Elasticsearch 명령어

indices 안에 data가 존재하는지 확인

GET metricbeat-*/_search
{
  "query": {
    "match": {
      "event.module": "elasticsearch"
    }
  }
}

GET .monitoring-es*/_search
{
  "size": 5,
  "_source": ["elasticsearch.node.process"]
}

GET .internal.alerts-security.alerts-default-000001/_search
{
  "size": 1,
  "query": { "match_all": {} }
}

health check

GET /_cluster/health?pretty

사용 가능한 field 확인

GET metricbeat-*/_mapping/field/*

field 존재여부 확인

GET metricbeat-*/_search
{
  "query": {
    "exists": {
      "field": "elasticsearch.node.process"
    }
  }
}

Node Process 확인

GET /_nodes/stats/process?pretty

Node system resource 사용 확인

GET _nodes/stats/jvm,process

alias check

GET _alias/logs-deprecation

GET _alias/ilm-history

missing shard 확인: UNASSIGNED, INITIALIZING 확인

GET _cat/shards/.alerts-security.alerts*?v

disk 용량 확인

GET _cluster/settings

index 존재여부 확인

GET _cat/indices/.alerts-security.alerts*?v

최종 데이터 확인

GET .monitoring-es-*/_search
{
  "size": 1,
  "sort": [{ "@timestamp": "desc" }],
  "_source": ["elasticsearch.node.process.cpu.percent"]
}

indices 삭제

DELETE .monitoring-es-7-*

indices 재생성

POST _monitoring/bulk

# metricbeat and kibaan must restart