elk的备份与恢复

elasticsearch提供了快照功能：

1、在elsticsearch的配置文件中定义一个path.repo路径配置

path.repo: ["/elk/my_backup"]

重新启动elasticsearch服务

创建备份的文件夹并赋予权限

mkdir -p /elk/my_backup

chmod 755 /elk/my_backup

chown -R elasticsearch.elasticsearch /elk/*

创建repository:

curl -XPUT ‘http://192.168.0.224:9200/_snapshot/backup‘ -d ‘

{

"type": "fs",                //表示类型为文件系统

"settings": {

"location": "/elk/my_backup/backup",                //存储的路径

"compress": true                //是否支持压缩

}

}‘

查看repository信息

$ curl -XGET ‘http://192.168.0.224:9200/_snapshot/backup?pretty‘

2、创建快照

备份工作在后台运行

$ curl -XPUT ‘http://192.168.0.224:9200/_snapshot/backup/snapshot_1(快照名)‘

同步执行,加wait_for_completion 标志,备份完成后才返回，如果数据量大的话，会花很长时间

$ curl -XPUT ‘http://192.168.212.190:9200/_snapshot/my_backup/snapshot_2?wait_for_completion=true‘

如果只想备份部分索引的话，可以加上indices 参数：

$ curl -XPUT ‘http://192.168.212.190:9200/_snapshot/my_backup/snapshot_3‘ -d ‘

{

"indices": "index_1,index_2",

"ignore_indices": "missing"

}‘

查看备份信息

$ curl -XGET ‘http://192.168.0.224:9200/_snapshot/backup/snapshot_2‘

如果要查看所有索引的信息，使用如下api：

$ curl -XGET ‘http://192.168.0.224:9200/_snapshot/backup/_all‘

另外还有个一api可以看到更加详细的信息：

$ curl -XGET ‘http://192.168.0.224:9200/_snapshot/backup/snapshot_2/_status‘

删除备份

$ curl -XDELETE ‘http://192.168.0.224:9200/_snapshot/backup/snapshot_2‘

[[email protected] elk]# vim esback.sh

#!/bin/bash

#elasticsearch备份脚本

#快照的名字

filename=`date +%Y%m%d%H`

#备份的文件名

backesFile=es$filename.tar.gz

cd /elk/my_backup

mkdir es_dump

cd es_dump

#删除之前的快照，$filename为上一次快照的名字

curl -XDELETE "192.168.0.224:9200/_snapshot/backup/$filename?pretty"

echo ‘sleep 30‘

sleep 30

#创建一个快照

curl -XPUT "192.168.0.224:9200/_snapshot/backup/$filename?wait_for_completion=true&pretty"

echo ‘sleep 30‘

sleep 30

#拷贝仓库内的快照到一个文件并打包

cp  -a /elk/my_backup/backup/* /elk/my_backup/es_dump

cd ..

tar czf $backesFile  es_dump/

rm es_dump -rf

恢复snapshot_1里的全部索引：

$ curl -XPOST ‘http://192.168.0.224:9200/_snapshot/backup/snapshot_1/_restore‘

api额外的参数:

$ curl -XPOST ‘http://192.168.0.224:9200/_snapshot/backup/snapshot_1/_restore‘ -d ‘

{

"indices": "index_1",

"rename_pattern": "index_(.+)",

"rename_replacement": "restored_index_$1"

}‘

indices: 设置只恢复index_1索引

rename_pattern 和rename_replacement: 用来正则匹配要恢复的索引，并且重命名。和备份一样，api会立刻返回值，然后在后台执行恢复，使用wait_for_completion 标记强制同步执行。

以使用下面两个api查看状态

$ curl -XGET ‘http://192.168.0.224:9200/_recovery/‘

#!/bin/bash

filename=‘2017033020‘

backesFile=es$filename.tar.gz

cd /elk/my_backup/

tar zxvf $backesFile

rm /elk/my_backup/backup/* -rf

cp -a /elk/my_backup/es_dump/* /elk/my_backup/backup

curl -XPOST "192.168.0.224:9200/logs*/_close"

curl -XPOST "192.168.0.224:9200/.kiba*/_close"

echo ‘sleep 5‘

sleep 5

curl -XPOST "192.168.0.224:9200/_snapshot/backup/$filename/_restore?pretty"

#curl -XPOST ‘192.168.0.224:9200/_snapshot/backup/$filename/_restore?pretty‘ -d ‘

#{

#    "indices":"logs*"

#}‘

echo ‘sleep 5‘

sleep 5

#curl -XPOST ‘192.168.0.224:9200/logs*/_open‘

#curl -XPOST ‘192.168.0.224:9200/.kiba*/_open‘

rm es_dump -rf