集群规格:40C\128G\PCIE1.6T * 8台
索引情况:1个索引,每天4T+ , doc:40亿+,shard:8 ,replicas:1, 存放一些nginx日志数据,保留时间大于7天,热数据基本只是查询当天的数据
问题:
1、kibana查询Last 30Min基本都是提示 Error:Visualize: Request Timeout after 30000ms
2、在profile中查询会报Cannot read property 'stack' of undefined,详细question/2313
例:展示展示下qps的趋势图都会报超时
{"size":0,"query":{"bool":{"must":[{"query_string":{"query":"*","analyze_wildcard":true}},{"range":{"@timestamp":{"gte":1504676814189,"lte":1504680414189,"format":"epoch_millis"}}}],"must_not":}},"_source":{"excludes":},"aggs":{"2":{"terms":{"field":"status","size":5,"order":{"_count":"desc"}}}}}
在查询过程中观察服务器的硬件负载 CPU、内存、磁盘都没有到达瓶颈
索引情况:1个索引,每天4T+ , doc:40亿+,shard:8 ,replicas:1, 存放一些nginx日志数据,保留时间大于7天,热数据基本只是查询当天的数据
问题:
1、kibana查询Last 30Min基本都是提示 Error:Visualize: Request Timeout after 30000ms
2、在profile中查询会报Cannot read property 'stack' of undefined,详细question/2313
例:展示展示下qps的趋势图都会报超时
{"size":0,"query":{"bool":{"must":[{"query_string":{"query":"*","analyze_wildcard":true}},{"range":{"@timestamp":{"gte":1504676814189,"lte":1504680414189,"format":"epoch_millis"}}}],"must_not":}},"_source":{"excludes":},"aggs":{"2":{"terms":{"field":"status","size":5,"order":{"_count":"desc"}}}}}
在查询过程中观察服务器的硬件负载 CPU、内存、磁盘都没有到达瓶颈
2 个回复
zhangxing - 一个背不好的锅的运维
赞同来自: novia
查询语法:
GET ngx_log/_search
{
"query": {
"bool": {
"must": [
{
"query_string": {
"analyze_wildcard": true,
"query": "*"
}
},
{
"range": {
"@timestamp": {
"gte": 1504684837941,
"lte": 1504688437941,
"format": "epoch_millis"
}
}
}
],
"must_not": []
}
}
}
返回结果:
{
"statusCode": 504,
"error": "Gateway Timeout",
"message": "Client request timeout"
}
kennywu76 - Wood
赞同来自: