🔎 Open source distributed and RESTful search engine.
Go to file
Jake Landis 43dc72f1a5
Fix cluster alert for watcher/monitoring IndexOutOfBoundsExcep… (#47756)
If a cluster sending monitoring data is unhealthy and triggers an
alert, then stops sending data the following exception [1] can occur.

This exception stops the current Watch and the behavior is actually
correct in part due to the exception. Simply fixing the exception
introduces some incorrect behavior. Now that the Watch does not
error in the this case, it will result in an incorrectly "resolved"
alert.  The fix here is two parts a) fix the exception b) fix the
following incorrect behavior.

a) fixing the exception is as easy as checking the size of the
array before accessing it.

b) fixing the following incorrect behavior is a bit more intrusive

- Note - the UI depends on the success/met state for each condition
to determine an "OK" or "FIRING"

In this scenario, where an unhealthy cluster triggers an alert and
then goes silent, it should keep "FIRING" until it hears back that
the cluster is green. To keep the Watch "FIRING" either the index
action or the email action needs to fire. Since the Watch is neither
a "new" alert or a "resolved" alert, we do not want to keep sending
an email (that would be non-passive too). Without completely changing
the logic of how an alert is resolved allowing the index action to
take place would result in the alert being resolved. Since we can
not keep "FIRING" either the email or index action (since we don't
want to resolve the alert nor re-write the logic for alert resolution),
we will introduce a 3rd action. A logging action that WILL fire when
the cluster is unhealthy. Specifically will fire when there is an
unresolved alert and it can not find the cluster state.
This logging action is logged at debug, so it should be noticed much.
This logging action serves as an 'anchor' for the UI to keep the state
in an a "FIRING" status until the alert is resolved.

This presents a possible scenario where a cluster starts firing,
then goes completely silent forever, the Watch will be "FIRING"
forever. This is an edge case that already exists in some scenarios
and requires manual intervention to remove that Watch.

This changes changes to use a template-like method to populate the 
version_created for the default monitoring watches. The version is 
set to 7.5 since that is where this is first introduced.

Fixes #43184
2019-10-09 10:47:21 -05:00
.ci Enable 7.x to run with --parallel 2019-10-09 14:40:47 +03:00
.github Add version command to issue template 2017-07-31 08:55:31 +09:00
benchmarks Enable node roles to be pluggable (#43175) 2019-06-13 15:15:48 -04:00
buildSrc Fix --debug-jvm Gradle Arg (#47773) (#47783) 2019-10-09 13:25:16 +02:00
client [7.x] [ML][Inference] adjusting definition object schema and validation (#47447) (#47673) 2019-10-08 07:11:05 -04:00
dev-tools Deprecate the pidfile setting (#45938) 2019-08-23 21:31:35 -04:00
distribution Convert RunTask to use testclusers, remove ClusterFormationTasks (#47572) 2019-10-08 14:43:29 +03:00
docs [DOCS] Correct split API request format (#47774) 2019-10-09 08:28:41 -04:00
gradle Make All OS tests run on GCP instances (#46924) 2019-10-04 08:46:52 +03:00
libs Upgrade joni from 2.1.6 to 2.1.29 (#47570) 2019-10-04 12:54:49 -05:00
licenses Reorganize license files 2018-04-20 15:33:59 -07:00
modules Convert RunTask to use testclusers, remove ClusterFormationTasks (#47572) 2019-10-08 14:43:29 +03:00
plugins Add explanations to script score queries (#46693) (#47548) 2019-10-03 21:05:05 -07:00
qa Complete testclusters backport (#47623) 2019-10-07 11:43:57 +03:00
rest-api-spec Backport testclusters all (#47565) 2019-10-04 16:12:53 +03:00
server Make loadShardSnapshot Exceptions Consistent (#47728) (#47735) 2019-10-08 21:04:51 +02:00
test [Transform] move root endpoint to _transform with BWC layer (#47127) (#47682) 2019-10-08 08:59:01 +02:00
x-pack Fix cluster alert for watcher/monitoring IndexOutOfBoundsExcep… (#47756) 2019-10-09 10:47:21 -05:00
.dir-locals.el Go back to 140 column limit in .dir-locals.el 2017-04-14 08:50:53 -06:00
.eclipseformat.xml Format Java source files automatically (#46745) 2019-09-30 10:35:47 +03:00
.editorconfig Exit batch files explictly using ERRORLEVEL (#29583) 2019-01-25 16:44:33 +01:00
.gitattributes Add a CHANGELOG file for release notes. (#29450) 2018-04-18 07:42:05 -07:00
.gitignore Make sure the clean task doesn't break test fixtures (#43641) 2019-07-08 17:58:27 +03:00
CONTRIBUTING.md Remove eclipse conditionals (#44075) 2019-10-03 11:55:00 +03:00
LICENSE.txt Clarify mixed license text (#45637) 2019-08-16 13:39:12 -04:00
NOTICE.txt Restore date aggregation performance in UTC case (#38221) (#38700) 2019-02-11 16:30:48 +03:00
README.textile [Docs] Correct README example snippet (#45133) 2019-08-02 16:53:49 +02:00
TESTING.asciidoc Rename system property to change bwc checkout behavior (#45574) 2019-08-16 08:54:04 -07:00
Vagrantfile Convert vagrant tests to per platform projects (#45064) 2019-08-12 16:01:53 -07:00
build.gradle Convert RunTask to use testclusers, remove ClusterFormationTasks (#47572) 2019-10-08 14:43:29 +03:00
gradle.properties Testclusters: improove timeout handling (#43440) 2019-07-01 11:39:53 +03:00
gradlew Upgrade to Gradle 5.6 (#45005) 2019-09-12 16:18:41 +03:00
gradlew.bat Upgrade to Gradle 5.5 (#43788) (#43832) 2019-07-01 11:54:58 -07:00
settings.gradle Remove eclipse conditionals (#44075) 2019-10-03 11:55:00 +03:00

