# EFK平台核心优势
技术优势:
  实时性: 近实时数据处理和分析
  可扩展: 水平扩展支持海量数据
  灵活性: 支持多种数据源和格式
  开源: 完全开源，社区活跃
  生态: 丰富的插件和集成方案

业务价值:
  运维监控: 实时系统状态监控
  故障排查: 快速定位和分析问题
  安全审计: 安全事件追踪和分析
  业务分析: 用户行为和业务指标分析
  合规性: 日志审计和合规报告

# 存储分层策略
热数据层 (Hot Tier):
  - 存储时间: 0-7天
  - 存储介质: NVMe SSD
  - 索引配置: 高性能写入和查询
  - 副本数量: 1个副本

温数据层 (Warm Tier):
  - 存储时间: 7-30天
  - 存储介质: SATA SSD
  - 索引配置: 只读，优化压缩
  - 副本数量: 1个副本

冷数据层 (Cold Tier):
  - 存储时间: 30天-1年
  - 存储介质: HDD或对象存储
  - 索引配置: 高压缩比，低查询频率
  - 副本数量: 0个副本

归档层 (Archive Tier):
  - 存储时间: 1年以上
  - 存储介质: 对象存储(S3/OSS)
  - 索引配置: 极度压缩，很少查询
  - 备份策略: 定期快照备份

# 操作系统参数优化
# /etc/sysctl.conf
vm.max_map_count=262144
vm.swappiness=1
net.core.somaxconn=65535
net.ipv4.tcp_max_syn_backlog=65535
fs.file-max=655360

# 应用参数
sysctl -p

# 用户限制配置
# /etc/security/limits.conf
elasticsearch soft nofile 65536
elasticsearch hard nofile 65536
elasticsearch soft nproc 4096
elasticsearch hard nproc 4096
elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited

# JVM堆内存设置原则
# 堆内存不超过系统内存的50%
# 堆内存不超过32GB (压缩指针限制)
# 例: 64GB内存的服务器，ES堆设置为30GB

# 安装OpenJDK 11或17
sudo apt update
sudo apt install openjdk-11-jdk

# 验证Java版本
java -version

# 设置JAVA_HOME环境变量
echo 'export JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64' >> ~/.bashrc
echo 'export PATH=$JAVA_HOME/bin:$PATH' >> ~/.bashrc
source ~/.bashrc

# 导入Elasticsearch GPG密钥
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

# 添加Elasticsearch仓库
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-7.x.list

# 安装Elasticsearch
sudo apt update
sudo apt install elasticsearch

# 启用开机自启
sudo systemctl enable elasticsearch

# 创建数据和日志目录
sudo mkdir -p /var/lib/elasticsearch
sudo mkdir -p /var/log/elasticsearch
sudo chown -R elasticsearch:elasticsearch /var/lib/elasticsearch
sudo chown -R elasticsearch:elasticsearch /var/log/elasticsearch

# /etc/elasticsearch/jvm.options
# 堆内存设置 (根据服务器内存调整)
-Xms30g
-Xmx30g

# 垃圾回收器选择
-XX:+UseG1GC
-XX:G1HeapRegionSize=32m
-XX:+UnlockExperimentalVMOptions
-XX:+UseG1GC
-XX:MaxGCPauseMillis=200

# 内存优化
-XX:+AlwaysPreTouch
-Xss1m
-Djava.awt.headless=true

# 文件描述符
-Dfile.encoding=UTF-8
-Djna.nosys=true

# GC日志
-Xlog:gc*,gc+age=trace,safepoint:gc.log:time,level,tags
-XX:+UseGCLogFileRotation
-XX:NumberOfGCLogFiles=32
-XX:GCLogFileSize=64m

# 临时目录
-Djava.io.tmpdir=${ES_TMPDIR}

# JVM崩溃时生成转储文件
-XX:+HeapDumpOnOutOfMemoryError
-XX:HeapDumpPath=/var/lib/elasticsearch
-XX:ErrorFile=/var/log/elasticsearch/hs_err_pid%p.log

