ES索引和快照的自动化管理方案
说明
由于业务的需要,我们ES使用的是Amazon Elasticsearch Service 7.4
,为了配合开发同学的使用和节省部门不必要的开支,我们将定期去备份索引快照至S3
中,同时删除ES对应的索引数据。
需求
我们需要定期备份一定周期(比如:一周之前)的索引快照至S3
,删除Elasticsearch Service
中对应索引数据。同时,如有需要还要可以恢复备份的索引数据。整个流程执行成功后,要有微信或其他途径信息提醒。
流程图
ES需求处理流程图:
curator工具
curator与es版本的兼容性
The current version of Curator is 5.8.3,详见传送门
curator可执行的操作
curator允许对索引和快照执行许多不同的操作,包括:
从别名添加或删除索引(或两者!)
更改分片路由分配
关闭索引
创建索引
删除索引
删除快照
打开被关闭的索引
对索引执行forcemerge段合并操作
reindex索引,包括来自远程集群的索引
更改索引的每个分片的副本数
rollover索引
生成索引的快照(备份)
还原快照
安装配置curator
curator
安装方式有多种,比如:yum/apt-get、pip、docker等
,这里我们选择常用的pip
。
pip安装curator
登录后复制
# 安装必要的基础包yum install -y vim python-pip
登录后复制
# 安装虚拟环境pip install virtualenvwrapper# 配置虚拟环境,在/etc/profile添加:### virtualenv start ####设置virtualenv的统一管理目录export WORKON_HOME=~/Envs#添加virtualenvwrapper的参数,生成干净隔绝的环境#export VIRTUALENVWRAPPER_VIRTUALENV_ARGS='--no-site-packages'#指定python解释器#export VIRTUALENVWRAPPER_PYTHON=/opt/python36/bin/python3.6#执行virtualenvwrapper安装脚本export VIRTUALENVWRAPPER_SCRIPT=/usr/bin/virtualenvwrapper.sh source /usr/bin/virtualenvwrapper_lazy.sh### virtualenv end #### 刷新配置文件source !$# 创建管理es的虚拟环境mkvirtualenv es-snapshot# 查看刚创建的虚拟环境lsvirtualenv# 进入虚拟环境workon es-snapshot
登录后复制
# 在es-snapshot虚拟环境中安装pip install elasticsearch-curator
命令行下单次执行
登录后复制
# 查看当前es的所有索引的详细信息,默认host:127.0.0.1,默认port:9200curator_cli --host 127.0.0.1 --port 9200 show_indices --verbose
配置config.yml
登录后复制
# Rmember, leave a key empty if there is no value. None will be a string,# not a Python "NoneType"client: #es集群地址 hosts: http://your-domain.com #es端口 port: your-port url_prefix: use_ssl: False # aws区域,如ap-south-1 aws_region: xxxxx aws_sign_request: False certificate: client_cert: client_key: ssl_no_validate: False http_auth: timeout: 30 master_only: Falselogging: #日志级别 loglevel: INFO #日志存放路径 logfile: /var/log/cur-run.log logformat: default blacklist: ['elasticsearch', 'urllib3']
配置action.yml
登录后复制
actions: 1: # 备份7天前的索引快照 action: snapshot description: >- Snapshot sdk_|game_ prefixed indices older than 7 day (based on index creation_date) with the default snapshot name pattern of 'es-%Y%m%d%H%M%S'. Wait for the snapshot to complete. Do not skip the repository filesystem access check. Use the other options to create the snapshot. options: # s3仓库名称,可通过脚本生成 repository: "es_backup_\ " # Leaving name blank will result in the default 'curator-%Y%m%d%H%M%S' name: es-%Y%m%d%H%M%S ignore_unavailable: False include_global_state: True partial: True wait_for_completion: True skip_repo_fs_check: True ignore_empty_list: True continue_if_exception: False disable_action: False filters: - filtertype: pattern kind: regex # 匹配"logstash-"的索引 value: 'logstash-' - filtertype: age source: creation_date direction: older unit: days # 7天之前的索引 unit_count: 7 2: # 关闭7天前以logstash-为前缀的索引: action: close description: >- Close indices older than 7 days (based on index name), for dtlog- prefixed indices. options: delete_aliases: False timeout_override: continue_if_exception: False filters: - filtertype: pattern kind: regex value: '^logstash-' exclude: - filtertype: age source: name direction: older timestring: '%Y.%m.%d' unit: days unit_count: 7 3: # 删除7天前的索引 action: delete_indices description: >- Delete metric indices older than 7 days (based on index name), for logstash-2021.04.10 prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly. options: ignore_empty_list: True filters: - filtertype: pattern kind: prefix # 匹配"logstash-"的索引 value: logstash- - filtertype: age # 这里根据索引name来匹配,还可以根据字段等,详见官方文档 source: name direction: older # 用于匹配和提取索引或快照名称中的时间戳 timestring: '%Y.%m.%d' unit: days # 7天之前的索引 unit_count: 7
配置action顺序:7天前索引做快照 --> 关闭7天前索引 --> 删除7天前索引 --> 保留7天内的索引,如有需要可把7天前的快照恢复当前es中。
action.yml
配置中:
登录后复制
# s3仓库名称,可通过脚本生成 repository: "es_backup_\ "
之所以这样写,是因为执行python register-repo.py
会得到两个值:带有时间戳仓库的后缀
