ELK5.6.1集群升级到6.6.0集群更新文档（完整版）
环境介绍：
elasticsearch-5.6.1 --- elasticsearch-6.6.0
kibana-5.6.1 --- kibana-6.6.0
Logstash-5.6.1 --- Logstash-6.6.0
IP |
角色 |
10.0.9.24 |
Elasticsearch，Kibana |
10.0.9.25 |
Elasticsearch(master) |
10.0.8.50 |
Logstash |
一、Elasticsearch升级
1．备份所有索引
①修改配置文件，增加备份仓库设置
vim elasticsearch.yml
path.repo: ["/elk/data/bak"] #上一级文件夹必须存在，这个路径必须是一个网盘，如NFS
②创建仓库名
curl -XPUT http://10.0.9.25:9200/_snapshot/my_fs_backup -H 'Content-Type: application/json' -d'{"type": "fs","settings": {"location": "/elk/data/bak/Backup20190531.bk","compress": true}}'
③向仓库备份index
curl -XPUT http://10.0.9.25:9200/_snapshot/my_fs_backup/snapshot_1?wait_for_completion=true
④查看备份状态，信息
curl -XGET http://10.0.9.25:9200/_snapshot/my_backup/snapshot_1 curl -XGET http://10.0.9.25:9200/_snapshot/my_backup/_all curl -XGET http://10.0.9.25:9200/_snapshot/my_backup/snapshot_1/status
2．停止碎片分配
curl -XPUT '10.0.9.24:9200/_cluster/settings?pretty' -H 'Content-Type: application/json' -d'
{
"persistent": {
"cluster.routing.allocation.enable": "none"
}
}'
3．刷新同步状态（可选）
curl -XPOST '10.0.9.24:9200/_flush/synced?pretty'
4．关闭所有节点
①ps -ef|grep elastic
②kill -9 pid
5．升级软件版本
①tar xvf elasticsearch-6.6.0.tar.gz
②mv elasticsearch-6.6.0 /elk/
6．配置文件修改，重新指向原有data目录和logs目录
①cd /elk/elasticsearch-6.6.0
②vim config/elasticsearch.yml
cluster.name: myapp node.name: elk_node1 path.data: /elk/data bootstrap.memory_lock: true bootstrap.system_call_filter: false network.host: 10.0.9.25 http.port: 9200 discovery.zen.ping.unicast.hosts: ["10.0.9.24", "10.0.9.25"] discovery.zen.minimum_master_nodes: 1 #如果有3个节点，这里配置为2 gateway.recover_after_nodes: 1 gateway.expected_nodes: 2 gateway.recover_after_time: 4m action.auto_create_index: true cluster.routing.allocation.same_shard.host: true thread_pool.bulk.queue_size: 1000 node.data: true path.repo: ["/elk/data/bak"]
7．升级x-pack索引
①获取x-pack索引状态
curl -XGET 10.0.9.24:9200/_xpack/migration/assistance
②升级所有索引
curl -XPOST 10.0.9.24:9200/_xpack/migration/upgrade/.security curl -XPOST 10.0.9.24:9200/_xpack/migration/upgrade/.watches curl -XPOST 10.0.9.24:9200/_xpack/migration/upgrade/.triggered_watches
8．启动服务，查看健康状态
①启动elasticsearch
./bin/elasticsearch -d
curl -XGET '10.0.9.24:9200/_cat/health?pretty' curl -XGET '10.0.9.24:9200/_cat/nodes?pretty'
9．恢复碎片分配
curl -XPUT '10.0.9.24:9200/_cluster/settings?pretty' -H 'Content-Type: application/json' -d'
{
"persistent": {
"cluster.routing.allocation.enable": "true"
}
}'
二、Kibana升级
1 . 解压和复制
①tar xvf kibana-6.6.0-linux-x86_64.tar.gz
②mv kibana-6.6.0-linux-x86_64 /elk
2 . 配置文件修改
①cd /elk/kibana-6.6.0-linux-x86_64
②vim config/kibana.yml
server.port: 7601 server.host: "10.0.9.24" elasticsearch.hosts: "http://10.0.9.24:9200" #elasticsearch.username: "elastic" #这里必须和X-PACK破解结合 #elasticsearch.password: "changeme" pid.file: /elk/kibana-6.6.0-linux-x86_64/kibana.pid logging.dest: stdout
3 . 重建.kibana索引
①设置.kibana的index空间为只读（block.sh）
curl -XPUT '10.0.9.24:9200/.kibana/_settings?pretty' -H 'Content-Type: application/json' -d'
{
"index.blocks.write": true
}'
②创建新的index空间.kibana-6（new_space.sh）
curl -XPUT '10.0.9.24::9200/.kibana-6?pretty' -H 'Content-Type: application/json' -d'
{
"settings" : {
"number_of_shards" : 1,
"index.mapper.dynamic": false
},
"mappings" : {
"doc": {
"properties": {
"type": {
"type": "keyword"
},
"updated_at": {
"type": "date"
},
"config": {
"properties": {
"buildNum": {
"type": "keyword"
}
}
},
"index-pattern": {
"properties": {
"fieldFormatMap": {
"type": "text"
},
"fields": {
"type": "text"
},
"intervalName": {
"type": "keyword"
},
"notExpandable": {
"type": "boolean"
},
"sourceFilters": {
"type": "text"
},
"timeFieldName": {
"type": "keyword"
},
"title": {
"type": "text"
}
}
},
"visualization": {
"properties": {
"description": {
"type": "text"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"savedSearchId": {