# 方式1: 使用官方仓库安装
curl -fsSL https://toolbelt.treasuredata.com/sh/install-ubuntu-bionic-td-agent4.sh | sh

# 方式2: 使用Ruby Gem安装
gem install fluentd

# 方式3: 使用Docker容器部署
docker run -d \
  --name fluentd \
  -p 24224:24224 \
  -p 24224:24224/udp \
  -v /var/log:/var/log \
  -v $(pwd)/fluent.conf:/fluentd/etc/fluent.conf \
  fluent/fluentd:v1.16-debian-1

# 启用服务
sudo systemctl enable td-agent
sudo systemctl start td-agent

# 安装Elasticsearch输出插件
sudo td-agent-gem install fluent-plugin-elasticsearch

# 安装Kafka插件
sudo td-agent-gem install fluent-plugin-kafka

# 安装系统监控插件
sudo td-agent-gem install fluent-plugin-systemd

# 安装解析插件
sudo td-agent-gem install fluent-plugin-parser

# 安装缓冲插件
sudo td-agent-gem install fluent-plugin-redis

# 验证插件安装
sudo td-agent-gem list | grep fluent-plugin

# 安装Kibana
sudo apt install kibana

# 启用服务
sudo systemctl enable kibana

# 安装ElastAlert
pip install elastalert

# 创建配置目录
sudo mkdir -p /etc/elastalert
sudo mkdir -p /var/log/elastalert

# 初始化索引
elastalert-create-index

#!/bin/bash
# /usr/local/bin/es_cluster_check.sh

ES_HOST="https://10.1.0.20:9200"
ES_USER="elastic"
ES_PASS="changeme"

# 获取集群健康状态
CLUSTER_HEALTH=$(curl -s -u "$ES_USER:$ES_PASS" "$ES_HOST/_cluster/health")
CLUSTER_STATUS=$(echo "$CLUSTER_HEALTH" | jq -r '.status')

# 获取节点信息
NODES_INFO=$(curl -s -u "$ES_USER:$ES_PASS" "$ES_HOST/_nodes/stats")
TOTAL_NODES=$(echo "$NODES_INFO" | jq '.nodes | length')

# 获取索引统计
INDICES_STATS=$(curl -s -u "$ES_USER:$ES_PASS" "$ES_HOST/_cat/indices?v&h=index,health,status,pri,rep,docs.count,store.size&format=json")

# 发送到监控系统
cat << EOF | curl -X POST "http://monitoring.company.com/api/metrics" \
     -H "Content-Type: application/json" \
     -d @-
{
  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "source": "elasticsearch",
  "cluster": {
    "status": "$CLUSTER_STATUS",
    "nodes": $TOTAL_NODES,
    "indices": $(echo "$INDICES_STATS" | jq length)
  },
  "health": $CLUSTER_HEALTH,
  "nodes": $NODES_INFO,
  "indices": $INDICES_STATS
}
EOF

# 健康检查告警
if [ "$CLUSTER_STATUS" != "green" ]; then
    echo "WARNING: Elasticsearch cluster status is $CLUSTER_STATUS" | \
    mail -s "Elasticsearch Cluster Alert" ops-team@company.com
fi

# 检查集群状态
curl -X GET "localhost:9200/_cluster/health?pretty"

# 检查节点状态
curl -X GET "localhost:9200/_nodes/stats?pretty"

# 检查索引状态
curl -X GET "localhost:9200/_cat/indices?v&health=red"

# 检查未分配分片
curl -X GET "localhost:9200/_cluster/allocation/explain?pretty"

# 修复红色索引
curl -X POST "localhost:9200/red-index/_close"
curl -X POST "localhost:9200/red-index/_open"

# 手动分配分片
curl -X POST "localhost:9200/_cluster/reroute" \
-H "Content-Type: application/json" \
-d '{
  "commands": [
    {
      "allocate_primary": {
        "index": "my-index",
        "shard": 0,
        "node": "node-1",
        "accept_data_loss": true
      }
    }
  ]
}'

