04-26 09:03 阅读 148

ES索引和快照的自动化管理方案

说明

由于业务的需要，我们ES使用的是Amazon Elasticsearch Service 7.4，为了配合开发同学的使用和节省部门不必要的开支，我们将定期去备份索引快照至S3中，同时删除ES对应的索引数据。

需求

我们需要定期备份一定周期（比如：一周之前）的索引快照至S3，删除Elasticsearch Service中对应索引数据。同时，如有需要还要可以恢复备份的索引数据。整个流程执行成功后，要有微信或其他途径信息提醒。

流程图

ES需求处理流程图：

ES索引和快照的自动化管理方案

curator工具

curator与es版本的兼容性

ES索引和快照的自动化管理方案

The current version of Curator is 5.8.3，详见传送门

curator可执行的操作

curator允许对索引和快照执行许多不同的操作，包括：

从别名添加或删除索引（或两者！）
更改分片路由分配
关闭索引
创建索引
删除索引
删除快照
打开被关闭的索引
对索引执行forcemerge段合并操作
reindex索引，包括来自远程集群的索引
更改索引的每个分片的副本数
rollover索引
生成索引的快照（备份）
还原快照

安装配置curator

curator安装方式有多种，比如：yum/apt-get、pip、docker等，这里我们选择常用的pip。

pip安装curator

登录后复制

# 安装必要的基础包yum install -y vim python-pip

登录后复制

# 安装虚拟环境pip install virtualenvwrapper# 配置虚拟环境，在/etc/profile添加：### virtualenv start ####设置virtualenv的统一管理目录export WORKON_HOME=~/Envs#添加virtualenvwrapper的参数，生成干净隔绝的环境#export VIRTUALENVWRAPPER_VIRTUALENV_ARGS='--no-site-packages'#指定python解释器#export VIRTUALENVWRAPPER_PYTHON=/opt/python36/bin/python3.6#执行virtualenvwrapper安装脚本export VIRTUALENVWRAPPER_SCRIPT=/usr/bin/virtualenvwrapper.sh
source /usr/bin/virtualenvwrapper_lazy.sh### virtualenv end #### 刷新配置文件source !$# 创建管理es的虚拟环境mkvirtualenv es-snapshot# 查看刚创建的虚拟环境lsvirtualenv# 进入虚拟环境workon es-snapshot

登录后复制

# 在es-snapshot虚拟环境中安装pip install elasticsearch-curator

命令行下单次执行

登录后复制

# 查看当前es的所有索引的详细信息，默认host：127.0.0.1，默认port：9200curator_cli --host 127.0.0.1 --port 9200 show_indices --verbose

配置config.yml

登录后复制

# Rmember, leave a key empty if there is no value.  None will be a string,# not a Python "NoneType"client:  #es集群地址
  hosts: http://your-domain.com  #es端口
  port: your-port
  url_prefix:
  use_ssl: False
  # aws区域，如ap-south-1
  aws_region: xxxxx
  aws_sign_request: False
  certificate:
  client_cert:
  client_key:
  ssl_no_validate: False
  http_auth:
  timeout: 30
  master_only: Falselogging:  #日志级别
  loglevel: INFO  #日志存放路径
  logfile: /var/log/cur-run.log
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

配置action.yml

登录后复制

actions:  1:    # 备份7天前的索引快照
    action: snapshot
    description: >-
      Snapshot sdk_|game_ prefixed indices older than 7 day (based on index
      creation_date) with the default snapshot name pattern of      'es-%Y%m%d%H%M%S'.  Wait for the snapshot to complete.  Do not skip
      the repository filesystem access check.  Use the other options to create
      the snapshot.
    options:      # s3仓库名称，可通过脚本生成
      repository: "es_backup_\
                   "
      # Leaving name blank will result in the default 'curator-%Y%m%d%H%M%S'
      name: es-%Y%m%d%H%M%S
      ignore_unavailable: False
      include_global_state: True
      partial: True
      wait_for_completion: True
      skip_repo_fs_check: True
      ignore_empty_list: True
      continue_if_exception: False
      disable_action: False
    filters:
      - filtertype: pattern
        kind: regex        # 匹配"logstash-"的索引
        value: 'logstash-'
      - filtertype: age
        source: creation_date
        direction: older
        unit: days        # 7天之前的索引
        unit_count: 7
  2:    # 关闭7天前以logstash-为前缀的索引:
    action: close
    description: >-
      Close indices older than 7 days (based on index name), for dtlog-
      prefixed indices.
    options:
      delete_aliases: False
      timeout_override:
      continue_if_exception: False
    filters:
    - filtertype: pattern
      kind: regex
      value: '^logstash-'
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 7
  3:    # 删除7天前的索引
    action: delete_indices
    description: >-
      Delete metric indices older than 7 days (based on index name), for logstash-2021.04.10
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
    filters:
    - filtertype: pattern
      kind: prefix      # 匹配"logstash-"的索引
      value: logstash-
    - filtertype: age      # 这里根据索引name来匹配，还可以根据字段等，详见官方文档
      source: name
      direction: older      # 用于匹配和提取索引或快照名称中的时间戳
      timestring: '%Y.%m.%d'
      unit: days      # 7天之前的索引
      unit_count: 7

