Elasticsearch常用运维命令

Elasticsearch 的运维命令主要集中在使用其 RESTful API 上。这些命令可以通过任何 HTTP 客户端(如 curl、Kibana Dev Tools、Postman 等)来执行。

集群健康与状态信息

这是运维中最常用的一组命令,用于快速了解集群的整体状态。

查看集群健康状态

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
[root@k8s-192-168-1-140 ~]# PASSWORD=$(kubectl get secret quickstart-es-elastic-user -o go-template='{{.data.elastic | base64decode}}')
[root@k8s-192-168-1-140 ~]#


curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/health?pretty"

[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/health?pretty"
{
"cluster_name" : "quickstart",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 39,
"active_shards" : 39,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"unassigned_primary_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
[root@k8s-192-168-1-140 ~]#

查看集群详细状态(包含节点、索引信息)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
curl -s -XGET  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/state?pretty"

[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/state?pretty"
--------略
{
"state" : "STARTED",
"primary" : true,
"node" : "N9j3pRcUR06S4vCsRcdnWw",
"relocating_node" : null,
"shard" : 0,
"index" : ".internal.alerts-observability.metrics.alerts-default-000001",
"allocation_id" : {
"id" : "5onDdIVtS6WBHRBQeCB7PQ"
},
"relocation_failure_info" : {
"failed_attempts" : 0
}
},
{
"state" : "STARTED",
"primary" : true,
"node" : "N9j3pRcUR06S4vCsRcdnWw",
"relocating_node" : null,
"shard" : 0,
"index" : ".ds-ilm-history-7-2025.12.12-000001",
"allocation_id" : {
"id" : "58PpB0LGQ6iabrqO5VLKqw"
},
"relocation_failure_info" : {
"failed_attempts" : 0
}
}
]
}
},
"health" : {
"disk" : {
"high_watermark" : "90%",
"high_max_headroom" : "150gb",
"flood_stage_watermark" : "95%",
"flood_stage_max_headroom" : "100gb",
"frozen_flood_stage_watermark" : "95%",
"frozen_flood_stage_max_headroom" : "20gb"
},
"shard_limits" : {
"max_shards_per_node" : 1000,
"max_shards_per_node_frozen" : 3000
}
}
}
[root@k8s-192-168-1-140 ~]#

查看节点信息(节点角色、负载等)

1
2
3
4
5
6
curl -s -XGET  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/nodes?v&pretty"

[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/nodes?v&pretty"
ip heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name
172.20.246.81 20 90 2 0.12 0.24 0.30 cdfhilmrstw * quickstart-es-default-0
[root@k8s-192-168-1-140 ~]#

查看所有节点统计信息(CPU,内存,磁盘等)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
curl -s -XGET  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_nodes/stats?pretty"

[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_nodes/stats?pretty"
{
"_nodes" : {
"total" : 1,
"successful" : 1,
"failed" : 0
},
"cluster_name" : "quickstart",
"nodes" : {
"N9j3pRcUR06S4vCsRcdnWw" : {
"timestamp" : 1765552084622,
"name" : "quickstart-es-default-0",
"transport_address" : "172.20.246.81:9300",
"host" : "172.20.246.81",
"ip" : "172.20.246.81:9300",
"roles" : [
"data",
"data_cold",
"data_content",
"data_frozen",
"data_hot",
"data_warm",
"ingest",
"master",
"ml",
"remote_cluster_client",
"transform"
],
"attributes" : {
"k8s_node_name" : "k8s-192-168-1-140",
"transform.config_version" : "10.0.0",
"xpack.installed" : "true",
"ml.allocated_processors" : "4",
"ml.max_jvm_size" : "1073741824",
"ml.config_version" : "12.0.0",
"ml.machine_memory" : "2147483648",
"ml.allocated_processors_double" : "4.0"
},
"indices" : {
"docs" : {
"count" : 704,
"deleted" : 33,
"total_size_in_bytes" : 3277982
},
"shard_stats" : {
"total_count" : 39
},
"store" : {
"size_in_bytes" : 3463658,
"total_data_set_size_in_bytes" : 3463658,
"reserved_in_bytes" : 0
},
---------略
"indexing_pressure" : {
"memory" : {
"current" : {
"combined_coordinating_and_primary_in_bytes" : 0,
"coordinating_in_bytes" : 0,
"primary_in_bytes" : 0,
"replica_in_bytes" : 0,
"all_in_bytes" : 0
},
"total" : {
"combined_coordinating_and_primary_in_bytes" : 17013966,
"coordinating_in_bytes" : 6251254,
"primary_in_bytes" : 17072110,
"replica_in_bytes" : 0,
"all_in_bytes" : 17013966,
"coordinating_rejections" : 0,
"primary_rejections" : 0,
"replica_rejections" : 0,
"primary_document_rejections" : 0,
"large_operation_rejections" : 0
},
"limit_in_bytes" : 107374182
}
},
"repositories" : { },
"allocations" : {
"shards" : 39,
"undesired_shards" : 0,
"forecasted_ingest_load" : 0.0,
"forecasted_disk_usage_in_bytes" : 3540384,
"current_disk_usage_in_bytes" : 3540384
}
}
}
}

