一不留神，Elasticsearch都5.0了，这个是为了追Lucene还是solr？ 想想hbase怎么从0.98， 0.99挣扎到1.0，令人唏嘘不已。
els5.0很诱人的，看看这个被招安的曾勇(Medcl)怎么说：http://www.infoq.com/cn/news/2016/08/Elasticsearch-5-0-Elastic
对于我来说，比较吸引人的第一个功能是索引的RollOver。这个文章有详细的描述：
https://www.elastic.co/blog/managing-time-based-indices-efficiently
心动不如行动，先耍起来。
安装els5.0 beta1(什么时候出正式版？话说一般到5.1才能稳定)
这个说怎么装xpack : https://www.elastic.co/guide/en/x-pack/current/installing-xpack.html#installing-xpack
装了这个东西就可以有marvel，以前还有个bigdesk可以监控下，现在也是追不上来了（难道也被招安了？），sense也不错。这种招安的风格有点象微软啊。
上面的链接也有els和kabana的安装链接。
闲话少叙，话说我把els5.0和kabana5.0 装好了，els上xpack也装好了，但是kabana上居然装不上。报错：
D:\elasticsearch5.0\kibana-5.0.0-beta1-windows-x86\bin>kibana-plugin install file:///F:/soft/ElasticSearch/5.0/x-pack-5.0.0-beta1.zip
Attempting to transfer from file:///F:/soft/ElasticSearch/5.0/x-pack-5.0.0-beta1.zip
Error: ENOTFOUND
file后面跟两个/，也不行。果然是beta版。
els起来后呼呼吃掉2g内存，我这外网机只有4g内存，eclipse没法跑了。
这个文档：https://www.elastic.co/guide/en/elasticsearch/guide/2.x/heap-sizing.html
说可以设环境变量ES_HEAP_SIZE，实测不好使，5.0里检查这个设置，检查到就报错退出了。
后来设了这个好使：ES_JAVA_OPTS。
在sense（以前装的）上操练这个：https://www.elastic.co/blog/managing-time-based-indices-efficiently
1
PUT _template/active-logs{
"template":"active-logs-*",
"settings":{
"number_of_shards":5,
"number_of_replicas":1,
"routing.allocation.include.box_type":"hot",
"routing.allocation.total_shards_per_node":2 },
"aliases":{ "active-logs":{}, "search-logs":{} }}
===================
els 6.x 兼容性说明
aliaes 可以指定"search-logs"，不能指定"active-logs"。否则调用_rollover时会报类似这样的错
{ "error": { "root_cause": [ { "type": "illegal_argument_exception", "reason": "Rollover alias [active-fusion-logs] can point to multiple indices, found duplicated alias [[search-fusion-logs, active-fusion-logs]] in index template [fusion-logs]" } ], "type": "illegal_argument_exception", "reason": "Rollover alias [active-fusion-logs] can point to multiple indices, found duplicated alias [[search-fusion-logs, active-fusion-logs]] in index template [fusion-logs]" }, "status": 400 }
解决办法，
（1）上面的模板中alias去掉"active-logs"。
（2）生成第一个索引的时候，加入alias，"active-logs"。例如
PUT active-log-1
{
"alias": "active-logs"
}
滚动的时候用"active-logs"，生成的新索引自动会加入到"active-logs"，和"search-logs"别名中。
POST active-logs/_rollover
{
“condition” ： { “max_docs” : 1000000 }
}
===================
这一步number_of_shards, 我改成5，
这一行删掉 "routing.allocation.include.box_type":"hot",
"routing.allocation.total_shards_per_node":2改成3
原因是我只有一个节点。
2 然后生成索引， 插入数据，RollOver
貌似都成功了
3 查询索引状态
GET _cluster/health/active-logs-1
{
"cluster_name": "elasticsearch",
"status": "yellow",
"timed_out": false,
"number_of_nodes": 1,
"number_of_data_nodes": 1,
"active_primary_shards": 3,
"active_shards": 3,
"relocating_shards": 0,
"initializing_shards": 0,
"unassigned_shards": 3,
"delayed_unassigned_shards": 0,
"number_of_pending_tasks": 0,
"number_of_in_flight_fetch": 0,
"task_max_waiting_in_queue_millis": 0,
"active_shards_percent_as_number": 50
}
GET _cluster/health/active-logs-2
sense： calling es..., 回不来了。
查看els日志，貌似滚动生成的索引时active-logs-000002
POST /active-logs-1/log/_search
{
"query": {
"match_all": {}
}
}
数据是对的。
向alias插入新数据，查询
POST /active-logs-000002/log/_search
{
"query": {
"match_all": {}
