ELK logstash 翻转索引没有代表分片

Question

我用麋鹿。 我的 logstash 启用了 rollover.index 模板 5 个 pri 分片 1 个 rep 分片。 但是只有当前索引有 rep 分片，旧索引只有 pri 分片。 如何使旧索引也有 5 个 pri 分片和 1 个 rep 分片？

# GET /_cat/indices?v
health status index                               uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   cloud-logs-2022.03.02-000046        ycvYYKEtRZSJxR8wwdJlqQ   5   0  128888646            0     52.1gb         52.1gb
green  open   cloud-logs-2022.03.02-000047        JclF5gpoTxKvBpPuTuy-jQ   5   1   42849847            0     37.3gb         18.6gb

# GET /_template
{
"cloud-log": {
        "order": 1,
        "index_patterns": [
            "cloud-logs-*"
        ],
        "settings": {
            "index": {
                "lifecycle": {
                    "name": "logstash-policy",
                    "rollover_alias": "cloud-logs"
                },
                "codec": "best_compression",
                "mapping": {
                    "total_fields": {
                        "limit": "10000"
                    }
                },
                "refresh_interval": "30s",
                "number_of_shards": "5",
                "query": {},
                "number_of_routing_shards": "30",
                "number_of_replicas": "1"
            }
        },
        "mappings": {},
        "aliases": {}
    }
}

Answer 1

管理cloud-logs-*索引生命周期的logstash-policy ILM 策略可能声明当索引回滚时，副本分片的数量应从 1 减少到 0。

您可以直接在 Kibana > Stack management > Index lifecycle policy 中更改它