关键指标解读:

status: green(健康),yellow(数据完整,但副本未分配),red(数据丢失或主分片缺失),只有一个索引出现red则集群就是red。
number_of_nodes: 集群中节点总数。
unassigned_shards: 未分配的分片数,yellow 或 red 状态的直接原因,集群状态的修复,其实就是修复这里。

检查pending tasks

1
2
3
4
5
6
7
curl  -u "elastic:$PASSWORD" -k  "https://10.68.66.232:9200/_cluster/pending_tasks?pretty"

[root@k8s-192-168-1-140 ~]# curl -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/pending_tasks?pretty"
{
"tasks" : [ ]
}
[root@k8s-192-168-1-140 ~]#

检查节点统计(包括JVM)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
curl  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_nodes/stats/jvm?pretty"

[root@k8s-192-168-1-140 ~]# curl -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_nodes/stats/jvm?pretty"
{
"_nodes" : {
"total" : 1,
"successful" : 1,
"failed" : 0
},
"cluster_name" : "quickstart",
"nodes" : {
"N9j3pRcUR06S4vCsRcdnWw" : {
"timestamp" : 1765556768340,
"name" : "quickstart-es-default-0",
"transport_address" : "172.20.246.81:9300",
"host" : "172.20.246.81",
"ip" : "172.20.246.81:9300",
"roles" : [
"data",
"data_cold",
"data_content",
"data_frozen",
"data_hot",
"data_warm",
"ingest",
"master",
"ml",
"remote_cluster_client",
"transform"
],
"attributes" : {
"k8s_node_name" : "k8s-192-168-1-140",
"transform.config_version" : "10.0.0",
"xpack.installed" : "true",
"ml.allocated_processors" : "4",
"ml.max_jvm_size" : "1073741824",
"ml.config_version" : "12.0.0",
"ml.machine_memory" : "2147483648",
"ml.allocated_processors_double" : "4.0"
},
"jvm" : {
"timestamp" : 1765556768340,
"uptime_in_millis" : 8190447,
"mem" : {
"heap_used_in_bytes" : 367588160,
"heap_used_percent" : 34,
"heap_committed_in_bytes" : 1073741824,
"heap_max_in_bytes" : 1073741824,
"non_heap_used_in_bytes" : 254902992,
"non_heap_committed_in_bytes" : 288817152,
"pools" : {
"CodeHeap 'non-nmethods'" : {
"used_in_bytes" : 2897024,
"max_in_bytes" : 5832704,
"peak_used_in_bytes" : 3078400,
"peak_max_in_bytes" : 5832704
},
"Metaspace" : {
"used_in_bytes" : 188019056,
"max_in_bytes" : 0,
"peak_used_in_bytes" : 188019056,
"peak_max_in_bytes" : 0
},
"CodeHeap 'profiled nmethods'" : {
"used_in_bytes" : 22557696,
"max_in_bytes" : 122908672,
"peak_used_in_bytes" : 47959168,
"peak_max_in_bytes" : 122908672
},
"Compressed Class Space" : {
"used_in_bytes" : 22554848,
"max_in_bytes" : 1073741824,
"peak_used_in_bytes" : 22558024,
"peak_max_in_bytes" : 1073741824
},
"young" : {
"used_in_bytes" : 218103808,
"max_in_bytes" : 0,
"peak_used_in_bytes" : 629145600,
"peak_max_in_bytes" : 0
},
"old" : {
"used_in_bytes" : 142159792,
"max_in_bytes" : 1073741824,
"peak_used_in_bytes" : 142159792,
"peak_max_in_bytes" : 1073741824
},
"survivor" : {
"used_in_bytes" : 7324560,
"max_in_bytes" : 0,
"peak_used_in_bytes" : 54525952,
"peak_max_in_bytes" : 0
},
"CodeHeap 'non-profiled nmethods'" : {
"used_in_bytes" : 18874368,
"max_in_bytes" : 122916864,
"peak_used_in_bytes" : 21230464,
"peak_max_in_bytes" : 122916864
}
}
},
"threads" : {
"count" : 102,
"peak_count" : 107
},
"gc" : {
"collectors" : {
"young" : {
"collection_count" : 49,
"collection_time_in_millis" : 567
},
"G1 Concurrent GC" : {
"collection_count" : 32,
"collection_time_in_millis" : 299
},
"old" : {
"collection_count" : 0,
"collection_time_in_millis" : 0
}
}
},
"buffer_pools" : {
"mapped" : {
"count" : 0,
"used_in_bytes" : 0,
"total_capacity_in_bytes" : 0
},
"direct" : {
"count" : 19,
"used_in_bytes" : 4849681,
"total_capacity_in_bytes" : 4849675
},
"mapped - 'non-volatile memory'" : {
"count" : 0,
"used_in_bytes" : 0,
"total_capacity_in_bytes" : 0
}
},
"classes" : {
"current_loaded_count" : 37618,
"total_loaded_count" : 39057,
"total_unloaded_count" : 1439
}
}
}
}
}
[root@k8s-192-168-1-140 ~]#

