Elasticsearch クラスタ設定

クイックガイド一覧に戻る

• You must first follow the installation and configuration steps on each node.
• The minimum size of an Elasticsearch cluster is 3 nodes and it must always grow in odd numbers in order to make use of the quorum system and guarantee data integrity.
• Ensure that you have connectivity between all 3 nodes and that ports 9200 and 9300 are accessible between each and every node.

• まず最初に 各ノードでインストールと設定手順 を行う必要があります。
• Elasticsearch クラスターの最小サイズは 3ノードであり、quorum システムを利用してデータの整合性を保証するには、常に奇数で増やす必要があります。
• 3つのノードすべての間で通信が可能であり、各ノード間でポート 9200 および 9300 へアクセスできることを確認してください。

Stop the Elasticsearch service on each and every node:

全ノードの Elasticsearch サービスを停止します。

systemctl stop elasticsearch.service

Modify the following lines in the configuration file /etc/elasticsearch/elasticsearch.yml :

設定ファイル /etc/elasticsearch/elasticsearch.yml の以下の行を編集します。

#discovery.seed_hosts: ["host1", "host2"]
#cluster.initial_master_nodes: ["host1", "host2"]

Uncomment the lines and add the IP addresses or URLs of each node:

該当行を コメントアウト し、各ノードの IP アドレスまたは URL を追加します。

discovery.seed_hosts: ["host1", "host2", "host3"]
cluster.initial_master_nodes: ["host1", "host2", "host3"]

Example with IP addresses:

IP アドレスでの例:

discovery.seed_hosts: ["172.42.42.101", "172.42.42.102", "172.42.42.103"]
cluster.initial_master_nodes: ["172.42.42.101", "172.42.42.102", "172.42.42.103"]

Before starting the service, because the nodes were started for the first time on their own (standalone), the contents of the data folder (by default /var/lib/elasticsearch/) must be deleted in order to start the cluster for the first time. Do this with the command:

ノードは初回に単独で(スタンドアロンで)開始されたため、サービスを開始する前にデータフォルダーの内容(デフォルトでは /var/lib/elasticsearch/)を削除する必要があります。 次のコマンドを実行します。

rm -rf /var/lib/elasticsearch/*

Now it is time to start the services on each and every node. Start and check that they are running with the commands:

次に、すべてのノードでサービスを開始します。 次のコマンドで開始し、実行されていることを確認します。

systemctl start elasticsearch.service && systemctl status elasticsearch.service

You should get an output similar to:

次のような出力を得られます。

Once the services have been started, you must confirm that the 3 nodes are joined to the cluster correctly, so when executing the following command on any of the nodes, the same response should be given:

サービスが開始されたら、3つのノードがクラスターに正しく参加していることを確認する必要があります。任意のノードで次のコマンドを実行すると、同じ応答が返されます。

curl -XGET http://127.0.0.1:9200/_cat/nodes

Check again the firewall configuration always taking into account that the nodes should communicate through ports 9200 and 9300 and that from the PFMS server and the PFMS Web Console should be able to access port 9200 as well. With these steps you will have already installed and configured the Elasticsearch cluster to be used as Pandora FMS log storage engine.

ノードがポート 9200 および 9300 を介して通信する必要があることに加えて、Pandora FMS サーバおよび Pandora FMS Web コンソールからポート 9200 へアクセスできる必要があることを常に考慮してファイアウォールの設定を再度確認してください。ここまでの設定により、Pandora FMS ログストレージエンジンとして使用される Elasticsearch クラスターの準備が完了です。

Before putting into production an environment, either a single node or a data cluster, it is recommended to apply the corresponding configurations to this node or cluster according to its use. In the case of the indexes generated by Pandora FMS, the most effective way to do it is defining a template to define the configuration of the fields and the stored data.

• To create a basic template follow the instructions in “Data models and templates for a node”.
• To define a multinode template you must take into account the following information:
  • When configuring the template (JSON format), you need to configure as many searches as you have nodes, however to correctly configure the replicas you must subtract 1 from the number of nodes in the environment.

For example, in a Pandora FMS environment with Elasticsearch with 3 configured nodes, when you modify the number_of_search and number_of_replicas fields it should look like this:

{
 "index_patterns": ["pandorafms*"],
 "settings": {
   "number_of_shards": 3,
   "auto_expand_replicas" : "0-1",
   "number_of_replicas" : "2"
 },

• https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster

From the command line you can list the templates of the environment by executing:

curl -X GET "localhost:9200/_cat/templates/*?v=true&s=name&pretty"

You can also view the details of a template, for example the one we have created for pandorafms by running it:

curl -X GET "localhost:9200/_template/pandorafms*?pretty"

which will return in JSON format the configuration you have defined.

You can perform these operations through the Elasticsearch interface in Pandora FMS using the native Elasticsearch commands.

• PUT _template/<template_name> {json_data}: allows you to enter the data of the template to be created.
• GET _template/><template_name>: allows you to display the created template.

クイックガイド一覧に戻る