Elasticsearch集羣優化

系統層面

修改默認文件描述符大小

echo '* soft nofile 1048576' >>/etc/security/limits.conf
echo '* hard nofile 1048576' >>/etc/security/limits.conf
echo 'elasticsearch soft memlock unlimited' >>/etc/security/limits.conf
echo 'elasticsearch hard memlock unlimited' >>/etc/security/limits.conf

 關閉swap，若是/etc/fstab裏面設置了開機自動掛載註釋掉

swapoff -a

JVM分配爲物理內存一半，最多設置不要超過32G

配置文件:/etc/elasticsearch/jvm.options

內核優化配置文件

vm.swappiness = 1
vm.max_map_count=262144
net.ipv4.neigh.default.gc_stale_time = 120
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.all.arp_announce = 2
net.ipv4.tcp_max_tw_buckets = 5000
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 1024
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_fin_timeout = 30
net.core.rmem_max=8388608
net.core.wmem_max=8388608
net.core.rmem_default=65536
net.core.wmem_default=65536
net.ipv4.tcp_rmem='4096 87380 8388608'
net.ipv4.tcp_wmem='4096 65536 8388608'
net.ipv4.tcp_mem='8388608 8388608 8388608'
net.ipv4.route.flush=1
fs.file-max=1048576
net.ipv4.tcp_keepalive_time = 30
net.ipv4.tcp_keepalive_probes = 2
net.ipv4.tcp_keepalive_intvl = 2
net.ipv4.ip_local_port_range = 5000 65000
vm.overcommit_memory = 1
net.ipv4.ip_forward=1

Elasticsearch配置層面

加大refresh_interval參數，增長緩存刷新到磁盤的時間,該配置的代價就是60秒後才把緩存數據刷新到磁盤。

curl -XPUT localhost:9200/logstash-*/_settings -d '{
    "index" : {
        "refresh_interval" : "60s"
    } }'

修改translog參數

translog是爲了保證數據的一致性，默認每隔5s強制刷新translog日誌到磁盤上，爲了保證不丟數據每次index/bulk/delete/update的時候必定觸發刷新translog到磁盤上，纔給請求返回200，若是考慮性能優先能夠設置如下參數。

curl -XPUT 'http://localhost:9200/_all/_settings?preserve_existing=true' -d '{
  "index.translog.durability" : "async"
}'

副本分片是能夠隨時調整的，有些較大的索引，能夠在作optimize前，先把副本所有取消掉，登optimize完後，再從新開啓副本。

curl -XPUT http://127.0.0.1:9200/索引名/_settings -d '
{ "index" : { "number_of_replicas" : 0 }
}'

修改primary shard和replica shard數量

默認值爲每一個indexer5個主分片1個副本分片可根據實際狀況進行調整，個人集羣目前爲6個node，我變成了3個主分片1個副本分片，這樣每一個node分配一個shard，好處是節省了空間，壞處是冗餘少了，

經過腳本天天凌晨1點自動建立indexer，截取部分腳本以下：

#!/bin/bash
DATE=`date +%Y.%m.%d`

curl -H "Content-Type: application/json;charset=UTF-8" -XPUT http://elasticsearch:9200/logstash-nginx-error-${DATE} -d '
{
    "settings" : {
        "index" : {
            "number_of_shards" : 3,
            "number_of_replicas" : 1
        }
    }
}'

另外附帶幾個經常使用的查看集羣狀態API

查看索引配置
curl -XGET http://127.0.0.1:9200/logstash-*/_settings?pretty

檢查集羣監控情況
curl -XGET http://127.0.0.1:9200/_cluster/health?pretty

檢查節點狀態
curl -XGET http://127.0.0.1:9200/_nodes/stats