索引管理

简单创建索引

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
curl -X PUT  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby?pretty" -H 'Content-Type: application/json' -d'
{
"settings": {
"number_of_shards": 3,
"number_of_replicas": 1
},
"mappings": {
"properties": {
"title": { "type": "text" },
"content": { "type": "text" },
"timestamp": { "type": "date" }
}
}
}
'


[root@k8s-192-168-1-140 ~]# curl -X PUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby?pretty" -H 'Content-Type: application/json' -d'
{
"settings": {
"number_of_shards": 3,
"number_of_replicas": 1
},
"mappings": {
"properties": {
"title": { "type": "text" },
"content": { "type": "text" },
"timestamp": { "type": "date" }
}
}
}
'


{
"acknowledged" : true,
"shards_acknowledged" : true,
"index" : "cby"
}
[root@k8s-192-168-1-140 ~]#

查看所有索引(包含文档数、存储大小等)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
curl -s -XGET  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/indices?v&pretty"

[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/indices?v&pretty"
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size dataset.size
green open .internal.alerts-transform.health.alerts-default-000001 a2rSAm8mS-SrwYku3uAYLQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.logs.alerts-default-000001 kfuEckcpSmGERMea6-K7SQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.uptime.alerts-default-000001 LjhwWuZjRlah9zJKu2Q1bQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-ml.anomaly-detection.alerts-default-000001 1T4CZbf5T8SG1goXXn-07w 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.slo.alerts-default-000001 4M4iza7KQCaU2t_y6E5smQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-default.alerts-default-000001 y1re-StiTG-aoC6sSgcGXA 1 0 0 0 249b 249b 249b
green open .internal.alerts-streams.alerts-default-000001 RNM1iJUnSvOpqy4KPNFwBQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.apm.alerts-default-000001 gWZKJICPQtO8-hNQsWfn8A 1 0 0 0 249b 249b 249b
green open .internal.alerts-security.attack.discovery.alerts-default-000001 AW_JMgIZSjaEyHDmQapViA 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.metrics.alerts-default-000001 cPLbEFixQF2tJO7hY0GK4A 1 0 0 0 249b 249b 249b
green open .internal.alerts-ml.anomaly-detection-health.alerts-default-000001 yFWgfEPoQiKnfjYYd_9rfA 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.threshold.alerts-default-000001 OfniPqsZRvWm4p0ybqZfEw 1 0 0 0 249b 249b 249b
green open .internal.alerts-security.alerts-default-000001 4DrPeUpGRcm2VVlK2tytbQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-dataset.quality.alerts-default-000001 1nWfrX_DTKO4VDuLULH9hw 1 0 0 0 249b 249b 249b
yellow open cby Xu_XibxhQGSSdVTvZac3OA 3 1 0 0 681b 681b 681b
green open .internal.alerts-stack.alerts-default-000001 sqLxcGqeS22EbJJ2XBMJvQ 1 0 0 0 249b 249b 249b
[root@k8s-192-168-1-140 ~]#

