ELK:日常维护系列(4)

日志系统未分片处理过程

curl -XGET localhost:9200/_cat/shards?h=index,shard,prirep,state,unassigned.details | grep UNASSIGNED

其中details 能清晰的说明分片是卡在那里，触发的情况通常有两种。

1. 主分片和副本分片被放置到同一个节点，这个引发的原因是你强控制索引均衡分布时

total_shards_per_node=shard_total/ node_num 

{ - 
  "xxx-2021.02.08": { - 
    "settings": { - 
      "index": { - 
        "routing": { - 
          "allocation": { - 
            "total_shards_per_node": "2"
          }
        },
        "mapping": { - 
          "depth": { - 
            "limit": "9"
          }
        },
        "refresh_interval": "60s",
        "number_of_shards": "5",
        "translog": { - 
          "flush_threshold_size": "128mb",
          "sync_interval": "30s",
          "durability": "async"
        },
        "provided_name": "xxx-2021.02.08",
        "creation_date": "1612711801181",
        "unassigned": { - 
          "node_left": { - 
            "delayed_timeout": "5m"
          }
        },
        "number_of_replicas": "1",
        "uuid": "NfmAszgrTdadYoYEarPENQ",
        "version": { - 
          "created": "7060299"
        }
      }
    }
  }
}

2. 由于重试次数达到了上限,试着在合理的范围内增大他

{
  "index.allocation.max_retries": 26
}