elasticsearch 備份與恢復詳細步驟（包含kibana操作界面）

本文配合kibana操作，可以更清晰的認識到過程
1.創建快照存儲庫

快照存儲庫的作用是創建一個目錄專門用來分門別類的存放各種備份（快照），以作為后期恢復。
1.修改es配置文件，以便支持快照存儲庫
# vim /etc/elasticsearch/elasticsearch.yml
path.repo: ["/data/backup/elasticsearch"]

2.創建一個網絡共享目錄
	如果是es集群，一定要創建一個共享目錄，並對快照存儲庫進行掛載（如3台集群，3台的共享目錄是進行共享的）
	創建nfs目錄  ##略
2.重啟es
	略
3.創建本地存儲庫
	 curl -XPUT -uuser:password  http://127.0.0.1:9200/_snapshot/bakup -H "Content-Type: application/json"  -d '
      {
          "type": "fs",
          "settings": {
              "location": "/data/backup/elasticsearch/",   #存儲庫位置，要和配置文件里一致
			  "max_restore_bytes_per_sec":"10mb",          #恢復最大速率
			  "compress":"true",                           #是否壓縮
			  "max_snapshot_bytes_per_sec":"10mb",         #創建最大速率
			  "chunk_size":"10mb"                          #壓縮塊大小
          }
      } '
      
 4.查看是否創建成功
$ curl -XGET -uuser:password  http://127.0.0.1:9200/_snapshot/

$ {"backup":{"type":"fs","settings":{"chunk_size":"10mb","location":"/data/backup/elasticsearch/","max_restore_bytes_per_sec":"10mb","compress":"true","max_snapshot_bytes_per_sec":"10mb"}}}

# 基於此，名為backup的快照存儲庫創建完成，可以基於索引或者全部進行備份操作

2.備份索引

1.備份指定的索引
curl -XPUT -uuser:password  http://127.0.0.1:9200/_snapshot/backup/bak2020-5?wait_for_completion=true -H "Content-Type: application/json"  -d '
   {
    
 "indices": "index1,index2,index3,index4"   #需要備份幾個索引就寫幾個	
   }'
2.備份當前庫所有索引
curl -XPUT -uuser:password  http://127.0.0.1:9200/_snapshot/backup/bak2020-5?wait_for_completion=true -H "Content-Type: application/json"

3.查看是否備份成功
	（1）返回結果
	{"snapshot":{"snapshot":"bak2020-5","uuid":"h4B0WAbzTPmTpRFaOfsFgA","version_id":7050099,"version":"7.5.0","indices":["cld-2020.04.09","uchp-2020.03.31","crlpub-2020.03.01","crlpub-2020.02.29"],"include_global_state":true,"state":"SUCCESS","start_time":"2020-05-19T02:25:34.925Z","start_time_in_millis":1589855134925,"end_time":"2020-05-19T02:26:39.891Z","end_time_in_millis":1589855199891,"duration_in_millis":64966,"failures":[],"shards":{"total":4,"failed":0,"successful":4}}}
	（2） 命令查看
	curl -XGET -uelastic:111111  http://127.0.0.1:9200/_snapshot/backup/bak2020-5
{"snapshots":[{"snapshot":"bak2020-5","uuid":"h4B0WAbzTPmTpRFaOfsFgA","version_id":7050099,"version":"7.5.0","indices":["cld-2020.04.09","uchp-2020.03.31","crlpub-2020.03.01","crlpub-2020.02.29"],"include_global_state":true,"state":"SUCCESS","start_time":"2020-05-19T02:25:34.925Z","start_time_in_millis":1589855134925,"end_time":"2020-05-19T02:26:39.891Z","end_time_in_millis":1589855199891,"duration_in_millis":64966,"failures":[],"shards":{"total":4,"failed":0,"successful":4}}]}

3.對數據庫進行恢復

1.實驗環境下，我們把備份的索引刪除，來測試是否可以恢復成功
略
2.恢復數據
	（1）.恢復單個索引
	curl -XPOST -uuser:password  http://127.0.0.1:9200/_snapshot/backup/bak2020-5/_restore -H "Content-Type: application/json" -d '
   {    
 "indices": "index1"	
   }'
    (2).直接恢復所有
    curl -XPOST -uuser:password  http://127.0.0.1:9200/_snapshot/backup/bak2020-5/_restore -H "Content-Type: application/json"

4.刪除不用的快照存儲

curl -XDELETE -uuser:password  http://127.0.0.1:9200/_snapshot/backup/bak2020-5/

5.對備份數據打包存儲，並還原到新的es集群中

tar zcf es-bak2020-5.tar.gz elasticsearch/*   #對庫下面的所有文件進行存儲

#將壓縮備份文件放入新集群的快照存儲庫下
tar xf es-bak2020-5.tar.gz -C /data/backup/elasticsearch

重新創建和備份同名的snopshot
curl -XPUT -uuser:password  http://127.0.0.1:9200/_snapshot/backup -H "Content-Type: application/json"  -d '
      {
          "type": "fs",
          "settings": {
          "location": "/data/backup/elasticsearch/",
          "max_restore_bytes_per_sec":"10mb",
          "compress":"true","max_snapshot_bytes_per_sec":"10mb",
          "chunk_size":"10mb"
          }
      } '
測試是否存在備份的snapshot
# curl -XGET -uuser:password  http://127.0.0.1:9200/_snapshot/backup/bak2020-5

# {"snapshots":[{"snapshot":"bak2020-5","uuid":"D1WdHq2oTtC03a60y2GkmA","version_id":7050099,"version":"7.5.0","indices":["cld-2020.04.09","crlpub-2020.03.01","uchp-2020.03.31","crlpub-2020.02.29"],"include_global_state":true,"state":"SUCCESS","start_time":"2020-05-19T02:53:57.284Z","start_time_in_millis":1589856837284,"end_time":"2020-05-19T02:55:01.842Z","end_time_in_millis":1589856901842,"duration_in_millis":64558,"failures":[],"shards":{"total":4,"failed":0,"successful":4}}]}

#測試為存在，按照第3步進行還原

前面這些都做好后，附上簡單的定時任務小腳本

#!/bin/bash
#備份上個月的es數據
user=$1
password=$2
date_lastmonth=`date -d "-1 month" +%Y.%m`
code_status=`curl -XGET -u$user:$password  http://127.0.0.1:9200/_snapshot/backup -s   -w  "%{http_code}\n" -I -o /dev/null`
create_snap(){

 curl -XPUT -u$user:$password  http://10.100.15.23:9200/_snapshot/backup -H "Content-Type: application/json"  -d '
      {
          "type": "fs",
          "settings": {
              "location": "/data/backup/elasticsearch/",
              "max_restore_bytes_per_sec":"30mb",
              "compress":"true","max_snapshot_bytes_per_sec":"30mb",
              "chunk_size":"10mb"
          }
      } '
echo "創建backup"
}
backup_snap(){
curl -XPUT -u$user:$password  http://10.100.15.23:9200/_snapshot/backup/bak2020-5?wait_for_completion=true -H 'Content-Type: application/json'  -d '
   {
 "indices": "caserver-'$date_lastmonth'"
        
   }'
}
tar_snap(){
cd /data/backup/elasticsearch/ && tar zcf /data/backup/es-${date_lastmonth}.tar.gz ./*

}
if [  ! $code_status -eq 200 ];then
create_snap
fi
backup_snap
tar_snap

恢復索引在kibana里面的操作界面或者通過api命令行（curl）都可以實現，這邊就不寫了