查看特定索引的状态

1
2
3
4
5
6
7
curl -s -XGET  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/indices/cby?v&pretty"

[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/indices/cby?v&pretty"
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size dataset.size
yellow open cby Xu_XibxhQGSSdVTvZac3OA 3 1 0 0 681b 681b 681b
[root@k8s-192-168-1-140 ~]#

查看索引的详细统计信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
curl -s -XGET  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_stats?pretty"

[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_stats?pretty"
{
"_shards" : {
"total" : 6,
"successful" : 3,
"failed" : 0
},
"_all" : {
"primaries" : {
"docs" : {
"count" : 0,
"deleted" : 0,
"total_size_in_bytes" : 0
},
-----略
"dense_vector" : {
"value_count" : 0,
"off_heap" : {
"total_size_bytes" : 0,
"total_veb_size_bytes" : 0,
"total_vec_size_bytes" : 0,
"total_veq_size_bytes" : 0,
"total_vex_size_bytes" : 0
}
},
"sparse_vector" : {
"value_count" : 0
}
}
}
}
}
[root@k8s-192-168-1-140 ~]#

查看索引的映射(mapping)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
curl -s -XGET  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_mapping?pretty"

[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_mapping?pretty"
{
"cby" : {
"mappings" : {
"properties" : {
"content" : {
"type" : "text"
},
"timestamp" : {
"type" : "date"
},
"title" : {
"type" : "text"
}
}
}
}
}
[root@k8s-192-168-1-140 ~]#

查看索引的设置(settings)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
curl -s -XGET  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings?pretty"

[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings?pretty"
{
"cby" : {
"settings" : {
"index" : {
"routing" : {
"allocation" : {
"include" : {
"_tier_preference" : "data_content"
}
}
},
"number_of_shards" : "3",
"provided_name" : "cby",
"creation_date" : "1765552408698",
"number_of_replicas" : "1",
"uuid" : "Xu_XibxhQGSSdVTvZac3OA",
"version" : {
"created" : "9039002"
}
}
}
}
}
[root@k8s-192-168-1-140 ~]#

删除索引(危险操作!)

1
2
3
4
5
6

curl -XDELETE -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby"

[root@k8s-192-168-1-140 ~]# curl -XDELETE -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby"
{"acknowledged":true}
[root@k8s-192-168-1-140 ~]#

关闭索引(保留数据但不再读写,节省资源)

1
2
3
4
5
curl -XPOST  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_close"

[root@k8s-192-168-1-140 ~]# curl -XPOST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_close"
{"acknowledged":true,"shards_acknowledged":true,"indices":{"cby":{"closed":true}}}
[root@k8s-192-168-1-140 ~]#

打开索引

1
2
3
4
5
curl -XPOST  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_open"

[root@k8s-192-168-1-140 ~]# curl -XPOST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_open"
{"acknowledged":true,"shards_acknowledged":true}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]#

修改索引配置(如动态修改副本数)

1
2
3
4
5
6
curl -XPUT  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings" -H 'Content-Type: application/json' -d' { "number_of_replicas": 2 } '


[root@k8s-192-168-1-140 ~]# curl -XPUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings" -H 'Content-Type: application/json' -d' { "number_of_replicas": 2 } '
{"acknowledged":true}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]#

查看分片分配情况(非常重要!)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
curl -s -XGET  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/shards?v&pretty"


