找到状态为 red 的索引
curl localhost:9200/_cat/indices?v=
看到节点的分配情况
curl localhost:9200/_cat/shards
查看健康状态
curl localhost:9200/_cat/heath
p 主节点
r 副节点
UNASSIGNED 未分配
返回未分配索引每个节点的详情，其中就有未分配的原因
curl localhost:9200/_cluster/allocation/explain?pretty
curl -X GET “localhost:9200/_cluster/allocation/explain?pretty” -H ‘Content-Type: application/json’ -d’
{
“index”: “opencti_stix_cyber_observable_relationships-000001”,
“shard”: 0,
“primary”: true
}
‘
刷新索引
curl localhost:9200/.monitoring-es-7-2022.07.03/_flush
创建索引
curl -X POST localhost:9200/.monitoring-es-7-2022.07.03 -d ‘{“settings”:{“number_of_shards”:1,”number_of_replicas”:1 }}’ -H’Content-Type: application/json’
删除索引
curl -XDELETE localhost:9200/opencti_stix_cyber_observable_relationships-000001
curl -XDELETE localhost:9200/.monitoring-es-7-2022.07.03
sudo find / -name “*” | xargs grep “192.168.17.169”
关闭索引
curl -X POST localhost:9200/MY_INDEX/_close
分配碎片
curl -X POST localhost:9200/_cluster/reroute -d ‘{“commands”:[{“allocate_stale_primary”:{“index”:”.monitoring-es-7-2022.07.03″,”shard”:0,”node”:”fH7R5UIRQ0KdrB4QnSQGWg”,”accept_data_loss”:true}}]}’ -H’Content-Type: application/json’
curl -X POST localhost:9200/_cluster/reroute -d ‘{“commands”:[{“allocate_stale_primary”:{“index”:”.monitoring-es-7-2022.07.03″,”shard”:_state,”node”:”fH7R5UIRQ0KdrB4QnSQGWg”,”accept_data_loss”:true}}]}’ -H’Content-Type: application/json’
这个变红：opencti_stix_sighting_relationships-000001
“details” : “failed shard on node [fH7R5UIRQ0KdrB4QnSQGWg]: failed recovery, failure RecoveryFailedException[[opencti_stix_sighting_relationships-000001][0]: Recovery failed on {huginn}{fH7R5UIRQ0KdrB4QnSQGWg}{F_oevKOlS-2AFQqIcM_LCQ}{localhost}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=8312119296, xpack.installed=true, transform.node=true, ml.max_open_jobs=512, ml.max_jvm_size=2147483648}]; nested: IndexShardRecoveryException[failed recovery]; nested: ElasticsearchException[java.io.IOException: failed to read /data/elasticsearch/nodes/0/indices/-HXQuxBlQL2i__oKX_TMZw/0/_state/retention-leases-180.st]; nested: IOException[failed to read /data/elasticsearch/nodes/0/indices/-HXQuxBlQL2i__oKX_TMZw/0/_state/retention-leases-180.st]; nested: CorruptStateException[org.apache.lucene.index.CorruptIndexException: codec mismatch: actual codec=Lucene80DocValuesMetadata vs expected codec=state (resource=NIOFSIndexInput(path=\”/data/elasticsearch/nodes/0/indices/-HXQuxBlQL2i__oKX_TMZw/0/_state/retention-leases-180.st\”))]; nested: CorruptIndexException[codec mismatch: actual codec=Lucene80DocValuesMetadata vs expected codec=state (resource=NIOFSIndexInput(path=\”/data/elasticsearch/nodes/0/indices/-HXQuxBlQL2i__oKX_TMZw/0/_state/retention-leases-180.st\”))]; “,
解决办法 删掉retention-leases-180.st即可
错误-删除即可
opencti_internal_objects-000001
/data/elasticsearch/nodes/0/indices/hiIFoyAsTl6seuyzt44W-Q/0/_state/retention-leases-46369.st
.monitoring-es-7-2022.08.11
/data/elasticsearch/nodes/0/indices/9qCLsnPXSuSuzPyqyhCqQA/0/_state/retention-leases-140.st
