监控elasticsearch

转载自：https://cloud.tencent.com/developer/article/1655489

注意：上半截跟下半截是采用的不同的方式，建议采用下半截的方式，上半截的方式据说获取不到数据，具体效果有待测试验证

安装监控插件

wget https://github.com/justwatchcom/elasticsearch_exporter/releases/download/v1.0.4rc1/elasticsearch_exporter-1.0.4rc1.linux-amd64.tar.gz

 tar -zxvf elasticsearch_exporter-1.0.4rc1.linux-amd64.tar.gz
 cd elasticsearch_exporter-1.0.4rc1.linux-amd64/
 nohup ./elasticsearch_exporter --web.listen-address ":9109"  --es.uri http://192.168.50.153:9200 &

完整参数启动方式：

nohup ./elasticsearch_exporter --es.all --es.indices --es.cluster_settings --es.indices_settings --es.shards --es.snapshots --es.timeout=10s --web.listen-address=":9114" --web.telemetry-path="/metrics" --es.uri http://192.168.50.153:9200 &

参数说明：

--es.uri 　　　　默认http://localhost:9200，连接到的Elasticsearch节点的地址（主机和端口）。 这可以是本地节点（例如localhost：9200），也可以是远程 Elasticsearch服务器的地址

--es.all 默认flase，如果为true，则查询群集中所有节点的统计信息，而不仅仅是查询我们连接到的节点。

--es.cluster_settings 默认flase，如果为true，请在统计信息中查询集群设置

--es.indices 默认flase，如果为true，则查询统计信息以获取集群中的所有索引。

--es.indices_settings 默认flase，如果为true，则查询集群中所有索引的设置统计信息。

--es.shards 默认flase，如果为true，则查询集群中所有索引的统计信息，包括分片级统计信息（意味着es.indices = true）。

--es.snapshots 默认flase，如果为true，则查询集群快照的统计信息。

开机自启

cat  /etc/systemd/system/elasticsearch_exporter.service

Description=elasticsearch_exporter
After=local-fs.target network-online.target network.target
Wants=local-fs.target network-online.target network.target

[Service]
ExecStart=/usr/local/elasticsearch_exporter/elasticsearch_exporter \
	--es.all --es.indices \
	--es.cluster_settings \
	--es.indices_settings \
	--es.shards --es.snapshots \
	--web.listen-address ":9114" \
	--es.timeout 20s \
	--es.uri http://172.20.32.218:9200
Restart=on-failure
[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable elasticsearch_exporter
systemctl start elasticsearch_exporter
systemctl status elasticsearch_exporter