[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/shards?v&pretty"
index shard prirep state docs store dataset ip node
.kibana_search_solution_9.2.2_001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.slo-observability.summary-v3.5 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.kibana_task_manager_9.2.2_001 0 p STARTED 48 90.1kb 90.1kb 172.20.246.81 quickstart-es-default-0
.kibana_usage_counters_9.2.2_001 0 p STARTED 82 64.9kb 64.9kb 172.20.246.81 quickstart-es-default-0
.kibana_alerting_cases_9.2.2_001 0 p STARTED 1 7.5kb 7.5kb 172.20.246.81 quickstart-es-default-0
cby 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
cby 0 r UNASSIGNED
cby 0 r UNASSIGNED
cby 1 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
cby 1 r UNASSIGNED
cby 1 r UNASSIGNED
cby 2 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
cby 2 r UNASSIGNED
cby 2 r UNASSIGNED
.slo-observability.summary-v3.5.temp 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-observability.slo.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.kibana_locks-000001 0 p STARTED 0 3.6kb 3.6kb 172.20.246.81 quickstart-es-default-0
.ds-.edr-workflow-insights-default-2025.12.12-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.kibana_9.2.2_001 0 p STARTED 88 86.4kb 86.4kb 172.20.246.81 quickstart-es-default-0
.ds-ilm-history-7-2025.12.12-000001 0 p STARTED 48 34.7kb 34.7kb 172.20.246.81 quickstart-es-default-0
.internal.alerts-observability.apm.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-observability.threshold.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-stack.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-transform.health.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-dataset.quality.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-streams.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-observability.uptime.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.ds-.logs-elasticsearch.deprecation-default-2025.12.12-000001 0 p STARTED 4 34.6kb 34.6kb 172.20.246.81 quickstart-es-default-0
.apm-agent-configuration 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-observability.metrics.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.slo-observability.sli-v3.5 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-ml.anomaly-detection.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.kibana_security_solution_9.2.2_001 0 p STARTED 6 61.4kb 61.4kb 172.20.246.81 quickstart-es-default-0
.internal.alerts-default.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-security.attack.discovery.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-security.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.kibana_ingest_9.2.2_001 0 p STARTED 143 294.3kb 294.3kb 172.20.246.81 quickstart-es-default-0
.internal.alerts-observability.logs.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.ds-.kibana-event-log-ds-2025.12.12-000001 0 p STARTED 1 6.3kb 6.3kb 172.20.246.81 quickstart-es-default-0
.kibana-siem-rule-migrations-integrations 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.kibana_analytics_9.2.2_001 0 p STARTED 5 1.7mb 1.7mb 172.20.246.81 quickstart-es-default-0
.security-profile-8 0 p STARTED 1 19.9kb 19.9kb 172.20.246.81 quickstart-es-default-0
.kibana_security_session_1 0 p STARTED 2 13.6kb 13.6kb 172.20.246.81 quickstart-es-default-0
.apm-custom-link 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.internal.alerts-ml.anomaly-detection-health.alerts-default-000001 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.apm-source-map 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
.security-7 0 p STARTED 288 771.8kb 771.8kb 172.20.246.81 quickstart-es-default-0
.kibana-siem-rule-migrations-prebuiltrules 0 p STARTED 0 249b 249b 172.20.246.81 quickstart-es-default-0
[root@k8s-192-168-1-140 ~]#

查看未分配的分片及原因

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
curl -s -XGET  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/shards?v&h=index,shard,prirep,state,unassigned.reason&s=state&pretty"


[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/shards?v&h=index,shard,prirep,state,unassigned.reason&s=state&pretty"
index shard prirep state unassigned.reason
cby 0 r UNASSIGNED INDEX_REOPENED
cby 0 r UNASSIGNED REPLICA_ADDED
cby 1 r UNASSIGNED INDEX_REOPENED
cby 1 r UNASSIGNED REPLICA_ADDED
cby 2 r UNASSIGNED INDEX_REOPENED
cby 2 r UNASSIGNED REPLICA_ADDED
.kibana_search_solution_9.2.2_001 0 p STARTED
.slo-observability.summary-v3.5 0 p STARTED
.kibana_task_manager_9.2.2_001 0 p STARTED
.kibana_usage_counters_9.2.2_001 0 p STARTED
.kibana_alerting_cases_9.2.2_001 0 p STARTED
cby 0 p STARTED
cby 1 p STARTED
cby 2 p STARTED
.slo-observability.summary-v3.5.temp 0 p STARTED
.internal.alerts-observability.slo.alerts-default-000001 0 p STARTED
.kibana_locks-000001 0 p STARTED
.ds-.edr-workflow-insights-default-2025.12.12-000001 0 p STARTED
.kibana_9.2.2_001 0 p STARTED
.ds-ilm-history-7-2025.12.12-000001 0 p STARTED
.internal.alerts-observability.apm.alerts-default-000001 0 p STARTED
.internal.alerts-observability.threshold.alerts-default-000001 0 p STARTED
.internal.alerts-stack.alerts-default-000001 0 p STARTED
.internal.alerts-transform.health.alerts-default-000001 0 p STARTED
.internal.alerts-dataset.quality.alerts-default-000001 0 p STARTED
.internal.alerts-streams.alerts-default-000001 0 p STARTED
.internal.alerts-observability.uptime.alerts-default-000001 0 p STARTED
.ds-.logs-elasticsearch.deprecation-default-2025.12.12-000001 0 p STARTED
.apm-agent-configuration 0 p STARTED
.internal.alerts-observability.metrics.alerts-default-000001 0 p STARTED
.slo-observability.sli-v3.5 0 p STARTED
.internal.alerts-ml.anomaly-detection.alerts-default-000001 0 p STARTED
.kibana_security_solution_9.2.2_001 0 p STARTED
.internal.alerts-default.alerts-default-000001 0 p STARTED
.internal.alerts-security.attack.discovery.alerts-default-000001 0 p STARTED
.internal.alerts-security.alerts-default-000001 0 p STARTED
.kibana_ingest_9.2.2_001 0 p STARTED
.internal.alerts-observability.logs.alerts-default-000001 0 p STARTED
.ds-.kibana-event-log-ds-2025.12.12-000001 0 p STARTED
.kibana-siem-rule-migrations-integrations 0 p STARTED
.kibana_analytics_9.2.2_001 0 p STARTED
.security-profile-8 0 p STARTED
.kibana_security_session_1 0 p STARTED
.apm-custom-link 0 p STARTED
.internal.alerts-ml.anomaly-detection-health.alerts-default-000001 0 p STARTED
.apm-source-map 0 p STARTED
.security-7 0 p STARTED
.kibana-siem-rule-migrations-prebuiltrules 0 p STARTED
[root@k8s-192-168-1-140 ~]#