}
}
数据也是对的。
看来滚动生成的索引的名字跟文档说的不一样。
4 active-logs-1设为只读索引，搬移一组shard到某个节点
PUT active-logs-1/_settings{"index.blocks.write":true, //这个设为true，索引就变成只读的了。不过按字面理解，应该是false才对啊？
"index.routing.allocation.require._name":"some_node_name"} //这一行我删掉了。
5 active-logs-1转换成一个新索引inactive-logs-1，只有一个shard。注意：active-logs-1依然在。
POST active-logs-1/_shrink/inactive-logs-1
GET _cluster/health/inactive-logs-1
{
"cluster_name": "elasticsearch",
"status": "green",
"timed_out": false,
"number_of_nodes": 1,
"number_of_data_nodes": 1,
"active_primary_shards": 1,
"active_shards": 1,
"relocating_shards": 0,
"initializing_shards": 0,
"unassigned_shards": 0,
"delayed_unassigned_shards": 0,
"number_of_pending_tasks": 0,
"number_of_in_flight_fetch": 0,
"task_max_waiting_in_queue_millis": 0,
"active_shards_percent_as_number": 100
}
shard变成1个了。
POST /inactive-logs-1/log/_search
{
"query": {
"match_all": {}
}
}
{
"took": 22,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"failed": 0
},
"hits": {
"total": 5,
"max_score": 1,
"hits": [
{
"_index": "inactive-logs-1",
"_type": "log",
"_id": "AVdve1ZLb8zmVmryc09U",
"_score": 1,
"_source": {
"text": "Some log message",
"@timestamp": "2016-07-02T01:00:00Z"
}
},
。。。
数据也对。
6 active-logs-1移出search-logs，inactive-logs-1移入。
POST _aliases
{
"actions": [
{
"remove": {
"index": "active-logs-1",
"alias": "search-logs"
}
},
{
"add": {
"index": "inactive-logs-1",
"alias": "search-logs"
}
}
]
}
//查询search-logs
POST /search-logs/log/_search
{
"query": {
"match_all": {}
}
}
{
"took": 8,
"timed_out": false,
"_shards": {
"total": 4,
"successful": 4,
"failed": 0
},
"hits": {
"total": 9,
"max_score": 1,
"hits": [
{
"_index": "active-logs-000002",
"_type": "log",
"_id": "AVdvhBG1b8zmVmryc1G7",
"_score": 1,
"_source": {
"text": "Some log message",
"@timestamp": "2016-07-02T01:00:00Z"
}
},
。。。
7 force merge
POST inactive-logs-1/_forcemerge?max_num_segments=1
{
"_shards": {
"total": 1,
"successful": 1,
"failed": 0
}
}
成功了！
//增加副本
PUT inactive-logs-1/_settings{"number_of_replicas":1 }
删除原索引
DELETE active-logs-1
8 通过field stat api 筛选indice
GET search-logs/_field_stats?level=indices
{
"fields": ["@timestamp"],
"index_constraints": {
"@timestamp": {
"max_value": {
"lt": "2016/07/06",
"format": "yyyy/MM/dd"
}
}
}
}
{
"_shards": {
"total": 4,
"successful": 4,
"failed": 0
},
"indices": {
"inactive-logs-1": {
"fields": {
"@timestamp": {
"type": "date",
"max_doc": 5,
"doc_count": 5,
"density": 100,
"sum_doc_freq": -1,
"sum_total_term_freq": 5,
"searchable": true,
"aggregatable": true,
"min_value": 1467334800000,
"min_value_as_string": "2016-07-01T01:00:00.000Z",
"max_value": 1467680400000,
"max_value_as_string": "2016-07-05T01:00:00.000Z"
}
}
},
"active-logs-000002": {
"fields": {
"@timestamp": {
"type": "date",
"max_doc": 4,
"doc_count": 4,
"density": 100,
"sum_doc_freq": -1,
"sum_total_term_freq": 4,
"searchable": true,
"aggregatable": true,
"min_value": 1467334800000,
"min_value_as_string": "2016-07-01T01:00:00.000Z",
"max_value": 1467594000000,
"max_value_as_string": "2016-07-04T01:00:00.000Z"
}
}
}
}
}
总结一下：
els5.0beta1的rollover api基本上是好使的。
由于条件所限，本验证只在单机上做了验证，个别功能没有验证到，主要是集群中切片索引的自动分配移动。