README.textile

h1. Elasticsearch

h2. A Distributed RESTful Search Engine

h3. "https://www.elastic.co/products/elasticsearch":https://www.elastic.co/products/elasticsearch

Elasticsearch is a distributed RESTful search engine built for the cloud. Features include:

* Distributed and Highly Available Search Engine.
** Each index is fully sharded with a configurable number of shards.
** Each shard can have one or more replicas.
** Read / Search operations performed on any of the replica shards.
* Multi Tenant.
** Support for more than one index.
** Index level configuration (number of shards, index storage, ...).
* Various set of APIs
** HTTP RESTful API
** Native Java API.
** All APIs perform automatic node operation rerouting.
* Document oriented
** No need for upfront schema definition.
** Schema can be defined for customization of the indexing process.
* Reliable, Asynchronous Write Behind for long term persistency.
* (Near) Real Time Search.
* Built on top of Lucene
** Each shard is a fully functional Lucene index
** All the power of Lucene easily exposed through simple configuration / plugins.
* Per operation consistency
** Single document level operations are atomic, consistent, isolated and durable.

h2. Getting Started

First of all, DON'T PANIC. It will take 5 minutes to get the gist of what Elasticsearch is all about.

h3. Requirements

You need to have a recent version of Java installed. See the "Setup":http://www.elastic.co/guide/en/elasticsearch/reference/current/setup.html#jvm-version page for more information.

h3. Installation

* "Download":https://www.elastic.co/downloads/elasticsearch and unzip the Elasticsearch official distribution.
* Run @bin/elasticsearch@ on unix, or @bin\elasticsearch.bat@ on windows.
* Run @curl -X GET http://localhost:9200/@.
* Start more servers ...

h3. Indexing

Let's try and index some twitter like information. First, let's index some tweets (the @twitter@ index will be created automatically):

<pre>
curl -XPUT 'http://localhost:9200/twitter/_doc/1?pretty' -H 'Content-Type: application/json' -d '
{
    "user": "kimchy",
    "post_date": "2009-11-15T13:12:00",
    "message": "Trying out Elasticsearch, so far so good?"
}'

curl -XPUT 'http://localhost:9200/twitter/_doc/2?pretty' -H 'Content-Type: application/json' -d '
{
    "user": "kimchy",
    "post_date": "2009-11-15T14:12:12",
    "message": "Another tweet, will it be indexed?"
}'

curl -XPUT 'http://localhost:9200/twitter/_doc/3?pretty' -H 'Content-Type: application/json' -d '
{
    "user": "elastic",
    "post_date": "2010-01-15T01:46:38",
    "message": "Building the site, should be kewl"
}'
</pre>

Now, let's see if the information was added by GETting it:

<pre>
curl -XGET 'http://localhost:9200/twitter/_doc/1?pretty=true'
curl -XGET 'http://localhost:9200/twitter/_doc/2?pretty=true'
curl -XGET 'http://localhost:9200/twitter/_doc/3?pretty=true'
</pre>

h3. Searching

Mmm search..., shouldn't it be elastic?
Let's find all the tweets that @kimchy@ posted:

<pre>
curl -XGET 'http://localhost:9200/twitter/_search?q=user:kimchy&pretty=true'
</pre>

We can also use the JSON query language Elasticsearch provides instead of a query string:

<pre>
curl -XGET 'http://localhost:9200/twitter/_search?pretty=true' -H 'Content-Type: application/json' -d '
{
    "query" : {
        "match" : { "user": "kimchy" }
    }
}'
</pre>