清除节点的缓存

1
2
3
4
5
curl -XPOST  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_cache/clear"

[root@k8s-192-168-1-140 ~]# curl -XPOST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_cache/clear"
{"_shards":{"total":9,"successful":3,"failed":0}}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]#

清除所有的缓存

1
2
3
4
5
6
7
8
9
10
11
12
curl -XPOST  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cache/clear?pretty"

[root@k8s-192-168-1-140 ~]# curl -XPOST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cache/clear?pretty"
{
"_shards" : {
"total" : 21,
"successful" : 18,
"failed" : 0
}
}
[root@k8s-192-168-1-140 ~]#

将节点排除出集群(下线节点)

1
curl -XPUT  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/settings" -H 'Content-Type: application/json' -d' { "transient": { "cluster.routing.allocation.exclude._name": "node-name-to-remove" } } '

查看正在运行的任务(如 _forcemerge, reindex)

1
2
3
4
5
6
7
8
9
curl -s -XGET  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/tasks?v&pretty"

[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/tasks?v&pretty"
action task_id parent_task_id type start_time timestamp running_time ip node
geoip-downloader[c] N9j3pRcUR06S4vCsRcdnWw:340 cluster:1 persistent 1765548603189 14:10:03 1.2h 172.20.246.81 quickstart-es-default-0
health-node[c] N9j3pRcUR06S4vCsRcdnWw:350 cluster:2 persistent 1765548603882 14:10:03 1.2h 172.20.246.81 quickstart-es-default-0
cluster:monitor/tasks/lists N9j3pRcUR06S4vCsRcdnWw:53136 - transport 1765553067275 15:24:27 498micros 172.20.246.81 quickstart-es-default-0
cluster:monitor/tasks/lists[n] N9j3pRcUR06S4vCsRcdnWw:53137 N9j3pRcUR06S4vCsRcdnWw:53136 transport 1765553067275 15:24:27 420.9micros 172.20.246.81 quickstart-es-default-0
[root@k8s-192-168-1-140 ~]#

查看热点线程(用于诊断性能问题)

1
2
3
4
5
6
7
curl -s -XGET  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_nodes/hot_threads?pretty"

[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_nodes/hot_threads?pretty"
::: {quickstart-es-default-0}{N9j3pRcUR06S4vCsRcdnWw}{ob3LpO08ReyXSUqr6OkHDQ}{quickstart-es-default-0}{172.20.246.81}{172.20.246.81:9300}{cdfhilmrstw}{9.2.2}{8000099-9039002}{k8s_node_name=k8s-192-168-1-140, transform.config_version=10.0.0, xpack.installed=true, ml.allocated_processors=4, ml.max_jvm_size=1073741824, ml.config_version=12.0.0, ml.machine_memory=2147483648, ml.allocated_processors_double=4.0}
Hot threads at 2025-12-12T16:31:15.859Z, interval=500ms, busiestThreads=3, ignoreIdleThreads=true:

