ELK By Karchick Dkk

ELK: Elasticsearch Commands for DevOps Engineers

Elasticsearch query examples for beginners

Getting Started with Elasticsearch Basics

What Is Elasticsearch Anyway?

Elasticsearch is like Google for your data! It’s an open-source search and analytics engine that makes it super easy to search, analyze, and visualize tons of data. Whether you’re troubleshooting server logs or powering search in your app, Elasticsearch has you covered.

If you’re not a member of Medium, Please check here

Elasticsearch is fast because it stores data as JSON documents and uses Lucene under the hood for indexing. Think of it as a library catalog but 10,000x faster!

Are you diving into the ELK Stack and feeling overwhelmed by all those Elasticsearch commands? Don’t worry; we’re breaking it down in this guide to make you feel like an Elasticsearch pro! Grab a coffee, and let’s talk about the most-used commands, why they matter, and how you can use them in real-world DevOps scenarios.

Elasticsearch Basic Queries:

1. Cluster Health and Information

Check cluster health

curl -X GET 'http://localhost:9200/_cluster/health?pretty'

• Output: Cluster status (green, yellow, red), number of nodes, active shards, etc.

View cluster stats

curl -X GET 'http://localhost:9200/_cluster/stats?pretty'

• Provides detailed stats about nodes, indices, and memory usage.

List all nodes

curl -X GET 'http://localhost:9200/_cat/nodes?v'

• Example Output: Node name, IP, heap usage, CPU load, etc.

2. Index Management

List all indices

curl -X GET 'http://localhost:9200/_cat/indices?v'

• Output: Status, number of documents, disk size, etc.

Index document count

curl -X GET 'http://localhost:9200/my-index/_count'

• Replace my-index with your index name.

Refresh an index

curl -X POST 'http://localhost:9200/my-index/_refresh'

• Ensures the latest data is available for searching.

Delete an index

curl -X DELETE 'http://localhost:9200/my-index'

• Caution: This is irreversible!

3. Search and Query Debugging

Search for documents

curl -X GET 'http://localhost:9200/my-index/_search?q=field:value&pretty'

• Replace field:value with the field and value you want to search for.

Debug slow queries

Enable slow query logging in elasticsearch.yml:

index.search.slowlog.threshold.query.warn: 2s
index.search.slowlog.threshold.fetch.warn: 1s

Logs will appear in the logs/ directory.

4. Node and Memory Monitoring

Check memory usage

curl -X GET 'http://localhost:9200/_nodes/stats/jvm?pretty'

• Shows JVM heap usage for all nodes.

View thread pool stats

curl -X GET 'http://localhost:9200/_cat/thread_pool?v'

• Useful to debug thread pool exhaustion.

Disk space usage

curl -X GET 'http://localhost:9200/_cat/allocation?v'

• Checks how disk space is allocated across nodes.

5. Shards and Replicas

View shard allocation

curl -X GET 'http://localhost:9200/_cat/shards?v'

• Check if shards are evenly distributed and active.

Relocate shards (example)

curl -X POST 'http://localhost:9200/_cluster/reroute' -H 'Content-Type: application/json' -d '
{
  "commands": [
    {
      "move": {
        "index": "my-index",
        "shard": 0,
        "from_node": "node1",
        "to_node": "node2"
      }
    }
  ]
}'

Adjust the number of replicas

curl -X PUT 'http://localhost:9200/my-index/_settings' -H 'Content-Type: application/json' -d '
{
  "index": {
    "number_of_replicas": 2
  }
}'

6. Snapshots and Backups

Create a snapshot

curl -X PUT 'http://localhost:9200/_snapshot/my_backup/snapshot_1?wait_for_completion=true' -H 'Content-Type: application/json' -d '
{
  "indices": "my-index",
  "ignore_unavailable": true,
  "include_global_state": false
}'

• Replace my_backup and snapshot_1 with your repository and snapshot names.

Restore a snapshot

curl -X POST 'http://localhost:9200/_snapshot/my_backup/snapshot_1/_restore' -H 'Content-Type: application/json' -d '
{
  "indices": "my-index",
  "ignore_unavailable": true
}'

7. Logs and Monitoring

Tail Elasticsearch logs

tail -f /var/log/elasticsearch/elasticsearch.log

• Monitor live logs for errors or warnings.

Check specific logs

grep "ERROR" /var/log/elasticsearch/elasticsearch.log

• Look for error patterns in logs.

8. API Key Management

Generate API key

curl -X POST 'http://localhost:9200/_security/api_key' -H 'Content-Type: application/json' -d '
{
  "name": "my-api-key",
  "role_descriptors": {
    "my-role": {
      "cluster": ["monitor"],
      "index": [
        {
          "names": ["my-index"],
          "privileges": ["read"]
        }
      ]
    }
  }
}'

• Returns an API key and ID.

List all API keys

curl -X GET 'http://localhost:9200/_security/api_key'

Best Practices for DevOps Engineers Using Elasticsearch

1. Sharding and Replicas:

• Always configure shards and replicas to balance performance and fault tolerance.

Pro Tip: Use 5 shards for large datasets and adjust replicas based on how critical your data is.

2. Monitor Your Cluster:

• Use tools like Kibana or Grafana to visualize cluster health and performance.

3. Index Lifecycle Management (ILM):

• Automate the deletion or migration of old logs to save storage space.

Fun Fact: ILM can save you $$$ by reducing costs on cloud storage!

4. Not Monitoring Resource Usage:

• Elasticsearch can be resource-hungry. Monitor your cluster’s CPU, RAM, and disk usage to avoid performance bottlenecks.

5. Ignoring Index Mappings:

• Always define mappings to avoid data type mismatches.
• Example: Use date fields for timestamps to enable powerful time-based queries.

6. Over-Sharding:

• Too many shards can hurt performance. Start small and scale up as needed.

Tips for Production Debugging

1. Monitor Logs Regularly:

• Use tools like Filebeat and Kibana for centralized log management.

2. Enable Monitoring:

• Set up Elastic APM or Prometheus exporters for Elasticsearch.

3. Automate Health Checks:

• Use tools like Zabbix or custom scripts to call health APIs periodically.

4. Snapshot Your Data:

• Automate regular snapshots for disaster recovery.

By mastering these commands, you’ll have a solid toolkit for managing Elasticsearch in production. Let me know if you’d like to dive deeper into any specific area!

Call to Action:

If you enjoyed this guide, share it with your friends and colleagues! Do you have a favorite Elasticsearch command or a troubleshooting tip? Drop it in the comments below — I’d love to hear from you!

Next blog we will discuss Elasticsearch ILM and SLM policy.

DevSecOps — Community 🚀

Thank you for being a part of the DevSecOps — Community community! Before you go:

• Be sure to clap and follow ️ Karthick Dkk 👏️️
• Follow: | LinkedIn | Newsletter | LinkedIn Groups | GitHub
• More content at DevSecOps — Community