Switching the Log Engine¶

Introduction¶

This document describes how to perform Guance to switch the log engine. It supports 6 different engines: the original open-source Elasticsearch, the original open-source OpenSearch, managed OpenSearch on AWS, managed Elasticsearch on Huawei Cloud, managed Elasticsearch (Log Enhanced Edition) on Alibaba Cloud, and managed Elasticsearch on Alibaba Cloud. This operation is suitable for POC switching to a production log engine.

Prerequisites¶

• Prepare the log engine address, username, and password.
• Confirm that the analysis-ik plugin has been installed successfully.
• Confirm that automatic index creation is disabled.
• Prepare the Guance MySQL address and the df_core database credentials.

Switching Steps¶

Step 1: Stop the kodo-x Service¶

kubectl scale -n forethought-kodo deploy kodo-x --replicas 0

Step 2: Refresh the Configuration¶

Log in to the df_core database.

1. Back up the table:

SQL> create table df_core.main_es_instance_copy select * from df_core.main_es_instance;

1. Query the information:

SQL> select authorization,configJSON,id,host from df_core.main_es_instance;

Structure:

mysql> select id,host,authorization,configJSON from df_core.main_es_instance;
+----+----------------------------------------+------------------------------------------------------------------------+-------------------------+
| id | host                                   | authorization                                                          | configJSON              |
+----+----------------------------------------+------------------------------------------------------------------------+-------------------------+
|  1 | http://testing-ft-elastic.cloudcare.cn | {"admin": {"password": "xxxxx", "username": "elastic"}}                | {"provider": "elastic"} |
+----+----------------------------------------+------------------------------------------------------------------------+-------------------------+
1 rows in set (0.01 sec)

1. Update the configuration:

SQL> update df_core.main_es_instance a set a.authorization='{"admin": {"password": "xxxxx", "username": "elastic"}}',a.configJSON='{"provider": "elastic"}',a.host='http://elasticsearch-client-headless.middleware:9200' where id =1;

Parameter descriptions:

• authorization is the ES username and password.
• configJSON is the ES provider.
  Possible values:
  • elastic (original open-source Elasticsearch)
  • opensearch (original open-source OpenSearch)
  • aws_opensearch (managed OpenSearch on AWS)
  • huawei_opensearch (managed Elasticsearch on Huawei Cloud)
  • aliyun_openstore (managed Elasticsearch Log Enhanced Edition on Alibaba Cloud)
  • aliyun_elasticsearch (managed Elasticsearch on Alibaba Cloud)
• host is the ES address.
• id is the ES instance ID obtained in Step 2.

Step 3: Restart the Service¶

kubectl delete pods --all -n forethought-kodo

Step 4: Initialize the ES Template¶

Log in to the forethought-core inner API container and execute the commands:

$ curl 'http://127.0.0.1:5000/api/v1/inner/es/init' -X 'POST'  -H 'Content-Type: application/json'
$ curl 'http://127.0.0.1:5000/api/v1/inner/es/init_subsequent' -X 'POST'  -H 'Content-Type: application/json'

Step 5: Start kodo-x¶

kubectl scale -n forethought-kodo deploy kodo-x --replicas 3

Step 6: Clear the Redis Cache¶

Log in to the Redis database:

flushall

Step 7: Verification¶

Log in to the Guance console and carefully inspect the infrastructure and log features.

FAQ¶

Query Failed on the Page¶

Prerequisites¶

• Obtain the workspace ID of the workspace that reported the error.
• Access to OpenSearch.

Delete the Erroneous Index¶

curl -XDELETE -u "user:password" http://<OPenSearchHost>:9200/<工作空间ID>*

Do not omit the wildcard *.