启动成功后，可以访问 http://192.168.50.153:9109/metrics ，看抓取的信息

监控图表

指标	解析
##搜索和索引性能
elasticsearch_indices_search_query_total	查询总数 吞吐量
elasticsearch_indices_search_query_time_seconds	查询总时间 性能
elasticsearch_indices_search_fetch_total	提取总数
elasticsearch_indices_search_fetch_time_seconds	花费在提取上的总时间
##索引请求
elasticsearch_indices_indexing_index_total	索引的文件总数
elasticsearch_indices_indexing_index_time_seconds_total	索引文档总时间
elasticsearch_indices_indexing_delete_total	索引的文件删除总数
elasticsearch_indices_indexing_delete_time_seconds_total	索引的文件删除总时间
elasticsearch_indices_refresh_total	索引刷新总数
elasticsearch_indices_refresh_time_seconds_total	刷新指数的总时间
elasticsearch_indices_flush_total	索引刷新总数到磁盘
elasticsearch_indices_flush_time_seconds	将索引刷新到磁盘上的总时间 累计flush时间
##JVM内存和垃圾回收
elasticsearch_jvm_gc_collection_seconds_sum	GC run time in seconds垃圾回收时间
elasticsearch_jvm_gc_collection_seconds_count	Count of JVM GC runs垃圾搜集数
elasticsearch_jvm_memory_committed_bytes	JVM memory currently committed by area最大使用内存限制
elasticsearch_jvm_memory_max_bytes	配置的最大jvm值
elasticsearch_jvm_memory_pool_max_bytes	JVM内存最大池数
elasticsearch_jvm_memory_pool_peak_max_bytes	最大的JVM内存峰值
elasticsearch_jvm_memory_pool_peak_used_bytes	池使用的JVM内存峰值
elasticsearch_jvm_memory_pool_used_bytes	目前使用的JVM内存池
elasticsearch_jvm_memory_used_bytes	JVM memory currently used by area 内存使用量
##集群健康和节点可用性
elasticsearch_cluster_health_status	集群状态，green（ 所有的主分片和副本分片都正常运行）、yellow（所有的主分片都正常运行，但不是所有的副本分片都正常运行）red（有主分片没能正常运行）值为1的即为对应状态
elasticsearch_cluster_health_number_of_data_nodes	node节点的数量
elasticsearch_cluster_health_number_of_in_flight_fetch	正在进行的碎片信息请求的数量
elasticsearch_cluster_health_number_of_nodes	集群内所有的节点
elasticsearch_cluster_health_number_of_pending_tasks	尚未执行的集群级别更改
elasticsearch_cluster_health_initializing_shards	正在初始化的分片数
elasticsearch_cluster_health_unassigned_shards	未分配分片数
elasticsearch_cluster_health_active_primary_shards	活跃的主分片总数
elasticsearch_cluster_health_active_shards	活跃的分片总数（包括复制分片）
elasticsearch_cluster_health_relocating_shards	当前节点正在迁移到其他节点的分片数量，通常为0，集群中有节点新加入或者退出时该值会增加
##资源饱和度
elasticsearch_thread_pool_completed_count	线程池操作完成（bulk、index、search、force_merge）
elasticsearch_thread_pool_active_count	线程池线程活动（bulk、index、search、force_merge）
elasticsearch_thread_pool_largest_count	线程池最大线程数（bulk、index、search、force_merge）
elasticsearch_thread_pool_queue_count	线程池中的排队线程数（bulk、index、search、force_merge）
elasticsearch_thread_pool_rejected_count	线程池的被拒绝线程数（bulk、index、search、force_merge）
elasticsearch_indices_fielddata_memory_size_bytes	fielddata缓存的大小（字节）
elasticsearch_indices_fielddata_evictions	来自fielddata缓存的驱逐次数
elasticsearch_indices_filter_cache_evictions	来自过滤器缓存的驱逐次数（仅版本2.x）
elasticsearch_indices_filter_cache_memory_size_bytes	过滤器高速缓存的大小（字节）（仅版本2.x）
elasticsearch_cluster_health_number_of_pending_tasks	待处理任务数
elasticsearch_indices_get_time_seconds
elasticsearch_indices_get_missing_total	丢失的文件的GET请求总数
elasticsearch_indices_get_missing_time_seconds	花费在文档丢失的GET请求上的总时间
elasticsearch_indices_get_exists_time_seconds
elasticsearch_indices_get_exists_total
elasticsearch_indices_get_total
##主机级别的系统和网络指标
elasticsearch_process_cpu_percent	Percent CPU used by process CPU使用率
elasticsearch_filesystem_data_free_bytes	Free space on block device in bytes 磁盘可用空间
elasticsearch_process_open_files_count	Open file descriptors ES进程打开的文件描述符
elasticsearch_transport_rx_packets_total	Count of packets receivedES节点之间网络入流量
elasticsearch_transport_tx_packets_total	Count of packets sentES节点之间网络出流量

prometheus配置

- job_name: 'elasticsearch'
      scrape_interval: 60s
      scrape_timeout:  30s
      metrics_path: "/metrics"
      static_configs:
      - targets:
        - '192.168.50.153:9109'
        labels:
          service: elasticsearch
      relabel_configs:
      - source_labels: [__address__]
        regex: '(.*)\:9109'
        target_label:  'instance'
        replacement:   '$1'
      - source_labels: [__address__]
        regex:         '.*\.(.*)\.lan.*'
        target_label:  'environment'
        replacement:   '$1'

