初探ELK-elasticsearch使用小结
Posted
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了初探ELK-elasticsearch使用小结相关的知识，希望对你有一定的参考价值。
初探ELK-elasticsearch使用小结
2016/9/12
一、安装 1、jdk 和 环境变量 支持jdk-1.7以上，推荐jdk-1.8 在环境变量配置：JAVA_HOME 2、安装 有2种方式下载，推荐缓存rpm包到本地yum源 1）直接使用rpm wget https://download.elastic.co/elasticsearch/release/org/elasticsearch/distribution/rpm/elasticsearch/2.4.0/elasticsearch-2.4.0.rpm 2）使用yum源 [[email protected] ~]# vim /etc/yum.repos.d/elasticsearch.repo [elasticsearch-2.x] name=Elasticsearch repository for 2.x packages baseurl=https://packages.elastic.co/elasticsearch/2.x/centos gpgcheck=1 gpgkey=https://packages.elastic.co/GPG-KEY-elasticsearch enabled=1 [[email protected] ~]# yum install elasticsearch 3）启动服务 [[email protected] ~]# chkconfig elasticsearch on [[email protected] ~]# service elasticsearch start 3、调整配置 [[email protected] ~]# mkdir -p /data/elasticsearch [[email protected] ~]# chown elasticsearch:elasticsearch /data/elasticsearch [[email protected] ~]# grep ^[^#] /etc/elasticsearch/elasticsearch.yml cluster.name: es-test node.name: node-1 path.data: /data/elasticsearch path.logs: /var/log/elasticsearch [[email protected] ~]# service elasticsearch restart 二、使用 REST API 1、能干啥 Check your cluster, node, and index health, status, and statistics Administer your cluster, node, and index data and metadata Perform CRUD (Create, Read, Update, and Delete) and search operations against your indexes Execute advanced search operations such as paging, sorting, filtering, scripting, aggregations, and many others 使用 curl 来操作 API 的方式： curl -X<REST Verb> <Node>:<Port>/<Index>/<Type>/<ID> 2、管理 1）健康状态 [[email protected] ~]# curl ‘localhost:9200/_cat/health?v‘ epoch timestamp cluster status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent 1473669150 16:32:30 es-test green 1 1 0 0 0 0 0 0 - 100.0% health 的状态包括：green, yellow, red. Green means everything is good (cluster is fully functional), yellow means all data is available but some replicas are not yet allocated (cluster is fully functional) red means some data is not available for whatever reason 2）列出节点 [[email protected] ~]# curl ‘localhost:9200/_cat/nodes?v‘ host ip heap.percent ram.percent load node.role master name 127.0.0.1 127.0.0.1 6 16 0.00 d * node-1 3）列出索引 [[email protected] ~]# curl ‘localhost:9200/_cat/indices?v‘ health status index pri rep docs.count docs.deleted store.size pri.store.size 3、CRUD操作 1）创建索引 [[email protected] ~]# curl -XPUT ‘localhost:9200/customer?pretty‘ { "acknowledged" : true } 创建了一个索引“customer”，且告知返回时使用一个 pretty-print 的方式（json） 再次列出索引 [[email protected] ~]# curl ‘localhost:9200/_cat/indices?v‘ health status index pri rep docs.count docs.deleted store.size pri.store.size yellow open customer 5 1 0 0 650b 650b 请对比一下之前的执行结果。 请注意，这里的 health 是 yellow，因为我们目前只有一个es节点，没有副本，未做到高可用。 2）给上述索引创建一个 doc 索引 customer 类型为： "external" ，ID为：1 [[email protected] ~]# curl -XPUT ‘localhost:9200/customer/external/1?pretty‘ -d ‘ { "name": "John Doe" }‘ 3）获取 doc [[email protected] ~]# curl -XGET ‘localhost:9200/customer/external/1?pretty‘ 4）重建索引 [[email protected] ~]# curl -XPUT ‘localhost:9200/customer/external/1?pretty‘ -d ‘ { "name": "Kelly Doe" }‘ 5）创建索引时，不指定ID，将随机生成 [[email protected] ~]# curl -XPOST ‘localhost:9200/customer/external?pretty‘ -d ‘ { "name": "Calvin Kern" }‘ 6）删除索引 [[email protected] ~]# curl -XDELETE ‘localhost:9200/customer?pretty‘ 7）更新 doc 中的数据 [[email protected] ~]# curl -XPOST ‘localhost:9200/customer/external/1/_update?pretty‘ -d ‘ { "doc": { "name": "Eric Mood" } }‘ 更新并增加： [[email protected] ~]# curl -XPOST ‘localhost:9200/customer/external/1/_update?pretty‘ -d ‘ { "doc": { "name": "Eric Mood", "age": 110 } }‘ 8）删除索引太直接了，如何只删除其中某个doc呢？ [[email protected] ~]# curl -XDELETE ‘localhost:9200/customer/external/1?pretty‘ 4、查看数据 1）导入测试数据： wget https://github.com/bly2k/files/blob/master/accounts.zip?raw=true -O accounts.zip unzip accounts.zip curl -XPOST ‘localhost:9200/bank/account/_bulk?pretty‘ --data-binary "@accounts.json" curl ‘localhost:9200/_cat/indices?v‘ 2）search 查看所有的数据： 方式一： curl ‘localhost:9200/bank/_search?q=*&pretty‘ 方式二： curl -XPOST ‘localhost:9200/bank/_search?pretty‘ -d ‘ { "query": { "match_all": {} } }‘ 查看指定的数据： curl -XPOST ‘localhost:9200/bank/_search?pretty‘ -d ‘ { "query": { "bool": { "must": [ { "match": { "age": "40" } } ], "must_not": [ { "match": { "state": "ID" } } ] } } }‘ 筛选数据： curl -XPOST ‘localhost:9200/bank/_search?pretty‘ -d ‘ { "query": { "bool": { "must": { "match_all": {} }, "filter": { "range": { "balance": { "gte": 20000, "lte": 30000 } } } } } }‘ 汇总数据： curl -XPOST ‘localhost:9200/bank/_search?pretty‘ -d ‘ { "size": 0, "aggs": { "group_by_state": { "terms": { "field": "state" } } } }‘ 备注：具体内容请参考官网doc ZYXW、参考 1、官网 https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-repositories.html https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration.html https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-dir-layout.html https://www.elastic.co/guide/en/elasticsearch/reference/current/_exploring_your_cluster.html
以上是关于初探ELK-elasticsearch使用小结的主要内容，如果未能解决你的问题，请参考以下文章