graylog自动化数据备份脚本

说明

---

为了方便备份、恢复数据，写了es_backup.sh、es_restore.sh两个脚本。

es_backup.sh脚本中涉及到的变量backFilePath（存放备份数据的压缩包目录）需要在使用此脚本之前创建好（脚本中的目录只是范例，可以根据需求更改），storeName（es仓库名称）、storePath（es仓库路径）更改为你的仓库名、仓库路径。
此备份脚本以snapshot_年月日时命名快照，如：snapshot_2018032617，表示2018年03月26日17时创建的此快照。
es_backup.sh

#!/bin/bash
#elasticsearch index backup
dateTime=`date +%Y%m%d%H`
snapshotName="snapshot_${dateTime}"
backFilePath="/home/monitorManager/elasticsearchBackupData/back"
backesFile=es$dateTime.tar.gz
storeName="backup_1"
storePath="/backup"
echo $snapshotName

if [[ $# == 2 ]];then
    case $1 in
        allIndex)
            mkdir $backFilePath/es_dump
            curl -XDELETE $2/_snapshot/$storeName/$snapshotName?pretty
            curl -XPUT "$2/_snapshot/$storeName/$snapshotName?pretty&wait_for_completion=true"
            echo 'Copying files......'
            cp -rf $storePath/* $backFilePath/es_dump
            cd $backFilePath
            tar czf $backesFile es_dump/
            rm -rf $backFilePath/es_dump/
            echo "success"
        ;;
    *)
        echo "Usage:$0 allIndex esHost:esPort"
    ;;
    esac
elif [[ $# == 3 ]];then
    case $1 in
        specialIndex)
            mkdir $backFilePath/es_dump
            curl -XDELETE $2/_snapshot/$storeName/$snapshotName?pretty
            index=$3
            jsonIndex="{\"indices\":\"${index}\"}"
            curl -XPUT "$2/_snapshot/$storeName/$snapshotName?pretty&wait_for_completion=true" -d ${jsonIndex}
            echo 'Copying files......'
            cp -rf $storePath/* $backFilePath/es_dump
            cd $backFilePath
            tar czf $backesFile es_dump/
            rm -rf $backFilePath/es_dump/
            echo "success"
        ;;
    *)
        echo "Usage:$0 specialIndex esHost:esPort yourIndexName1,yourIndexName2"
    ;;
    esac
fi

es_restore.sh脚本中esNewHost（es迁移目的集群主机）、esNewPort（es迁移目的集群端口）、esNewStorePath（es迁移目的集群仓库目录）、esOldBackPath（源集群仓库目录），需要提前被创建，可根据需求修改。
es_restore.sh

#!/bin/bash
#elasticsearch index restore
dateTime=$2
snapshotName="snapshot_${dateTime}"
backesFile=es$dateTime.tar.gz
storeName="backup_1"
esNewHost="localhost"
esNewPort=9200
esNewStorePath="/home/monitorManager/test"
esOldBackPath="/home/monitorManager/elasticsearchBackupData/back"

if [[ $# == 2 ]];then
    case $1 in
        restoreAll)
            cd $esOldBackPath
            tar -zxvf $backesFile
            rm -rf $esNewStorePath/*
            cp -rf $esOldBackPath/es_dump/* $esNewStorePath
            curl -XPOST "$esNewHost:$esNewPort/_snapshot/$storeName/$snapshotName/_restore?pretty&wait_for_completion=true"
            rm -rf $esOldBackPath/es_dump/ 
            echo "restore success"
        ;;
    *)
        echo "Usage:$0 restoreAll {dateTime}"
    ;;
    esac
elif [[ $# == 3 ]];then
    case $1 in
        restoreSpecial)
            index=$3
            cd $esOldBackPath
            tar -zxvf $backesFile
            rm -rf $esNewStorePath/*
            cp -rf $esOldBackPath/es_dump/* $esNewStorePath
            echo "closing index......"
            curl -XPOST $esNewHost:$esNewPort/$index/_close
            jsonIndex="{\"indices\":\"${index}\"}"
            echo $jsonIndex
            curl -XPOST "$esNewHost:$esNewPort/_snapshot/$storeName/$snapshotName/_restore?pretty&wait_for_completion=true" -d ${jsonIndex}
            rm -rf $esOldBackPath/es_dump/ 
            echo "opening index......"
            curl -XPOST $esNewHost:$esNewPort/$index/_open
            echo "restore success"
        ;;
    *)
        echo "Usage:$0 restoreSpecial {dateTime} {yourIndexName1,yourIndexName2}"
    ;;
    esac
fi

使用说明

---

将两个脚本上传服务器，添加执行权限：

$ sudo chmod +x es_backup.sh
$ sudo chmod +x es_restore.sh

备份

# 备份所有索引
$ ./es_backup.sh allIndex {esHost:esPort} 
# 备份指定索引
$ ./es_backup.sh specialIndex {esHost:esPort} {indexName1,indexName2}

恢复
恢复快照中所有索引：
恢复快照中的所有索引时，需要提前关闭快照中包含的索引。然后执行如下命令。

$ ./es_restore.sh restoreAll {dateTime}

恢复快照中指定索引：

$ ./es_restore.sh restoreAll {dateTime} {yourIndexName1,yourIndexName2}

说明：{}中的内容需要被替换。