ElasticSearch输入“只读".模式,无法更改节点 [英] ElasticSearch entered "read only" mode, node cannot be altered
问题描述
我的ES群集(由5个数据节点,3个主节点组成)在夜间发生了某些事情.
Something happened during the night to my ES cluster (composed of 5 data nodes, 3 master nodes).
说实话,我不知道发生了什么,但是所有索引和数据都被删除了,集群进入了只读"模式,可能被黑客入侵了?
To be honest, I have no idea what happened but all the indices and data were deleted and the cluster entered a "read only" mode, possibly hacked?
当试图使Kiban运行时,我得到以下信息:
When trying to get Kiban running i get the following:
尝试重新启动kibana-它重新启动,没有任何更改. 尝试重新启动Elastic-重新启动(所有节点),没有任何更改.
Tried restarting kibana - it restarted, nothing changed. Tried restarting Elastic - it restarted (all nodes), nothing changed.
然后我查看了群集设置,这就是我得到的:
I then had a look at the cluster settings and this is what I got:
{
"persistent": {
"cluster": {
"routing": {
"allocation": {
"enable": "all"
}
},
"blocks": {
"read_only": "true"
}
}
},
"transient": {
"cluster": {
"routing": {
"allocation": {
"enable": "all"
}
}
}
}
}
我尝试如下撤消只读操作:
I tried undoing the read only as follows:
PUT _cluster/settings
{
"persistent": {
"blocks.read_only": false
}
}
如您所见,没有运气:
{
"error": {
"root_cause": [
{
"type": "cluster_block_exception",
"reason": "blocked by: [FORBIDDEN/6/cluster read-only (api)];"
}
],
"type": "cluster_block_exception",
"reason": "blocked by: [FORBIDDEN/6/cluster read-only (api)];"
},
"status": 403
}
有什么想法吗?
更新:问题由Andrei Stefan解决,现在更重要的部分-为什么? 发生了什么事,为什么? 我丢失了所有数据,并且群集进入了只读模式.
UPDATE: Problem solved by Andrei Stefan, now for the more important part - why? What happened and why? I've lost all data and my cluster entered a read-only mode.
推荐答案
正确的命令是:
PUT /_cluster/settings
{
"persistent" : {
"cluster.blocks.read_only" : false
}
}
这篇关于ElasticSearch输入“只读".模式,无法更改节点的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!