elasticsearch故障解决方案

报错查看

查看具体报错信息

[root@prod-crs-elk-a ~]# curl http://127.0.0.1:9200/_cluster/allocation/explain
{“index”:”prod-elk-log-2023-02-20″,”shard”:0,”primary”:false,”current_state”:”unassigned”,”unassigned_info”:{“reason”:”CLUSTER_RECOVERED”,”at”:”2023-04-11T07:10:33.837Z”,”last_allocation_status”:”no_attempt”},”can_allocate”:”no”,”allocate_explanation”:”cannot allocate because allocation is not permitted to any of the nodes”,”node_allocation_decisions”:[{“node_id”:”LJhLqZPFSMCaeH25BQBZ4w”,”node_name”:”prod-crs-elk-a”,”transport_address”:”127.0.0.1:9300″,”node_attributes”:{“ml.machine_memory”:”33566990336″,”xpack.installed”:”true”,”transform.node”:”true”,”ml.max_open_jobs”:”20″},”node_decision”:”no”,”deciders”:[{“decider”:”same_shard”,”decision”:”NO”,”explanation”:”a copy of this shard is already allocated to this node [[prod-elk-log-2023-02-20][0], node[LJhLqZPFSMCaeH25BQBZ4w], [P], s[STARTED], a[id=OQ1vOkXDR6SRbhFQr0tZNw]]”}]}]}

原因解释

在返回结果中给出了导致分片未分配的详细信息，reason 给出了分片最初未分配的原因，可以理解成 unassigned 是什么操作触发的；allocate_explanation 则进一步的说明，该分片无法被分配到任何节点，而无法分配的具体原因在 deciders 的 explanation 信息中详细描述。

报错中a copy of this shard is already allocated to this node是集群yellow的详细原因， 这个由于这个复制分片已经分配到此节点， 那么解决方案就是把复制分片设置为0【number_of_replicas: 0】， 根据上面的解释是index:prod-elk-log-2023-02-20已有分片

处理方案：

设置number_of_replicas为0

再次查看

[root@prod-crs-elk-a logs]# curl http://127.0.0.1:9200/_cluster/health?pretty
{
  "cluster_name" : "elasticsearch",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "active_primary_shards" : 198,
  "active_shards" : 198,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}

已经正常了。

服务器租用托管，机房租用托管，主机租用托管，https://www.e1idc.com