配置action顺序：7天前索引做快照 --> 关闭7天前索引 --> 删除7天前索引 --> 保留7天内的索引，如有需要可把7天前的快照恢复当前es中。

action.yml配置中：

登录后复制

# s3仓库名称，可通过脚本生成
repository: "es_backup_\
"

之所以这样写，是因为执行python register-repo.py会得到两个值：带有时间戳仓库的后缀比如es_backup_20210424150533，另一个值是时间戳并把它写入time_save.txt。sed '/es_backup_/r time_save.txt' action_temp.yml -i将获得的时间戳传进action_temp.yml中。

注意：actions: 后面的，依次类推：

登录后复制

2：执行操作3：执行操作4：执行操作
N：执行操作

创建S3仓库

在执行curator之前，我们需要创建s3仓库，需要配置IAM role访问Elasticsearch Service权限，详见AWS Elasticsearch Service 建立snapshot

详见如下脚本：

登录后复制

# cat register-repo.pyimport boto3import requestsfrom requests_aws4auth import AWS4Authimport timedef create_s3_register(timeup):
   host = 'https://your-aws-es-domain.com/' # include https:// and trailing /
   region = 'ap-south-1' # e.g. us-west-1
   service = 'es'
   credentials = boto3.Session().get_credentials()
   awsauth = AWS4Auth(credentials.access_key, credentials.secret_key, region, service, session_token=credentials.token)   # Register repository
   path = '_snapshot/'+'es_backup_'+timeup # the Elasticsearch API endpoint
   url = host + path

   payload = {     "type": "s3",     "settings": {       "bucket": "your-s3-bucket",       "region": "ap-south-1",       "role_arn": "arn:aws:iam::1234567890:role/your-role-name"
     }
   }

headers = {"Content-Type": "application/json"}

r = requests.put(url, auth=awsauth, json=payload, headers=headers)

   print(r.status_code)
   print(r.text)def var_save(timeup,filename,mode='w'):
    file = open(filename,mode)
    file.write('              '+timeup+'\\'+'\n')
    file.closeif __name__=="__main__":
    time = time.strftime('%Y%m%d%H%M%S',time.localtime(time.time()))
    create_s3_register(time)
    var_save(time,'time_save.txt')

创建执行脚本

该脚本将完成，索引快照备份、索引关闭和索引删除，最后微信信息通知，详见：

登录后复制

#!/bin/bash#author: tengfei.wu#email: tengfei.wu@domain.com#date:2021/04/25#version: 2# Create the S3 repositorypython register-repo.py# Get the name of the warehousecp action.yml action_temp.yml
sed '/es_backup_/r time_save.txt' action_temp.yml -i# Perform ES index shutdown, backup, and deletion#curator --config config.yml action_temp.yml --dry-runcurator --config config.yml action_temp.yml
rm -rf action_temp.yml# WeChat alarmcontent='
【AI测试环境】-- ES操作通知

详情信息: "ES快照备份、索引关闭和索引删除"
操作细节:
  索引快照: "7天前索引"
  索引关闭: "7天前索引"
  索引删除: "7天前索引"
  状态:  SUCCESS
  报警创建方式: "自动脚本对接"
  当前索引: "保留最近一周的索引"'curl http://x.x.x.x:4567/send -d "tos=your-IM&content=${content}"

定时执行

登录后复制

# logstash-日志备份，每周日am 9:3030 9 * * 0 cd /root/Envs/es-snapshot/bin && source ./activate && cd /root/Envs/es-snapshot && (/bin/bash ccc) && deactivate

手动执行

登录后复制

workon es-snapshot && cd /root/Envs/es-snapshot/
sh start_es_backup.sh > /dev/null 2>&1 &

检查执行结果

ES索引和快照的自动化管理方案

其他的操作

索引恢复

登录后复制

# cat action_restore.ymlactions:  1:
    action: restore
    description: >-
      Restore all indices in the most recent snapshot with state SUCCESS.  Wait      for the restore to complete before continuing.  Do not skip the repository
      filesystem access check.  Use the other options to define the index/shard
      settings for the restore.
    options:
      repository: es_backup_20210425054626
      name:
      indices:
      wait_for_completion: True
      #max_wait: 3600
      #wait_interval: 10
    filters:
    - filtertype: state
      state: SUCCESS
      exclude:

查看当前索引状态：curator_cli --host your-domain.es.amazonaws.com --port your-port show_indices --verbose

索引打开

登录后复制

# cat action_open.ymlactions:  1:
    action: open
    description: "open selected indices"
    options:
      continue_if_exception: False
      timeout_override: 300
    filters:
    - filtertype: pattern
      kind: regex
      value: '^logstash-'
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 7

仓库快照删除和删除空仓库

登录后复制

# action_delete_snapshot.yml# 删除快照配置示例actions:  1:
    action: delete_snapshots
    description: "Delete selected snapshots from 'repository'"
    options:
      repository: es_backup_20210424150533
      retry_interval: 120
      retry_count: 3
      timeout_override: 3600
    filters:
    - filtertype: state
      state: SUCCESS
      exclude:

注意：

上面的action_delete_snapshot.yml配置只是清空了es_backup_20210424150533仓库中的快照内容，仓库并没有删除，删除空仓库：DELETE /_snapshot/es_backup_20210424150533

action支持的操作

action传送门
action examples传送门