logstash修改日志输出的索引默认模版中的分片和备份

在kibana执行

GET /_template/

获取es中所有的模版信息.

然后找到了名为logstash的模版如下:

{"order": 0,"version": 50001,"template": "logstash-*","settings": {"index": {"refresh_interval": "5s"}},"mappings": {"_default_": {"_all": {"enabled": true,"norms": false},"dynamic_templates": [{"message_field": {"path_match": "message","match_mapping_type": "string","mapping": {"type": "text","norms": false}}},{"string_fields": {"match": "*","match_mapping_type": "string","mapping": {"type": "text","norms": false,"fields": {"keyword": {"type": "keyword","ignore_above": 256}}}}}],"properties": {"&＃64;timestamp": {"type": "date","include_in_all": false},"&＃64;version": {"type": "keyword","include_in_all": false},"geoip": {"dynamic": true,"properties": {"ip": {"type": "ip"},"location": {"type": "geo_point"},"latitude": {"type": "half_float"},"longitude": {"type": "half_float"}}}}}},"aliases": {}
}

我们发现setting中没有设置分片和备份.可见这是采用的es的默认分片5和默认备份1

这个是很耗费磁盘的.而日志其实没必要那么多的分片和备份.因为就两台机器,磁盘也不够.

所以我们修改其logstash的模板信息中的分片和备份,使其以后创建索引的时候分片设置为2,备份设置为0.


PUT /_template/logstash
{"index_patterns": ["uatlog*","testlog*","devlog*","prodlog*","uatbacklog*","testbacklog","devbacklog","prodback*"],"order": 1,"settings": {"number_of_shards": 2,"number_of_replicas": 0,"refresh_interval": "5s"},"mappings": {"_doc": {"dynamic_templates": [{"message_field": {"path_match": "message","match_mapping_type": "string","mapping": {"type": "text","norms": false}}},{"string_fields": {"match": "*","match_mapping_type": "string","mapping": {"type": "text","norms": false,"fields": {"keyword": {"type": "keyword","ignore_above": 256}}}}}],"properties": {"&＃64;timestamp": {"type": "date"},"&＃64;version": {"type": "keyword"},"geoip": {"dynamic": true,"properties": {"ip": {"type": "ip"},"location": {"type": "geo_point"},"latitude": {"type": "half_float"},"longitude": {"type": "half_float"}}}}}},"aliases": {}
}

上面的put方法完全参考官方的模版设置方法:https://www.elastic.co/guide/en/elasticsearch/reference/6.3/indices-templates.html,可以根据需要设置相关信息.  另外注意设置的时候不能光设置setting,其他比如mapping不设置的话,默认为给置为空

设置成功后我们执行

GET /_template/logstash

查看名为logstash的模版名的模版信息.可以看到,索引的名称中凡是包含uatlog,testlog,devlog等前缀信息的索引的,其索引的分片都设置为2,备份都设置为1.

配置完毕!