比如es_backup_20210424150533
,另一个值是时间戳
并把它写入time_save.txt
。sed '/es_backup_/r time_save.txt' action_temp.yml -i
将获得的时间戳传进action_temp.yml
中。
注意:actions: 后面的,依次类推:
登录后复制
2:执行操作3:执行操作4:执行操作 N:执行操作
创建S3仓库
在执行curator
之前,我们需要创建s3仓库
,需要配置IAM role
访问Elasticsearch Service
权限,详见AWS Elasticsearch Service 建立snapshot
详见如下脚本:
登录后复制
# cat register-repo.pyimport boto3import requestsfrom requests_aws4auth import AWS4Authimport timedef create_s3_register(timeup): host = 'https://your-aws-es-domain.com/' # include https:// and trailing / region = 'ap-south-1' # e.g. us-west-1 service = 'es' credentials = boto3.Session().get_credentials() awsauth = AWS4Auth(credentials.access_key, credentials.secret_key, region, service, session_token=credentials.token) # Register repository path = '_snapshot/'+'es_backup_'+timeup # the Elasticsearch API endpoint url = host + path payload = { "type": "s3", "settings": { "bucket": "your-s3-bucket", "region": "ap-south-1", "role_arn": "arn:aws:iam::1234567890:role/your-role-name" } } headers = {"Content-Type": "application/json"} r = requests.put(url, auth=awsauth, json=payload, headers=headers) print(r.status_code) print(r.text)def var_save(timeup,filename,mode='w'): file = open(filename,mode) file.write(' '+timeup+'\\'+'\n') file.closeif __name__=="__main__": time = time.strftime('%Y%m%d%H%M%S',time.localtime(time.time())) create_s3_register(time) var_save(time,'time_save.txt')
创建执行脚本
该脚本将完成,索引快照备份、索引关闭和索引删除,最后微信信息通知,详见:
登录后复制
#!/bin/bash#author: tengfei.wu#email: tengfei.wu@domain.com#date:2021/04/25#version: 2# Create the S3 repositorypython register-repo.py# Get the name of the warehousecp action.yml action_temp.yml sed '/es_backup_/r time_save.txt' action_temp.yml -i# Perform ES index shutdown, backup, and deletion#curator --config config.yml action_temp.yml --dry-runcurator --config config.yml action_temp.yml rm -rf action_temp.yml# WeChat alarmcontent=' 【AI测试环境】-- ES操作通知 详情信息: "ES快照备份、索引关闭和索引删除" 操作细节: 索引快照: "7天前索引" 索引关闭: "7天前索引" 索引删除: "7天前索引" 状态: SUCCESS 报警创建方式: "自动脚本对接" 当前索引: "保留最近一周的索引"'curl http://x.x.x.x:4567/send -d "tos=your-IM&content=${content}"
定时执行
登录后复制
# logstash-日志备份,每周日am 9:3030 9 * * 0 cd /root/Envs/es-snapshot/bin && source ./activate && cd /root/Envs/es-snapshot && (/bin/bash ccc) && deactivate
手动执行
登录后复制
workon es-snapshot && cd /root/Envs/es-snapshot/ sh start_es_backup.sh > /dev/null 2>&1 &
检查执行结果
其他的操作
索引恢复
登录后复制
# cat action_restore.ymlactions: 1: action: restore description: >- Restore all indices in the most recent snapshot with state SUCCESS. Wait for the restore to complete before continuing. Do not skip the repository filesystem access check. Use the other options to define the index/shard settings for the restore. options: repository: es_backup_20210425054626 name: indices: wait_for_completion: True #max_wait: 3600 #wait_interval: 10 filters: - filtertype: state state: SUCCESS exclude:
查看当前索引状态:curator_cli --host your-domain.es.amazonaws.com --port your-port show_indices --verbose
索引打开
登录后复制
# cat action_open.ymlactions: 1: action: open description: "open selected indices" options: continue_if_exception: False timeout_override: 300 filters: - filtertype: pattern kind: regex value: '^logstash-' - filtertype: age source: name direction: older timestring: '%Y.%m.%d' unit: days unit_count: 7
仓库快照删除和删除空仓库
登录后复制
# action_delete_snapshot.yml# 删除快照配置示例actions: 1: action: delete_snapshots description: "Delete selected snapshots from 'repository'" options: repository: es_backup_20210424150533 retry_interval: 120 retry_count: 3 timeout_override: 3600 filters: - filtertype: state state: SUCCESS exclude:
注意:
上面的
action_delete_snapshot.yml
配置只是清空了es_backup_20210424150533
仓库中的快照内容,仓库并没有删除,删除空仓库:DELETE /_snapshot/es_backup_20210424150533
action支持的操作
action传送门
action examples传送门
©著作权归作者所有:来自51CTO博客作者品鉴初心的原创作品,如需转载,请注明出处,否则将追究法律责任