查看elasticsearch状态信息
[root@devops-efk appuser]# curl
{
"cluster_name" : "my-application",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 1995,
"active_shards" : 1995,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 1973,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 50.27721774193549
}
查看elasticsearch报警信息
[root@devops-efk ~]# curl
{"index":"filebeat-6.3.0-2022.01.21","shard":1,"primary":false,"current_state":"unassigned","unassigned_info":{"reason":"CLUSTER_RECOVERED","at":"2022-06-14T06:34:10.740Z","last_allocation_status":"no_attempt"},"can_allocate":"no","allocate_explanation":"cannot allocate because allocation is not permitted to any of the nodes","node_allocation_decisions":[{"node_id":"cOc2sqF8RA6WD_RUlEeqUQ","node_name":"node-1","transport_address":"10.1.236.7:9300","node_attributes":{"ml.machine_memory":"8202665984","xpack.installed":"true","ml.max_open_jobs":"20","ml.enabled":"true"},"node_decision":"no","deciders":[{"decider":"same_shard","decision":"NO","explanation":"the shard cannot be allocated to the same node on which a copy of the shard already exists [[filebeat-6.3.0-2022.01.21][1], node[cOc2sqF8RA6WD_RUlEeqUQ], [P], s[STARTED], a[id=rhT7WPrgTqiLAPwJUBgHvA]]"}]}]}[root@devops-efk ~]# timed out waiting for input: auto-logout
既然查看到错误问题，剩下的就是去解决了
根据上面的返回信息，集群的 unassigned_shards 为 1973。
单点部署的 Elasticsearch，默认分片的副本数为 1，而相同的分片不能在同一个节点上，所以就出现上面 unsigned shards 的问题。解决方法如下：
[root@devops-efk appuser]# curl -X PUT "10.1.236.7:9200/_settings" -H 'Content-Type: application/json' -d'
> {"number_of_replicas":0}' （这个也是要输入的）
（以下是输出）
{"acknowledged":true}[root@devops-efk appuser]#
查看kibana也是正常的