之后运行重读prometheus配置命令

./reload-prometheus.sh

grafana模板

https://grafana.com/dashboards/2322

报警配置

groups:
- name: elasticsearchStatsAlert
  rules:
  - alert: Elastic_Cluster_Health_RED
    expr: elasticsearch_cluster_health_status{color="red"}==1
    for: 1m
    labels:
      severity: critical
    annotations:
      summary: "Instance {{ $labels.instance }}: not all primary and replica shards are allocated in elasticsearch cluster {{ $labels.cluster }}"
      description: "Instance {{ $labels.instance }}: not all primary and replica shards are allocated in elasticsearch cluster {{ $labels.cluster }}."
  - alert: Elastic_Cluster_Health_Yellow
    expr: elasticsearch_cluster_health_status{color="yellow"}==1
    for: 1m
    labels:
      severity: critical
    annotations:
      summary: " Instance {{ $labels.instance }}: not all primary and replica shards are allocated in elasticsearch cluster {{ $labels.cluster }}"
      description: "Instance {{ $labels.instance }}: not all primary and replica shards are allocated in elasticsearch cluster {{ $labels.cluster }}."
  - alert: Elasticsearch_JVM_Heap_Too_High
    expr: elasticsearch_jvm_memory_used_bytes{area="heap"} / elasticsearch_jvm_memory_max_bytes{area="heap"} > 0.8
    for: 1m
    labels:
      severity: critical
    annotations:
      summary: "ElasticSearch node {{ $labels.instance }} heap usage is high "
      description: "The heap in {{ $labels.instance }} is over 80% for 15m."
  - alert: Elasticsearch_health_up
    expr: elasticsearch_cluster_health_up !=1
    for: 1m
    labels:
      severity: critical
    annotations:
      summary: " ElasticSearch node: {{ $labels.instance }} last scrape of the ElasticSearch cluster health failed"
      description: "ElasticSearch node: {{ $labels.instance }} last scrape of the ElasticSearch cluster health failed"
  - alert: Elasticsearch_Too_Few_Nodes_Running
    expr: elasticsearch_cluster_health_number_of_nodes < 12
    for: 1m
    labels:
      severity: critical
    annotations:
      summary: "There are only {{$value}} < 12 ElasticSearch nodes running "
      description: "lasticSearch running on less than 12 nodes(total 14)"
  - alert: Elasticsearch_Count_of_JVM_GC_Runs
    expr: rate(elasticsearch_jvm_gc_collection_seconds_count{}[5m])>5
    for: 1m
    labels:
      severity: critical
    annotations:
      summary: "ElasticSearch node {{ $labels.instance }}: Count of JVM GC runs > 5 per sec and has a value of {{ $value }} "
      description: "ElasticSearch node {{ $labels.instance }}: Count of JVM GC runs > 5 per sec and has a value of {{ $value }}"
  - alert: Elasticsearch_GC_Run_Time
    expr: rate(elasticsearch_jvm_gc_collection_seconds_sum[5m])>0.3
    for: 1m
    labels:
      severity: critical
    annotations:
      summary: " ElasticSearch node {{ $labels.instance }}: GC run time in seconds > 0.3 sec and has a value of {{ $value }}"
      description: "ElasticSearch node {{ $labels.instance }}: GC run time in seconds > 0.3 sec and has a value of {{ $value }}"
  - alert: Elasticsearch_json_parse_failures
    expr: elasticsearch_cluster_health_json_parse_failures>0
    for: 1m
    labels:
      severity: critical
    annotations:
      summary: " ElasticSearch node {{ $labels.instance }}: json parse failures > 0 and has a value of {{ $value }}"
      description: "ElasticSearch node {{ $labels.instance }}: json parse failures > 0 and has a value of {{ $value }}"
  - alert: Elasticsearch_breakers_tripped
    expr: rate(elasticsearch_breakers_tripped{}[5m])>0
    for: 1m
    labels:
      severity: critical
    annotations:
      summary: " ElasticSearch node {{ $labels.instance }}: breakers tripped > 0 and has a value of {{ $value }}"
      description: "ElasticSearch node {{ $labels.instance }}: breakers tripped > 0 and has a value of {{ $value }}"
  - alert: Elasticsearch_health_timed_out
    expr: elasticsearch_cluster_health_timed_out>0
    for: 1m
    labels:
      severity: critical
    annotations:
      summary: " ElasticSearch node {{ $labels.instance }}: Number of cluster health checks timed out > 0 and has a value of {{ $value }}"
      description: "ElasticSearch node {{ $labels.instance }}: Number of cluster health checks timed out > 0 and has a value of {{ $value }}"

=上半截和下半截分隔线=============================================

=上半截和下半截分隔线=============================================

=上半截和下半截分隔线=============================================

elasticsearch-7.x监控

Since Elasticsearch 7.0.0 : ./bin/elasticsearch-plugin install -b https://github.com/vvanholl/elasticsearch-prometheus-exporter/releases/download/7.2.1.0/prometheus-exporter-7.2.1.0.zip

Since Elasticsearch 6.0.0 : ./bin/elasticsearch-plugin install -b https://github.com/vvanholl/elasticsearch-prometheus-exporter/releases/download/6.8.0.0/prometheus-exporter-6.8.0.0.zip

On Elasticsearch 5.x.x : ./bin/elasticsearch-plugin install -b https://github.com/vvanholl/elasticsearch-prometheus-exporter/releases/download/5.6.16.0/elasticsearch-prometheus-exporter-5.6.16.0.zip

On old 2.x.x versions : ./bin/plugin install https://github.com/vvanholl/elasticsearch-prometheus-exporter/releases/download/2.4.1.0/elasticsearch-prometheus-exporter-2.4.1.0.zip

Do not forget to restart the node after the installation!

Note that the plugin needs the following special permissions:

java.lang.RuntimePermission accessClassInPackage.sun.misc
java.lang.RuntimePermission accessDeclaredMembers
java.lang.reflect.ReflectPermission suppressAccessChecks
If you have a lot of indices and think this data is irrelevant, you can disable in the main configuration file:

prometheus.indices: false
To disable exporting cluster settings use:

prometheus.cluster.settings: false
Uninstall
Since Elasticsearch 6.0.0: ./bin/elasticsearch-plugin remove prometheus-exporter

On Elasticsearch 5.x.x: ./bin/elasticsearch-plugin remove prometheus-exporter

On old 2.x.x versions: ./bin/plugin remove prometheus-exporter

prometheus配置

- job_name: elasticsearch
  scrape_interval: 10s
  metrics_path: "/_prometheus/metrics"
  static_configs:
  - targets:
    - node1:9200
    - node2:9200
    - node3:9200

带账号密码：

- job_name: 'elastic-cluster'
      scrape_interval: 10s
      metrics_path: '/_prometheus/metrics'
      static_configs:
      - targets:
        - 'node1:9200'
        - 'node2:9200'
        - 'node3:9200'
      basic_auth:
        username: 'elastic'
        password: 'elastic'

grafana

https://grafana.com/grafana/dashboards/266