ElasticSearch | 易学教程

Elastic Search - Scroll behavior

阅读更多关于 Elastic Search - Scroll behavior

问题 I come across at least two possible ways to fetch the results in batches . Scroll API Pagination - From , Size parameters What is the fundamental difference ? I am assuming #1 allows to scroll over the records while #2 allows you to fetch a batch of records at a time . If i just use different From , Size parameters to drive pagination, are there chances where the same record will be returned in different batches? 回答1: Using from/size is the default and easiest way to paginate results. By

elasticsearch集群启动有问题可以考虑把es的进程杀掉

阅读更多关于 elasticsearch集群启动有问题可以考虑把es的进程杀掉

ps -ef | grep elastic [elsearch@cos7-1 bin]$ ps -ef | grep elastic elsearch 53362 53298 0 10:22 pts/5 00:00:00 vim elasticsearch.yml elsearch 56994 1 5 12:41 ? 00:00:25 /opt/elasticsearch-7.10.0/jdk/bin/java -Xshare:auto -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -XX:+ShowCodeDetailsInExceptionMessages -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas

Create java RestHighLevelClient in elastic cluster mode

阅读更多关于 Create java RestHighLevelClient in elastic cluster mode

问题 If elasticsearch runs on single mode, I can easily establish the RestHighLevel connection with this line of code: RestHighLevelClient client = new RestHighLevelClient( RestClient.builder( new HttpHost("localhost", 9200, "http"), new HttpHost("localhost", 9201, "http"))); But if my elastic cluster has 3 machines, e.g., "host1", "host2", "host3", how to create the rest high level client in cluster mode ? Thanks 回答1: RestHighLevelClient client = new RestHighLevelClient( RestClient.builder( new

Elastic：用Docker部署Elastic栈

阅读更多关于 Elastic：用Docker部署Elastic栈

安装因为我们需要使用docker来进行安装，我们必须安装： docker：根据不同的操作系统，请按照要求安装docker。可以到网站 https://docs.docker.com/去安装 docker-compose。这个可以到网站 https://docs.docker.com/compose/install/#install-using-pip去安装用docker来安装Elasticsearch 下载docker image 获取Docker的Elasticsearch就像对Elastic Docker注册表发出docker pull命令一样简单。 docker pull docker.elastic.co/elasticsearch/elasticsearch:7.3.2 上面是以Elasticsearch 7.3.2为例来示范的。在实际的使用中，可以替换它用自己喜欢的版本。开发或测试环境从命令行运行Elasticsearch。使用以下命令可以快速启动Elasticsearch以进行开发或测试： docker run -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" docker.elastic.co/elasticsearch/elasticsearch:7.3.2 请注意single-node

“[circuit_breaking_exception] [parent]” Data too large, data for “[<http_request>]” would be error

阅读更多关于 “[circuit_breaking_exception] [parent]” Data too large, data for “[]” would be error

问题 After smoothly working for more than 10 months, I start getting this error on production suddenly while doing simple search queries. { "error" : { "root_cause" : [ { "type" : "circuit_breaking_exception", "reason" : "[parent] Data too large, data for [<http_request>] would be [745522124/710.9mb], which is larger than the limit of [745517875/710.9mb]", "bytes_wanted" : 745522124, "bytes_limit" : 745517875 } ], "type" : "circuit_breaking_exception", "reason" : "[parent] Data too large, data for

How do _search queries work in Elasticsearch?

阅读更多关于 How do _search queries work in Elasticsearch?

问题 The question is more around: "How do Elasticsearch nodes interact to give a specific search result and what is the flow of a search request?" I've referred to the following links to understand, but they aren't very clear, in what I am trying to understand. https://www.elastic.co/guide/en/elasticsearch/reference/master/ingest.html https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html As per the above documentation, "Data Nodes" are the ones which perform all the

Elasticsearch 7.2.0: master not discovered or elected yet, an election requires at least X nodes

阅读更多关于 Elasticsearch 7.2.0: master not discovered or elected yet, an election requires at least X nodes

问题 I'm trying to automate the process of horizontal scale up and scale down of elasticsearch nodes in kubernetes cluster. Initially, I deployed an elasticsearch cluster (3 master, 3 data & 3 ingest nodes) on a Kubernetes cluster. Where, cluster.initial_master_nodes was: cluster.initial_master_nodes: - master-a - master-b - master-c Then, I performed scale down operation, reduced the number of master node 3 to 1 (unexpected, but for testing purpose). While doing this, I deleted master-c , master

Elasticsearch 7.2.0: master not discovered or elected yet, an election requires at least X nodes

阅读更多关于 Elasticsearch 7.2.0: master not discovered or elected yet, an election requires at least X nodes

Generating filebeat custom fields

阅读更多关于 Generating filebeat custom fields

问题 I have an elasticsearch cluster (ELK) and some nodes sending logs to the logstash using filebeat. All the servers in my environment are CentOS 6.5. The filebeat.yml file in each server is enforced by a Puppet module (both my production and test servers got the same configuration). I want to have a field in each document which tells if it came from a production/test server. I wanted to generate a dynamic custom field in every document which indicates the environment (production/test) using

Redis的过期策略和内存淘汰策略

阅读更多关于 Redis的过期策略和内存淘汰策略

Redis的过期策略和内存淘汰策略搞混淆了。 Redis的过期策略我们都知道，Redis是key-value数据库，我们可以设置Redis中缓存的key的过期时间。Redis的过期策略就是指当Redis中缓存的key过期了，Redis如何处理。过期策略通常有以下三种：定时过期：每个设置过期时间的key都需要创建一个定时器，到过期时间就会立即清除。该策略可以立即清除过期的数据，对内存很友好；但是会占用大量的CPU资源去处理过期的数据，从而影响缓存的响应时间和吞吐量。惰性过期：只有当访问一个key时，才会判断该key是否已过期，过期则清除。该策略可以最大化地节省CPU资源，却对内存非常不友好。极端情况可能出现大量的过期key没有再次被访问，从而不会被清除，占用大量内存。定期过期：每隔一定的时间，会扫描一定数量的数据库的expires字典中一定数量的key，并清除其中已过期的key。该策略是前两者的一个折中方案。通过调整定时扫描的时间间隔和每次扫描的限定耗时，可以在不同情况下使得CPU和内存资源达到最优的平衡效果。 (expires字典会保存所有设置了过期时间的key的过期时间数据，其中，key是指向键空间中的某个键的指针，value是该键的毫秒精度的UNIX时间戳表示的过期时间。键空间是指该Redis集群中保存的所有键。) Redis中同时使用了惰性过期和定期过期两种过期策略