Question

我是ElasticSearch的初学者。我的问题是 - 我们如何收到有关分片的通知？失败如：

...    
"failures": [
                   {
                       "index": "some_index",
                       "reason": "RemoteTransportException[[Ocelot][inet[/127.0.0.1:9300]][indices:data/read/search[phase/query]]]; nested: QueryPhaseExecutionException[[some_index][3]: query[filtered(+status:act +isActive:T)->cache(_type:product)],from[0],size[1000],sort[<custom:\"name\": org.elasticsearch.index.fielddata.fieldcomparator.BytesRefFieldComparatorSource@4b1221d>]: Query Failed [Failed to execute main query]]; nested: ElasticsearchException[org.elasticsearch.common.breaker.CircuitBreakingException: [FIELDDATA] Data too large, data for [name] would be larger than limit of [5133041664/4.7gb]]; nested: UncheckedExecutionException[org.elasticsearch.common.breaker.CircuitBreakingException: [FIELDDATA] Data too large, data for [name] would be larger than limit of [5133041664/4.7gb]]; nested: CircuitBreakingException[[FIELDDATA] Data too large, data for [name] would be larger than limit of [5133041664/4.7gb]]; ",
                       "shard": 3,
                       "status": 500
                   }
],
...

请求机构进行快速调查。 我对通知仅对请求的主体感兴趣。

ElasticSearch有专门的工具吗？

Answer 1

一个想法是将您的ES日志存储在索引中，类似于您对应用程序日志所做的操作。

然后你有几个选择

定义一个percolator，它将帮助您检测包含失败错误的新日志，因为它们已被编入索引
使用官方Watcher plugin并定义您希望收到提醒的条件
使用Yelp的ElastAlert提供与Watcher类似的功能（但是免费）

弹性故障记录

1 个答案: