ELK相关脚本示例

监控logstash进程

#!/usr/bin/env bash
# Author:zayki
# Created: 2022.08.16
# Keep the logstash service high avaliable

pid=`netstat -tulnp |grep 9250 |awk '{print $NF}' |awk -F/ '{print $1}'`
port_status=$(nc -z -w 2 20.9.255.10 9250 |grep -c succeeded)

if [[ ! -z ${pid} ]];then
    echo "The logstash service already started."

    if [[ ${port_status} -eq 1 ]];then
        echo "The logstash service is in normal status."
    else
        echo "The logstash service is not avaliable,it need to be restart."
        kill -9 ${pid}
        /usr/local/logstash-7.9.3/bin/logstash -f /usr/local/logstash-7.9.3/config/logstash.conf -w 2 -b 300 -u 200 --log.level=debug > /dev/null 2>&1 &
    fi

else
    echo "The logstash service is not started,it will be started after a moment."
    /usr/local/logstash-7.9.3/bin/logstash -f /usr/local/logstash-7.9.3/config/logstash.conf -w 2 -b 300 -u 200 --log.level=debug > /dev/null 2>&1 &
fi

复制

手动预创建索引名称

#!/bin/bash
# Created on 2022.05.19
# /root/index_name.lst include all indices.
# es_lst include all es server ip address.

es_lst="30.0.0.12
30.0.1.9
30.0.2.2"

today=$(date -d tomorrow +%Y.%m.%d)

for ip in $es_lst
    do
        status_code=$(curl -I -m 3 -o /dev/null -s -w %{http_code} http://$ip:9200)
        if [ $status_code = "200" ];then
            for index in `cat /root/index_name.lst`
                do
                    curl -XPUT http://$ip:9200/$index-$today
                    sleep 60
                done
            echo "Index have been created."
            exit 
        else
            echo "The es with ip ${ip} can't accessed."
        fi
    done
复制

清理空间脚本1

#!/bin/bash
# Remove the index of elasticserch

echoRed() { echo $'\e[0;31m'"$1"$'\e[0m'; }
echoGreen() { echo $'\e[0;32m'"$1"$'\e[0m'; }

es_ip=$1
index_name=$2

if [ ! "$1" ] ;then
    echoRed "Usage: es_delete.sh es_ip index_name"
else
    day=`curl -S -XGET ''${es_ip}':9200/_cat/indices/'${index_name}'*?v&s=index:desc'| awk '{print $3}' |grep -v index|awk -F '-' '{print $NF}' |tail -1`
    echoGreen "The earliest start time is $day!" # >> ~/CleanIndex.log
    echoGreen "Clean index ${index_name}-$day at $es_ip......" >> ~/CleanIndex.log
    curl -S -XDELETE 'http://'$es_ip':9200/'${index_name}'-'$day''
fi
复制

清理空间脚本2

#!/bin/bash
# Remove the big size index of elasticserch
# 30.0.0.53 CLOUD_PROD
# 30.0.0.9  CLOUD_UAT

echoRed() { echo $'\e[0;31m'"$1"$'\e[0m'; }
echoGreen() { echo $'\e[0;32m'"$1"$'\e[0m'; }

es_ip=$1
today_before_7days=`date -d '-'"7"' day' +%s`
today_before_30days=`date -d '-'"30"' day' +%s`

function get_index_date() {
    curl -S -XGET ''${es_ip}':9200/_cat/indices/'$1'*?v&s=index'| awk '{print $3}' |grep -v index|awk -F '-' '{print $NF}'
}

function remove_big_index_7d() {
    for ind_name in {"aeonlife-file","aeonlife-ocr"};do
        index_day_list=`get_index_date $ind_name`
        for day in $index_day_list;do
            day2date=`date -d ${day//\./\-} +%s`
            if [ $day2date -lt $today_before_7days ];then
            echoGreen "clean index $ind_name-$day"
            curl -S -XDELETE 'http://'${es_ip}':9200/'${ind_name}'-'${day}''
            fi
        done
    done
}

function remove_big_index_30d() {
    for ind_name in {"aeonlife-gateway","aeonlife-gatewayapi-service","aeonlife-tool"};do 
        index_day_list=`get_index_date $ind_name`
        for day in $index_day_list;do
            day2date=`date -d ${day//\./\-} +%s`
            if [ $day2date -lt $today_before_30days ];then
            echoGreen "clean index $ind_name-$day"
            curl -S -XDELETE 'http://'${es_ip}':9200/'${ind_name}'-'${day}''
            fi
        done
    done
}


if [ ! "$1" ] ;then
    echoRed "Usage: deleteEsData.sh es_ip"

else
    remove_big_index_7d >> /tmp/remove_big_index_7d.log
    remove_big_index_30d >> /tmp/remove_big_index_30d.log
fi
复制