[root@k8s-192-168-1-140 ~]#

查看集群设置

1
2
3
4
5
6
7
8
curl -s -XGET  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/settings?pretty"

[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cluster/settings?pretty"
{
"persistent" : { },
"transient" : { }
}
[root@k8s-192-168-1-140 ~]#

在索引中插入内容指定ID

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
curl -X POST  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_doc/123" -H 'Content-Type: application/json' -d'
{
"name": "Snow Crash",
"author": "Neal Stephenson",
"release_date": "1992-06-01",
"page_count": 470
}
'

[root@k8s-192-168-1-140 ~]# curl -X POST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_doc/123" -H 'Content-Type: application/json' -d'
{
"name": "Snow Crash",
"author": "Neal Stephenson",
"release_date": "1992-06-01",
"page_count": 470
}
'
{"_index":"cby","_id":"123","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":0,"_primary_term":3}

在索引中插入内容随机ID

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
curl -X POST  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_doc/" -H 'Content-Type: application/json' -d'
{
"name": "Snow Crash",
"author": "Neal Stephenson",
"release_date": "1992-06-01",
"page_count": 470
}
'

[root@k8s-192-168-1-140 ~]# curl -X POST -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_doc/" -H 'Content-Type: application/json' -d'
{
"name": "Snow Crash",
"author": "Neal Stephenson",
"release_date": "1992-06-01",
"page_count": 470
}
'
{"_index":"cby","_id":"ByNRE5sBdx0sYBy0kiOe","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":0,"_primary_term":3}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]#

统计索引中的量

1
2
3
4
5
6
curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_count'

[root@k8s-192-168-1-140 ~]# curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_count'
{"count":2,"_shards":{"total":3,"successful":3,"skipped":0,"failed":0}}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]#

查询索引中的数据内容

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_search?pretty'

[root@k8s-192-168-1-140 ~]# curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_search?pretty'
{
"took" : 8,
"timed_out" : false,
"_shards" : {
"total" : 3,
"successful" : 3,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 2,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "cby",
"_id" : "123",
"_score" : 1.0,
"_source" : {
"name" : "Snow Crash",
"author" : "Neal Stephenson",
"release_date" : "1992-06-01",
"page_count" : 470
}
},
{
"_index" : "cby",
"_id" : "ByNRE5sBdx0sYBy0kiOe",
"_score" : 1.0,
"_source" : {
"name" : "Snow Crash",
"author" : "Neal Stephenson",
"release_date" : "1992-06-01",
"page_count" : 470
}
}
]
}
}
[root@k8s-192-168-1-140 ~]#

删除指定索引中的数据内容

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
curl -X DELETE  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_doc/123"

[root@k8s-192-168-1-140 ~]# curl -X DELETE -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_doc/123"
{"_index":"cby","_id":"123","_version":2,"result":"deleted","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":1,"_primary_term":3}

[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]# curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_search?pretty'
{
"took" : 25,
"timed_out" : false,
"_shards" : {
"total" : 3,
"successful" : 3,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "cby",
"_id" : "ByNRE5sBdx0sYBy0kiOe",
"_score" : 1.0,
"_source" : {
"name" : "Snow Crash",
"author" : "Neal Stephenson",
"release_date" : "1992-06-01",
"page_count" : 470
}
}
]
}
}
[root@k8s-192-168-1-140 ~]#

设检查索引统计

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
curl  -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/indices?v&s=index"

