elasticsearch Elasticsearch关闭/打开索引后的磁盘空间问题

我最近需要打开和关闭Elasticsearch索引来添加自定义分析器并创建映射。从那以后，我一直在所有节点上看到磁盘空间问题，我不确定最好的解决方法

以下是从主节点上的日志文件中选择的一些当天的行：

[2016-03-18 01:54:46,161][INFO ][cluster.metadata] [instance name] closing indices [[prod]]
[2016-03-18 01:54:46,161][INFO ][cluster.metadata] [instance name] opening indices [[prod]]
[2016-03-18 01:54:48,493][WARN ][cluster.routing.allocation.decider] [instance name] After allocating, node [nodename] would have less than the required 0b free bytes threshold (-28916726190 bytes free), preventing allocation
[2016-03-18 01:54:48,494][WARN ][cluster.routing.allocation.decider] [instance name] After allocating, node [nodename] would have less than the required 0b free bytes threshold  (-29217364398 bytes free), preventing allocation

。。。每个ES节点的其中一行

然后，对于每个节点，看起来像是其中之一：

[2016-03-18 01:54:49,500][DEBUG][action.search.type] [instance name] All shards failed for phase: [query]
org.elasticsearch.transport.RemoteTransportException: instance name]][indices:data/read/search[phase/query]]
Caused by: org.elasticsearch.index.shard.IllegalIndexShardStateException: [prod][0] CurrentState[RECOVERING] operations only allowed when started/relocated
    at org.elasticsearch.index.shard.IndexShard.readAllowed(IndexShard.java:1000)
    at org.elasticsearch.index.shard.IndexShard.acquireSearcher(IndexShard.java:793)
    at org.elasticsearch.index.shard.IndexShard.acquireSearcher(IndexShard.java:789)
    at org.elasticsearch.search.SearchService.createContext(SearchService.java:552)
    at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:532)
    at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:294)
    at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:776)
    at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:767)
    at org.elasticsearch.transport.netty.MessageChannelHandler$RequestHandler.doRun(MessageChannelHandler.java:279)
    at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:36)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)

然后，一堆更多的第一个区块线，然后：

[2016-03-18 01:56:39,891][INFO ][cluster.metadata] [instance name] [prod] create_mapping [mapping name]

然后是其中两行：

[2016-03-18 02:05:18,993][WARN ][cluster.action.shard] [instance name] [prod][1] received shard failed for [prod][1], node[node name], [R], s[INITIALIZING], indexUUID [index id], reason [shard failure [failed recovery][RecoveryFailedException[[prod][1]: Recovery failed from [instance name]{master=true} into [instance name]{master=false}]; nested: RemoteTransportException[[instance name][internal:index/shard/recovery/start_recovery]]; nested: RecoveryEngineException[[prod][1] Phase[1] Execution failed]; nested: RecoverFilesRecoveryException[[prod][1] Failed to transfer [0] files with total size of [0b]]; nested: IllegalStateException[try to recover [prod][1] from primary shard with sync id but number of docs differ: 217250828 (instance name, primary) vs 217250830(instance name)]; ]]

然后，一堆低磁盘和高磁盘水印错误。自运行打开/关闭命令以来，这些错误一直在发生，因此它们会阻止对新数据进行索引

当我运行/cat/_shards/prod时，我看到：

index shard prirep state             docs  store ip          node                                    
prod  0     p      STARTED      218452373 73.5gb 
prod  0     r      STARTED      218452373 73.5gb 
prod  0     r      UNASSIGNED                                                                        
prod  1     p      STARTED      217445482 73.1gb 
prod  1     r      STARTED      217445482 73.1gb 
prod  1     r      UNASSIGNED                                                                        
prod  2     r      INITIALIZING                  
prod  2     r      INITIALIZING                 
prod  2     p      STARTED      218665090 73.2gb

请注意，碎片2的一个副本碎片在初始化和未分配阶段之间振荡

我真的希望有人能就未来的最佳方式进行咨询，因为这个问题每天都在变得越来越痛苦。我现在能想到的最好方法是备份所有数据，更新索引设置以拥有0个副本（以消除未分配的碎片），然后更新以添加1个副本（因为我感觉可能是恢复过程无意中添加了一个副本）。我不知道如何证实这一理论，我能看到的最多的是我们没有覆盖elasticsearch.yml中的默认设置（默认设置为1个副本），我们的ec2实例大小似乎无法在同一实例上容纳2个碎片。我真的很想知道是否有人知道如何以及为什么打开/关闭和索引会导致磁盘使用量激增。ElasticSearch文档提到关闭索引可能会导致这种情况，但它们没有给出太多其他背景信息

---

如果有帮助，很高兴提供任何其他信息，提前谢谢

检查

prod

索引设置，查看它配置了多少副本：

GET/prod/\u设置

。您可以在

elasticsearch.yml

中看到的是默认配置，但每个索引都可以有自己的主索引和副本配置。也许，在更新分析器命令中，您还更改了复制副本的数量值。这就解释了为什么现在存在磁盘空间问题。你需要2个复制品吗？如果没有，请将其更改为1，您应该可以：

curl-XPUT”http://localhost:9200/prod/_settings“-d'{”索引：{“副本数”：1}}'