ELKStack(ELASTICSEARCH)几个常见问题的解决

curl -XPUT 127.0.0.1:9200/_snapshot/backup -d '
{
    "type":"fs",
    "settings":{"location":"/opt/elk/snapshot/"}
}'

出现unassigned shards的手工修复方法

curl -XPOST 'localhost:9200/_cluster/reroute' -d '{
    "commands" : [ {
          "allocate" : {
              "index" : "logstash-ksmobile-2015.05",
              "shard" : 0,
              "node" : "0G0Gu4NNTTOtOi0LH_hdfg",
              "allow_primary" : true
          }
        }
    ]
}'

出现大量unassigned shards的批量修复方法

master=$(curl -s 'http://localhost:9200/_cat/master?v' | grep -v ' ip ' | awk '{print $1}')
for index in $(curl  -s 'http://localhost:9200/_cat/shards' | grep UNASSIGNED | awk '{print $1}' | sort | uniq); do
    for shard in $(curl  -s 'http://localhost:9200/_cat/shards' | grep UNASSIGNED | grep $index | awk '{print $2}' | sort | uniq); do
        echo  $index $shard

        curl -XPOST 'http://localhost:9200/_cluster/reroute' -d '{
            "commands" : [ {
                  "allocate" : {
                      "index" : "'$index'",
                      "shard" : "'$shard'",
                      "node" : "'$master'",
                      "allow_primary" : true
                  }
                }
            ]
        }'

        sleep 5
    done
done

via:http://www.wklken.me/posts/2015/05/23/elasticsearch-issues.html
via:http://keenwon.com/1393.html

ELK中无法启动kibana,解决“Elasticsearch is still initializing the kibana index... ”

kibana出现无法启动的问题,5601端口未连接,但进程存在,查看日志发现有如下报错

"Elasticsearch is still initializing the kibana index... Trying again in 2.5 second."

ps:查看日志可以用 kibana -l xxx.log

{"name":"Kibana","hostname":"kt52","pid":3607,"level":30,"msg":"Elasticsearch is still initializing the kibana index... Trying again in 2.5 second.","time":"2015-07-10T02:40:12.473Z","v":0}

一开始以为是集群中es的索引有问题,将5台机器的索引删除了也不顶用,浪费了一天时间。后来发现需要删除.kibana的索引。

解决办法
1. /_plugin/gui/ 使用gui删除.kibana的索引
2. curl -XDELETE http://localhost:9200/.kibana