[root@k8s-192-168-1-140 ~]# curl -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/_cat/indices?v&s=index"
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size dataset.size
green open .internal.alerts-dataset.quality.alerts-default-000001 1nWfrX_DTKO4VDuLULH9hw 1 0 0 0 249b 249b 249b
green open .internal.alerts-default.alerts-default-000001 y1re-StiTG-aoC6sSgcGXA 1 0 0 0 249b 249b 249b
green open .internal.alerts-ml.anomaly-detection-health.alerts-default-000001 yFWgfEPoQiKnfjYYd_9rfA 1 0 0 0 249b 249b 249b
green open .internal.alerts-ml.anomaly-detection.alerts-default-000001 1T4CZbf5T8SG1goXXn-07w 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.apm.alerts-default-000001 gWZKJICPQtO8-hNQsWfn8A 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.logs.alerts-default-000001 kfuEckcpSmGERMea6-K7SQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.metrics.alerts-default-000001 cPLbEFixQF2tJO7hY0GK4A 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.slo.alerts-default-000001 4M4iza7KQCaU2t_y6E5smQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.threshold.alerts-default-000001 OfniPqsZRvWm4p0ybqZfEw 1 0 0 0 249b 249b 249b
green open .internal.alerts-observability.uptime.alerts-default-000001 LjhwWuZjRlah9zJKu2Q1bQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-security.alerts-default-000001 4DrPeUpGRcm2VVlK2tytbQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-security.attack.discovery.alerts-default-000001 AW_JMgIZSjaEyHDmQapViA 1 0 0 0 249b 249b 249b
green open .internal.alerts-stack.alerts-default-000001 sqLxcGqeS22EbJJ2XBMJvQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-streams.alerts-default-000001 RNM1iJUnSvOpqy4KPNFwBQ 1 0 0 0 249b 249b 249b
green open .internal.alerts-transform.health.alerts-default-000001 a2rSAm8mS-SrwYku3uAYLQ 1 0 0 0 249b 249b 249b
yellow open cby zKsFpdUaTJaO0MBUyQ-O4g 3 1 1 0 6.7kb 6.7kb 6.7kb
[root@k8s-192-168-1-140 ~]#

查询指定字段为某值的数据

1
2
3
4
5
6
7
8
9
10
11
12
13
curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_search?q=page_count:470'

[root@k8s-192-168-1-140 ~]# curl -XGET -u "elastic:$PASSWORD" -k 'https://10.68.66.232:9200/cby/_search?q=page_count:470'
{"took":1,"timed_out":false,"_shards":{"total":3,"successful":3,"skipped":0,"failed":0},"hits":{"total":{"value":1,"relation":"eq"},"max_score":1.0,"hits":[{"_index":"cby","_id":"ByNRE5sBdx0sYBy0kiOe","_score":1.0,"_source":
{
"name": "Snow Crash",
"author": "Neal Stephenson",
"release_date": "1992-06-01",
"page_count": 470
}
}]}}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]#

重置refesh_interval

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
curl -X PUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings" -H "Content-Type: application/json" -d'{"refresh_interval": null}'

[root@k8s-192-168-1-140 ~]# curl -X PUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings" -H "Content-Type: application/json" -d'{"refresh_interval": null}'
{"acknowledged":true}

[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings?pretty"
{
"cby" : {
"settings" : {
"index" : {
"routing" : {
"allocation" : {
"include" : {
"_tier_preference" : "data_content"
}
}
},
"number_of_shards" : "3",
"provided_name" : "cby",
"creation_date" : "1765552854698",
"number_of_replicas" : "1",
"uuid" : "zKsFpdUaTJaO0MBUyQ-O4g",
"version" : {
"created" : "9039002"
}
}
}
}
}
[root@k8s-192-168-1-140 ~]#

设置refesh_interval时间

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
curl -X PUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings" -H "Content-Type: application/json" -d'{"refresh_interval": "30s"}'

[root@k8s-192-168-1-140 ~]# curl -X PUT -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings" -H "Content-Type: application/json" -d'{"refresh_interval": "30s"}'

{"acknowledged":true}[root@k8s-192-168-1-140 ~]#
[root@k8s-192-168-1-140 ~]# curl -s -XGET -u "elastic:$PASSWORD" -k "https://10.68.66.232:9200/cby/_settings?pretty"
{
"cby" : {
"settings" : {
"index" : {
"routing" : {
"allocation" : {
"include" : {
"_tier_preference" : "data_content"
}
}
},
"refresh_interval" : "30s",
"number_of_shards" : "3",
"provided_name" : "cby",
"creation_date" : "1765552854698",
"number_of_replicas" : "1",
"uuid" : "zKsFpdUaTJaO0MBUyQ-O4g",
"version" : {
"created" : "9039002"
}
}
}
}
}
[root@k8s-192-168-1-140 ~]#

关于

https://www.oiox.cn/

https://www.oiox.cn/index.php/start-page.html

CSDN、GitHub、知乎、开源中国、思否、掘金、简书、华为云、阿里云、腾讯云、哔哩哔哩、今日头条、新浪微博、个人博客

全网可搜《小陈运维》

文章主要发布于微信公众号:《Linux运维交流社区》