elasticsearch - 如何找出在Elasticsearch 6.4中加入或离开的节点

Question

我正在尝试找出在ElasticSearch 6.4中剩余的节点或加入的节点

看起来node_left和node_joined事件已从最新版本的惊奇索引中删除。
还有其他方法可以创建监视以在节点加入或离开群集时发出警报吗？除了查询总节点数之外？

有什么建议吗？

Answer 1

如果您使用的是indexing，则elasticsearch日志位于专用的监视集群中，那么您可以在监视集群中创建一个观察程序脚本，以查询诸如added，removed的特定关键字。

[2019-09-12T12:15:56,802][INFO ][o.e.c.s.ClusterService   ] [1.1.1.1] removed {{2.2.2.2}{_bm_BBMQQJCCVx6HbuBa_B}{n83UoTCLSiWOyfst-a_s0w}{2.2.2.2}{2.2.2.2:9300}{zone=sandeep-node, ml.enabled=true, tag=sandy-test},}, reason: zen-disco-receive(from master [master {3.3.3.3}{6V0mpFS4RXyE4K11eb1Iyg}{Q6uvX9ySQ5q00eZfme2cHA}{3.3.3.3}{3.3.3.3:9300}{ml.max_open_jobs=10, ml.enabled=true, tag=sandy-test, zone=sandeep-node} committed version [559]])
[2019-09-12T12:16:13,898][INFO ][o.e.c.s.ClusterSettings  ] [1.1.1.1] updating [cluster.routing.allocation.enable] from [none] to [all]
[2019-09-12T12:16:37,892][INFO ][o.e.c.s.ClusterService   ] [1.1.1.1] added {{2.2.2.2}{_bm_BBMQQJCCVx6HbuBa_B}{RToPW_2dQw2vqpMOYpLlTg}{2.2.2.2}{2.2.2.2:9300}{ml.max_open_jobs=10, ml.enabled=true, tag=sandy-test, zone=sandeep-node},}, reason: zen-disco-receive(from master [master {3.3.3.3}{6V0mpFS4RXyE4K11eb1Iyg}{Q6uvX9ySQ5q00eZfme2cHA}{3.3.3.3}{3.3.3.3:9300}{ml.max_open_jobs=10, ml.enabled=true, tag=sandy-test, zone=sandeep-node} committed version [580]])

下面是一个示例观察程序脚本，该脚本在索引 ERROR中查询 *-eslogs-*。 Elasticsearch日志被索引到所述索引中。

{
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "*-eslogs-*"
        ],
        "types": [],
        "body": {
          "size": 1,
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "analyze_wildcard": true,
                    "query": "Level: ERROR"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-5m",
                      "lte": "now",
                      "format": "epoch_millis"
                    }
                  }
                }
              ],
              "must_not": []
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "profile": "standard",
        "from": "Watcher Alert <DL-WATCH@BAR.com>",
        "to": [
          "DL-FOO@BAR.com>, DL-ANOTHER-FOO@BAR.com>"
        ],
        "subject": "Watcher Notification",
        "body": {
          "text": "There are {{ctx.payload.hits.total}} ERROR messages on Elasticsearch Cluster in the last 5 minutes.  \r\n One of the log entry below: \r\n {{ctx.payload.hits.hits.0}}"
        }
      }
    }
  }
}

另一种方法是 GET _cat/nodes，对节点总数进行计数，并在值大于或小于预定义阈值时发出警报。