elasticsearch的服務器響應異常及解決策略（轉）

詳述：

1 _riverStatus Import_fail 

問題描述： 發現有個索引的數據同步不完整，在 http://192.168.1.17:9200/_plugin/head/ 在browse - river裏看到 _riverStatus Import_fail

查看 elasticsearch 的log發現 有幾條數據因爲異常形成同步失敗，處理好數據好從新建索引數據同步正常。

2 es_rejected_execution_exception <429>

此異常主要是由於請求數過多，es的線程池不夠用了。

默認bulk thead pool set  queue capacity =50 這個能夠設置大點

打開 elasticsearch.yml 在末尾加上 

threadpool:
    bulk:
        type: fixed
        size: 60
        queue_size: 1000

從新啓動服務便可

另：

--查看線程池設置--
curl -XGET "http://localhost:9200/_nodes/thread_pool/"

非bulk入庫thread pool設置能夠這樣修改
threadpool:
    index:
        type: fixed
        size: 30
        queue_size: 1000

關於該異常，有網友給的解釋挺好的：

Elasticsearch has a thread pool and a queue for search per node. A thread pool will have N number of workers ready to handle the requests. When a request comes and if a worker is free , this is handled by the worker. Now by default the number of workers is equal to the number of cores on that CPU. When the workers are full and there are more search requests , the request will go to queue. The size of queue is also limited. Its by default size is say 100 and if there happens more parallel requests than this , then those requests would be rejected as you can see in the error log.

The solution to this would be to -

1.    Increase the size of queue or threadpool - The immediate solution for this would be to increase the size of the search queue. We can also increase the size of threadpool , but then that might badly effect the performance of individual queries. So increasing the queue might be a good idea. But then remember that this queue is memory residential and increasing the queue size too much can result in Out Of Memory issues. You can get more info on the same here.
2.    Increase number of nodes and replicas - Remember each node has its own search threadpool/queue. Also search can happen on primary shard OR replica.

 

關於thread pool，可參看：https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-threadpool.html

3 create_failed_engine_exception <500>

相關分片損壞.

刪除該分片重建便可。

4 mapper_parsing_exception <400>

存在字段格式不正確，與mapping不匹配。

檢查文檔字段格式，格式不正確有兩種狀況，其一是格式與mapping不匹配，其二是對字符串而言，可能字符非法。

5 index_not_found_exception <404>

索引不存在。

創建索引。

6 Result window is too large, from + size must be less than or equal to: [10000] but was [10000000].

result window的值默認爲10000，比實際需求的小，故而報錯。

兩個方法：其一，在elasticsearch.yml中設置index.max_result_window，也能夠直接修改某索引的settings：

curl -XPUT http://127.0.0.1:9200/indexname/_settings -d '{ "index" : { "max_result_window" : 100000000}}'

其二，使用scroll api。

POST /twitter/tweet/_search?scroll=1m
{
    "size": 100,
    "query": {
        "match" : {
            "title" : "elasticsearch"
        }
    }
}

從服務器響應獲取scroll_id，而後後面批次的結果可經過循環使用下面語句獲得：

POST  /_search/scroll 
{
    "scroll" : "1m", 
    "scroll_id" : "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==" 
}

關於scroll api，可參看：https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-scroll.html

7 illegal_argument_exception: number of documents in the index cannot exceed 2147483519 <400>

分片上文檔數達到20億上限，沒法插入新文檔。

重建索引，增長分片；也能夠增長節點。

8 action_request_validation_exception: Validation Failed:1:no requests added <400>

這個錯誤通常出如今bulk入庫時，是格式不對，每行數據後面都得回車換行，最後一行後要跟空行。

修改格式就能夠從新bulk了。

9 No Marvel Data Found (marvel error)

通常是人爲刪除（好比在sense插件裏執行刪除命令）marvel數據，致使marvel採集出錯（刪除了半天數據，另外半天數據將沒法正常採集），不能統計；對於這種狀況，等次日marvel就能夠正常使用了。

也有多是9300端口被佔用，marvel默認使用9300端口；對於這種狀況，找到9300端口占用進程，kill掉，重啓kibana便可。

10 Bad Request, you must reconsidered your request. <400>

通常是數據格式不對。

11 Invalid numeric value: Leading zeroes not allowed\n <400>

這種狀況是整數類型字段格式不正確，好比一個整數等於0000。檢查每一個整數字段的數據生成便可。

12 #Deprecation: query malformed, empty clause found at [9:9] 

查詢語句不合法，裏面含有空大括號。

13 query：string_index_out_of_bounds_exception

查詢數據時，曾遇到這個問題。後來發現是http請求頭格式不對，url裏多了一個斜槓，卻報了這個錯誤，特此記錄。

14 failed to obtain node locks

在同一個節點（linux系統）上啓動多個elasticsearch時出現failed to obtain node locks錯誤，啓動失敗.

 

轉載自：https://www.cnblogs.com/jiu0821/p/6075833.html#_label0_7