master节点和slave节点要互相能够解析
[iyunv@master httpd]# ping master
PING www.elk.com (192.168.100.10) 56(84) bytes of data.
64 bytes from www.elk.com (192.168.100.10): icmp_seq=1 ttl=64 time=0.073 ms
^C
--- www.elk.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 675ms
rtt min/avg/max/mdev = 0.073/0.073/0.073/0.000 ms
[iyunv@master httpd]# ping slave
PING slave (192.168.100.13) 56(84) bytes of data.
64 bytes from slave (192.168.100.13): icmp_seq=1 ttl=64 time=1.18 ms

【配置集群】
master节点(节点一) 192.168.100.10上的配置：
# ---------------------------------- Cluster -----------------------------------
cluster.name: elasticsearch-cluster

# ------------------------------------ Node ------------------------------------

node.name: master

# --------------------------------- Discovery ----------------------------------
#
# Elasticsearch nodes will find each other via unicast, by default.
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
# discovery.zen.ping.unicast.hosts: ["host1", "host2"]
discovery.zen.ping.unicast.hosts: ["master", "slave"]




salve节点(节点二) 192.168.100.13上的配置：安装elasticsearch (同上elasticsearch安装)

[iyunv@slave elasticsearch]# egrep -v "^$|^#" config/elasticsearch.yml     

1 2 3 4 5 6 7

cluster.name: elasticsearch-cluster node.name: slave discovery.zen.ping.unicast.hosts: ["master", "slave"] path.data: /tmp/elasticsearch/data path.logs: /tmp/elasticsearch/logs network.host: 0.0.0.0 network.port: 9200

slave启动elasticsearch

1	[iyunv@slave elasticsearch]# sudo su - elasticsearch /usr/local/elasticsearch/bin/elasticsearch

【验证】
访问插件查看集群状态

http://192.168.100.10:9200/_plugin/head/




或者使用:
API检查

1	[iyunv@master etc]# curl 192.168.100.10:9200/_cluster/health?pretty

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

{   "cluster_name" : "elasticsearch",   "status" : "yellow",   "timed_out" : false,   "number_of_nodes" : 1,   "number_of_data_nodes" : 1,   "active_primary_shards" : 26,   "active_shards" : 26,   "relocating_shards" : 0,   "initializing_shards" : 0,   "unassigned_shards" : 26,   "delayed_unassigned_shards" : 0,   "number_of_pending_tasks" : 0,   "number_of_in_flight_fetch" : 0,   "task_max_waiting_in_queue_millis" : 0,   "active_shards_percent_as_number" : 50.0 }

状态意义
green所有主分片和从分片都可用
yellow所有主分片可用，但存在不可用的从分片
red存在不可用的主要分片
在接下来的章节，我们将学习一下什么是主要分片(primary shard) 和 从分片(replica shard)，并说明这些状态在实际环境中的意义。



【为黄不为绿色的原因】
我主节点配置文件修改后，木有重启，重启后即正常


【结果】




之后数据的存储路径会变成 elasticsearch-cluster 目录下面
/tmp/elasticsearch/data/elasticsearch-cluster


当然之前一个节点的数据当然是没有了，所以重新打开kibana会要新创建索引

数据目录中也只能看到今天的索引了
[iyunv@master tls]# ls /tmp/elasticsearch/data/elasticsearch-cluster/nodes/0/indices/
.kibana/             logstash-2016.05.15/






【看数据增加】
为了给它加点数据

1	[iyunv@master httpd]# for i in {1..100000}; do echo "mesaage $i" >> /var/log/messages ;done

看结果: