ElasticSearch输入“只读".模式,无法更改节点 [英] ElasticSearch entered "read only" mode, node cannot be altered

查看:298
本文介绍了ElasticSearch输入“只读".模式,无法更改节点的处理方法,对大家解决问题具有一定的参考价值,需要的朋友们下面随着小编来一起学习吧!

问题描述

我的ES群集(由5个数据节点,3个主节点组成)在夜间发生了某些事情.

Something happened during the night to my ES cluster (composed of 5 data nodes, 3 master nodes).

说实话,我不知道发生了什么,但是所有索引和数据都被删除了,集群进入了只读"模式,可能被黑客入侵了?

To be honest, I have no idea what happened but all the indices and data were deleted and the cluster entered a "read only" mode, possibly hacked?

当试图使Kiban运行时,我得到以下信息:

When trying to get Kiban running i get the following:

尝试重新启动kibana-它重新启动,没有任何更改. 尝试重新启动Elastic-重新启动(所有节点),没有任何更改.

Tried restarting kibana - it restarted, nothing changed. Tried restarting Elastic - it restarted (all nodes), nothing changed.

然后我查看了群集设置,这就是我得到的:

I then had a look at the cluster settings and this is what I got:

{
  "persistent": {
    "cluster": {
      "routing": {
        "allocation": {
          "enable": "all"
        }
      },
      "blocks": {
        "read_only": "true"
      }
    }
  },
  "transient": {
    "cluster": {
      "routing": {
        "allocation": {
          "enable": "all"
        }
      }
    }
  }
}

我尝试如下撤消只读操作:

I tried undoing the read only as follows:

PUT _cluster/settings
{
  "persistent": {
    "blocks.read_only": false
  }
}

如您所见,没有运气:

{
  "error": {
    "root_cause": [
      {
        "type": "cluster_block_exception",
        "reason": "blocked by: [FORBIDDEN/6/cluster read-only (api)];"
      }
    ],
    "type": "cluster_block_exception",
    "reason": "blocked by: [FORBIDDEN/6/cluster read-only (api)];"
  },
  "status": 403
}

有什么想法吗?

更新:问题由Andrei Stefan解决,现在更重要的部分-为什么? 发生了什么事,为什么? 我丢失了所有数据,并且群集进入了只读模式.

UPDATE: Problem solved by Andrei Stefan, now for the more important part - why? What happened and why? I've lost all data and my cluster entered a read-only mode.

推荐答案

正确的命令是:

PUT /_cluster/settings
{
  "persistent" : {
    "cluster.blocks.read_only" : false
  }
}

这篇关于ElasticSearch输入“只读".模式,无法更改节点的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!

查看全文
登录 关闭
扫码关注1秒登录
发送“验证码”获取 | 15天全站免登陆