es备份恢复到另外的新机器(带验证模式)

环境:
OS:Centos 7
原机器架构:3节点组成的集群(带验证模式)
目的集群架构:单节点(带验证模式)
es版本:6.8.5

1.原库创建备份(集群环境)
##创建备份仓库目录

curl -u elastic:elastic -H "Content-Type: application/json" -XPUT http://192.168.1.100:19200/_snapshot/esbackup -d'{
    "type": "fs", 
    "settings": {
        "location": "/home/middle/esbak/backup"
    }
}'

可以使用如下命令查看备份的路径

curl -u elastic:elastic -X GET "http://192.168.1.100:19200/_snapshot/esbackup?pretty"

##执行备份

curl -u elastic:elastic -H "Content-Type: application/json" -XPUT http://192.168.1.100:19200/_snapshot/esbackup/snapshot_20221208

注意集群环境的备份目录需要每个节点都可以有读取写入的权限,一般采用nfs方式实现

2.查看备份情况
可以使用如下命令查看备份情况
curl -u elastic:elastic -X GET "http://192.168.1.100:19200/_snapshot/esbackup/_all?pretty"

3.将es备份目录打包,然后上传到新部署的机器上面
[elasticsearch@localhost single_elasticsearch]$ cd /home/elasticsearch/single_elasticsearch
tar -czvf esbak20221208.tar ./esbak
scp esbak20221208.tar elasticsearch@192.168.1.104:/tmp/

4.新机器安装部署es
安装步骤省略,特别注意如下参数跟原来机器一致,因为我们等会将原来机器的备份文件加压到该目录
path.repo: /home/middle/esbak/backup

5.将原主机备份的文件解压到新机器path.repo参数指定的目录
su - elasticsearch
[elasticsearch@localhost tmp]$ cd /tmp/
[elasticsearch@localhost tmp]$ tar -xvf esbak_20221208.tar.gz
[elasticsearch@localhost esbak]$ cd /tmp/backup
[elasticsearch@localhost esbak]$ cp -r ./* /home/middle/esbak/backup/

6.删除存在安全使用的index并去掉密码验证重启动es
新的机器这个时候是没有index的

[elasticsearch@pg1 backup]$ curl -u elastic:elastic -X GET 'http://192.168.1.104:19200/_cat/indices?v'
health status index       uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   .security-6 _MTw15S4QoWX1nLKTPpi2g   1   0          6            0     19.5kb         19.5kb

因为我们这里使用的是密码验证的,系统会生成.security-6这个索引,我们需要删除该索引才能恢复

[elasticsearch@pg1 backup]$ curl -u elastic:elastic -XDELETE 'http://192.168.1.104:19200/.security-6?pretty'
{
  "acknowledged" : true
}

杀到会话
[elasticsearch@pg1 backup]$ kill 2136

注释掉验证部分
su - elasticsearch
vi /usr/local/services/elasticsearch/config/elasticsearch.yml

##xpack.security.enabled: true
##xpack.security.transport.ssl.enabled: true
##http.cors.enabled: true
##http.cors.allow-origin: "*"
##http.cors.allow-headers: Authorization,X-Requested-With,Content-Length,Content-Type

然后重新启动
[elasticsearch@pg1 config]$ cd /usr/local/services/elasticsearch/bin
[elasticsearch@pg1 bin]$ ./elasticsearch -d

[elasticsearch@pg1 bin]$ curl -X GET 'http://192.168.1.104:19200/_cat/indices?v'
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size

这个时候就可以不使用密码验证了

6.执行恢复
执行恢复步骤
6.1 创建备份指定目录

curl -H "Content-Type: application/json" -XPUT http://192.168.1.104:19200/_snapshot/esbackup -d'{
"type": "fs",
"settings": {
"location": "/home/middle/esbak/backup"
}
}'

6.2 查看备份信息,这个时候备份信息已经注册进来了

[elasticsearch@pg1 backup]$ curl -X GET "http://192.168.1.104:19200/_snapshot/esbackup/_all?pretty"
{
  "snapshots" : [
    {
      "snapshot" : "snapshot_20221208",
      "uuid" : "M7VkzUwNTu6nhOVJvu_9Dw",
      "version_id" : 6080599,
      "version" : "6.8.5",
      "indices" : [
        ".security-6",
        "hospital_info"
      ],
      "include_global_state" : true,
      "state" : "SUCCESS",
      "start_time" : "2022-12-07T17:00:02.869Z",
      "start_time_in_millis" : 1670432402869,
      "end_time" : "2022-12-07T17:00:04.887Z",
      "end_time_in_millis" : 1670432404887,
      "duration_in_millis" : 2018,
      "failures" : [ ],
      "shards" : {
        "total" : 6,
        "failed" : 0,
        "successful" : 6
      }
    }
  ]
}

6.3 执行恢复
[elasticsearch@pg1 bin]$ curl -XPOST http://192.168.1.104:19200/_snapshot/esbackup/snapshot_20221208/_restore
{"accepted":true}

7.验证

[elasticsearch@pg1 bin]$ curl -X GET 'http://192.168.1.104:19200/_cat/indices?v'
health status index         uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   .security-6   vjUKyjj2T2eW4ZZGsdW-4Q   1   0          6            0     19.6kb         19.6kb
yellow open   t_info Fnrd9wPISpe_dYdNCyPSEw   5   1      93325        11389     63.9mb         63.9mb

可以看到索引已经恢复了

8.重新启用验证
停掉es
[elasticsearch@pg1 bin]$ kill 2638
修改参数启用密码验证
vi /usr/local/services/elasticsearch/config/elasticsearch.yml

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
http.cors.enabled: true
http.cors.allow-origin: "*"
http.cors.allow-headers: Authorization,X-Requested-With,Content-Length,Content-Type

重新启动
[elasticsearch@pg1 config]$ cd /usr/local/services/elasticsearch/bin
[elasticsearch@pg1 bin]$ ./elasticsearch -d

这个时候需要账号密码登录了
curl -u elastic:旧密码 -X GET 'http://192.168.1.104:19200/_cat/indices?v'

这里的密码是旧集群的密码

9.验证数据

[elasticsearch@pg1 bin]$ curl -u elastic:旧密码 -H "Content-Type: application/json" -XGET 'http://192.168.1.104:19200/_cat/count/t_info?v&format=json&pretty'
[
  {
    "epoch" : "1670467327",
    "timestamp" : "02:42:07",
    "count" : "93325"
  }
]

##################################恢复具体的某个索引##################################

1.恢复索引t_info

curl -u elastic:elastic -X POST "http://192.168.1.104:19200/_snapshot/esbackup/snapshot_20221208/_restore?pretty" -H 'Content-Type: application/json' -d'
{
  "indices": "t_info"
}
'

2.恢复的时候改名

curl -u elastic:elastic -X POST "http://192.168.1.104:19200/_snapshot/esbackup/snapshot_20221208/_restore?pretty" -H 'Content-Type: application/json' -d'
{
  "indices": "t_info",
  "rename_pattern": "t_info",
  "rename_replacement": "t_info01"
}
'

原来名称t_info修改为t_info01

参考连接
https://www.elastic.co/guide/en/elasticsearch/reference/6.8/modules-snapshots.html

-- The End --