# 检查Fluentd状态
sudo systemctl status td-agent

# 查看详细日志
sudo tail -f /var/log/td-agent/td-agent.log

# 测试配置语法
sudo td-agent --dry-run -c /etc/td-agent/td-agent.conf

# 检查缓冲区状态
sudo ls -la /var/log/td-agent/buffer/

# 重启服务
sudo systemctl restart td-agent

# 发送测试日志
echo '{"message":"test log","level":"info"}' | \
curl -X POST -d @- http://localhost:8888/test.log

# 检查Kibana状态
sudo systemctl status kibana

# 查看Kibana日志
sudo tail -f /var/log/kibana/kibana.log

# 检查Elasticsearch连接
curl -X GET "http://localhost:5601/api/status"

# 重建索引模式
curl -X DELETE "localhost:5601/api/saved_objects/index-pattern/logs-*"

# 清理缓存
sudo rm -rf /var/lib/kibana/optimize/

# 日志量估算公式
每日日志量 = 日志行数 × 平均行大小 × 压缩比

# 示例计算
日志行数: 1亿行/天
平均行大小: 200字节
压缩比: 3:1
每日原始日志: 100,000,000 × 200 = 20GB
每日压缩日志: 20GB ÷ 3 = 6.7GB

# 存储需求计算
保留天数: 90天
副本数量: 1个
总存储需求: 6.7GB × 90天 × 2(原始+副本) = 1.2TB

# 创建内置用户密码
sudo /usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto

# 创建自定义角色
curl -X POST "https://localhost:9200/_security/role/log_reader" \
-H "Content-Type: application/json" \
-u elastic:password \
-d '{
  "cluster": ["monitor"],
  "indices": [
    {
      "names": ["*-logs-*"],
      "privileges": ["read", "view_index_metadata"]
    }
  ]
}'

# 创建用户
curl -X POST "https://localhost:9200/_security/user/log_analyst" \
-H "Content-Type: application/json" \
-u elastic:password \
-d '{
  "password": "secure_password",
  "roles": ["log_reader"],
  "full_name": "Log Analyst",
  "email": "analyst@company.com"
}'

# 生成CA证书
sudo /usr/share/elasticsearch/bin/elasticsearch-certutil ca

# 生成节点证书
sudo /usr/share/elasticsearch/bin/elasticsearch-certutil cert \
  --ca elastic-stack-ca.p12 \
  --dns elasticsearch-01,elasticsearch-02,elasticsearch-03 \
  --ip 10.1.0.20,10.1.0.21,10.1.0.22,10.1.0.23 \
  --out elastic-certificates.p12

# 复制证书到各节点
sudo cp elastic-certificates.p12 /etc/elasticsearch/
sudo chown elasticsearch:elasticsearch /etc/elasticsearch/elastic-certificates.p12
sudo chmod 660 /etc/elasticsearch/elastic-certificates.p12

# /etc/elasticsearch/jvm.options.d/performance.options

# 垃圾回收优化
-XX:+UseG1GC
-XX:MaxGCPauseMillis=200
-XX:G1HeapRegionSize=32m
-XX:+UnlockExperimentalVMOptions
-XX:G1NewSizePercent=30
-XX:G1MaxNewSizePercent=40

# 内存优化
-XX:+AlwaysPreTouch
-XX:+UseLargePages
-XX:LargePageSizeInBytes=2m

# 编译优化
-XX:+UnlockDiagnosticVMOptions
-XX:+LogVMOutput
-XX:LogFile=/var/log/elasticsearch/gc.log

# 性能监控
-XX:+PrintGCDetails
-XX:+PrintGCTimeStamps
-XX:+PrintGCDateStamps
-XX:+PrintGCApplicationStoppedTime

# 定期清理过期索引
#!/bin/bash
RETENTION_DAYS=90
INDICES_TO_DELETE=$(curl -s "http://localhost:9200/_cat/indices" | \
  awk '{print $3}' | \
  grep -E '^.*-[0-9]{4}\.[0-9]{2}\.[0-9]{2}$' | \
  while read index; do
    index_date=$(echo $index | grep -oE '[0-9]{4}\.[0-9]{2}\.[0-9]{2}$')
    index_timestamp=$(date -d "${index_date//./-}" +%s)
    current_timestamp=$(date +%s)
    days_diff=$(( (current_timestamp - index_timestamp) / 86400 ))
    if [ $days_diff -gt $RETENTION_DAYS ]; then
      echo $index
    fi
  done)

for index in $INDICES_TO_DELETE; do
  echo "Deleting index: $index"
  curl -X DELETE "http://localhost:9200/$index"
done