Just for kicks, let's get all the documents stored (we should see the tweet from @elastic@ as well):

<pre>
curl -XGET 'http://localhost:9200/twitter/_search?pretty=true' -H 'Content-Type: application/json' -d '
{
    "query" : {
        "match_all" : {}
    }
}'
</pre>

We can also do range search (the @post_date@ was automatically identified as date)

<pre>
curl -XGET 'http://localhost:9200/twitter/_search?pretty=true' -H 'Content-Type: application/json' -d '
{
    "query" : {
        "range" : {
            "post_date" : { "from" : "2009-11-15T13:00:00", "to" : "2009-11-15T14:00:00" }
        }
    }
}'
</pre>

There are many more options to perform search, after all, it's a search product no? All the familiar Lucene queries are available through the JSON query language, or through the query parser.

h3. Multi Tenant - Indices and Types

Man, that twitter index might get big (in this case, index size == valuation). Let's see if we can structure our twitter system a bit differently in order to support such large amounts of data.

Elasticsearch supports multiple indices. In the previous example we used an index called @twitter@ that stored tweets for every user.

Another way to define our simple twitter system is to have a different index per user (note, though that each index has an overhead). Here is the indexing curl's in this case:

<pre>
curl -XPUT 'http://localhost:9200/kimchy/_doc/1?pretty' -H 'Content-Type: application/json' -d '
{
    "user": "kimchy",
    "post_date": "2009-11-15T13:12:00",
    "message": "Trying out Elasticsearch, so far so good?"
}'

curl -XPUT 'http://localhost:9200/kimchy/_doc/2?pretty' -H 'Content-Type: application/json' -d '
{
    "user": "kimchy",
    "post_date": "2009-11-15T14:12:12",
    "message": "Another tweet, will it be indexed?"
}'
</pre>

The above will index information into the @kimchy@ index. Each user will get their own special index.

Complete control on the index level is allowed. As an example, in the above case, we might want to change from the default 1 shards with 1 replica per index, to 2 shards with 1 replica per index (because this user tweets a lot). Here is how this can be done (the configuration can be in yaml as well):

<pre>
curl -XPUT http://localhost:9200/another_user?pretty -H 'Content-Type: application/json' -d '
{
    "settings" : {
        "index.number_of_shards" : 2,
        "index.number_of_replicas" : 1
    }
}'
</pre>

Search (and similar operations) are multi index aware. This means that we can easily search on more than one
index (twitter user), for example:

<pre>
curl -XGET 'http://localhost:9200/kimchy,another_user/_search?pretty=true' -H 'Content-Type: application/json' -d '
{
    "query" : {
        "match_all" : {}
    }
}'
</pre>

Or on all the indices:

<pre>
curl -XGET 'http://localhost:9200/_search?pretty=true' -H 'Content-Type: application/json' -d '
{
    "query" : {
        "match_all" : {}
    }
}'
</pre>

{One liner teaser}: And the cool part about that? You can easily search on multiple twitter users (indices), with different boost levels per user (index), making social search so much simpler (results from my friends rank higher than results from friends of my friends).

h3. Distributed, Highly Available

Let's face it, things will fail....

Elasticsearch is a highly available and distributed search engine. Each index is broken down into shards, and each shard can have one or more replicas. By default, an index is created with 5 shards and 1 replica per shard (5/1). There are many topologies that can be used, including 1/10 (improve search performance), or 20/1 (improve indexing performance, with search executed in a map reduce fashion across shards).

In order to play with the distributed nature of Elasticsearch, simply bring more nodes up and shut down nodes. The system will continue to serve requests (make sure you use the correct http port) with the latest data indexed.

h3. Where to go from here?

We have just covered a very small portion of what Elasticsearch is all about. For more information, please refer to the "elastic.co":http://www.elastic.co/products/elasticsearch website. General questions can be asked on the "Elastic Discourse forum":https://discuss.elastic.co or on IRC on Freenode at "#elasticsearch":https://webchat.freenode.net/#elasticsearch. The Elasticsearch GitHub repository is reserved for bug reports and feature requests only.

h3. Building from Source

Elasticsearch uses "Gradle":https://gradle.org for its build system.

In order to create a distribution, simply run the @./gradlew assemble@ command in the cloned directory.

The distribution for each project will be created under the @build/distributions@ directory in that project.

See the "TESTING":TESTING.asciidoc file for more information about running the Elasticsearch test suite.

h3. Upgrading from older Elasticsearch versions

In order to ensure a smooth upgrade process from earlier versions of Elasticsearch, please see our "upgrade documentation":https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-upgrade.html for more details on the upgrade process.