弹性搜索索引出乎意料地消失了

Question

我有一个单节点el集群。几个小时前我丢了两个指数
这些是我从码头工人那里得到的日志。我不知道那里有多少原木
此处的日志太大：

https://pastebin.com/YiLiQkPC

这是采样日志：

{"log":"{"type": "server", "timestamp": "2020-12-16T05:16:00,561Z", "level": "WARN", "component": "o.e.b.JNANatives", "cluster.name": "docker-cluster", "node.name": "37f65704d9bb", "message": "Unable to lock JVM Memory: error=12, reason=Cannot allocate memory" }n","stream":"stdout","time":"2020-12-16T05:16:00.564490107Z"}
{"log":"{"type": "server", "timestamp": "2020-12-16T05:16:00,564Z", "level": "WARN", "component": "o.e.b.JNANatives", "cluster.name": "docker-cluster", "node.name": "37f65704d9bb", "message": "This can result in part of the JVM being swapped out." }n","stream":"stdout","time":"2020-12-16T05:16:00.565085052Z"}
{"log":"{"type": "server", "timestamp": "2020-12-16T05:16:00,565Z", "level": "WARN", "component": "o.e.b.JNANatives", "cluster.name": "docker-cluster", "node.name": "37f65704d9bb", "message": "Increase RLIMIT_MEMLOCK, soft limit: 65536, hard limit: 65536" }n","stream":"stdout","time":"2020-12-16T05:16:00.565449225Z"}
{"log":"{"type": "server", "timestamp": "2020-12-16T05:16:00,565Z", "level": "WARN", "component": "o.e.b.JNANatives", "cluster.name": "docker-cluster", "node.name": "37f65704d9bb", "message": "These can be adjusted by modifying /etc/security/limits.conf, for example: \n\t# allow user 'elasticsearch' mlockall\n\telasticsearch soft memlock unlimited\n\telasticsearch hard memlock unlimited" }n","stream":"stdout","time":"2020-12-16T05:16:00.565962142Z"}
{"log":"{"type": "server", "timestamp": "2020-12-16T05:16:00,565Z", "level": "WARN", "component": "o.e.b.JNANatives", "cluster.name": "docker-cluster", "node.name": "37f65704d9bb", "message": "If you are logged in interactively, you will have to re-login for the new limits to take effect." }n","stream":"stdout","time":"2020-12-16T05:16:00.56620427Z"}
{"log":"{"type": "server", "timestamp": "2020-12-16T05:16:00,785Z", "level": "INFO", "component": "o.e.n.Node", "cluster.name": "docker-cluster", "node.name": "37f65704d9bb", "message": "version[7.9.3], pid[6], build[default/docker/c4138e51121ef06a6404866cddc601906fe5c868/2020-10-16T10:36:16.141335Z], OS[Linux/4.19.0-12-cloud-amd64/amd64], JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/15/15+36-1562]" }n","stream":"stdout","time":"2020-12-16T05:16:00.787778299Z"}

感谢

Answer 1

下面的日志行清楚地显示了您的索引被删除，您的索引在同一时间被删除了吗？？

{"日志"："类型"："服务器"、"时间戳"："2020-12-16T07:21:34013Z"；，"级别"："INFO"部件"："o.e.c.m.MetadataDeleteIndexService"；，"cluster.name"："docker集群"node.name"："37f65704d9bb"；，"消息"："[研究fb private/4d7NP5IqSNyFNvzMLSn5-A]删除索引"cluster.uuid"："gzpqD1vtTi-6jAasvOm15g"node.id"："5zzXP2kCQ9eDI0U6WY4j9Q"；}\n〃"流"："stdout"时间"："2020-12-16T07:21:14059142Z"}

如果您的已删除索引具有research-fb-private/4d7NP5IqSNyFNvzMLSn5-A名称，如果是，则确认删除索引，您还可以在删除索引期间在相同日志中检查已删除索引的名称。