"type": "keyword"
},
"title": {
"type": "text"
},
"uiStateJSON": {
"type": "text"
},
"version": {
"type": "integer"
},
"visState": {
"type": "text"
}
}
},
"search": {
"properties": {
"columns": {
"type": "keyword"
},
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"sort": {
"type": "keyword"
},
"title": {
"type": "text"
},
"version": {
"type": "integer"
}
}
},
"dashboard": {
"properties": {
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"optionsJSON": {
"type": "text"
},
"panelsJSON": {
"type": "text"
},
"refreshInterval": {
"properties": {
"display": {
"type": "keyword"
},
"pause": {
"type": "boolean"
},
"section": {
"type": "integer"
},
"value": {
"type": "integer"
}
}
},
"timeFrom": {
"type": "keyword"
},
"timeRestore": {
"type": "boolean"
},
"timeTo": {
"type": "keyword"
},
"title": {
"type": "text"
},
"uiStateJSON": {
"type": "text"
},
"version": {
"type": "integer"
}
}
},
"url": {
"properties": {
"accessCount": {
"type": "long"
},
"accessDate": {
"type": "date"
},
"createDate": {
"type": "date"
},
"url": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 2048
}
}
}
}
},
"server": {
"properties": {
"uuid": {
"type": "keyword"
}
}
},
"timelion-sheet": {
"properties": {
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"timelion_chart_height": {
"type": "integer"
},
"timelion_columns": {
"type": "integer"
},
"timelion_interval": {
"type": "keyword"
},
"timelion_other_interval": {
"type": "keyword"
},
"timelion_rows": {
"type": "integer"
},
"timelion_sheet": {
"type": "text"
},
"title": {
"type": "text"
},
"version": {
"type": "integer"
}
}
},
"graph-workspace": {
"properties": {
"description": {
"type": "text"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"numLinks": {
"type": "integer"
},
"numVertices": {
"type": "integer"
},
"title": {
"type": "text"
},
"version": {
"type": "integer"
},
"wsState": {
"type": "text"
}
}
}
}
}
}
}'
③将index由.kibana重定向到.kibana-6（reindex.sh）
curl -XPOST '10.0.9.24:9200/_reindex?pretty' -H 'Content-Type: application/json' -d'
{
"source": {
"index": ".kibana"
},
"dest": {
"index": ".kibana-6"
},
"script": {
"inline": "ctx._source = [ ctx._type : ctx._source ]; ctx._source.type = ctx._type; ctx._id = ctx._type + \":\" + ctx._id; ctx._type = \"doc\"; ",
"lang": "painless"
}
}'
④将.kibana-6这个index同义为.kibana，并删除旧的index，即.kibana（rename.sh）
curl -XPOST '10.0.9.24:9200/_aliases?pretty' -H 'Content-Type: application/json' -d'
{
"actions" : [
{ "add": { "index": ".kibana-6", "alias": ".kibana" } },
{ "remove_index": { "index": ".kibana" } }
]
}'
4 . 迁移数据目录data到新版的目录里
cp -r /elk/kibana-5.6.1-linux-x86_64/data/* /elk/kibana-6.6.0-linux-x86_64/data
5 . 安装新版sentinl告警插件
①mv sentinl-v6.6.0.zip /elk/kibana-6.6.0-linux-x86_64/plugins
②cd /elk/kibana-6.6.0-linux-x86_64/plugins
③unzip sentinl-v6.6.0.zip
④mv kibana/sentinl .
⑤rm -rf kibana
6 . 关闭旧进程，启动新服务
①ps -ef|grep node
②kill -9 pid
③cd /elk/kibana-6.6.0-linux-x86_64/
④./bin/kibana &
三、Logstash升级
1 . 解压和复制
①tar xvf logstash-6.6.0.tar.gz
②mv logstash-6.6.0 /elk
2 . 配置文件复制
①cd /elk/logstash-6.6.0
②cp /elk/logstash-5.6.1/wls.conf /elk/logstash-6.6.0 #复制配置文件
③cp /elk/logstash-5.6.1/startlogstash /elk/logstash-6.6.0 #复制启动脚本
④cp /elk/logstash-5.6.1/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-4.1.2/patterns/wls
/elk/logstash-6.6.0/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/ #复制自定义正则文件
3 . 配置文件修改
①vim wls.conf #检查正则中是否有多余的空格和回车
②vim startlogstash #修改第一行代码WorkDir=/elk/logstash-6.6.0
③vim conf/logstash.yml
http.host: "10.0.8.50" xpack.monitoring.enabled: true xpack.monitoring.elasticsearch.url: "http://10.0.9.24:9200" xpack.monitoring.elasticsearch.username: "elastic" xpack.monitoring.elasticsearch.password: "changeme"
④vim conf/jvm..options
-Xms3g -Xmx3g
4 . 关闭旧进程，启动新服务
①ps -ef|grep logstash
②kill -9 pid
③cd /elk/logstash-6.6.0
④./startlogstash start