Managing Production Operations

# elasticsearch.yml
cluster.name: production-cluster
node.name: es-node-1
network.host: 0.0.0.0
http.port: 9200

# Memory settings (50% of system RAM)
bootstrap.memory_lock: true
indices.memory.index_buffer_size: 25%

{
  "type": "fs",
  "location": "/backups/elasticsearch"
}

PUT /_snapshot/my_backup/snapshot_1
{
  "indices": "index-2024-*",
  "ignore_unavailable": true,
  "include_global_state": false
}

POST /_snapshot/my_backup/snapshot_1/_restore
{
  "indices": "index-2024-*",
  "rename_pattern": "index-(.*)",
  "rename_replacement": "restored-index-$1"
}

sudo systemctl stop elasticsearch
sudo yum update elasticsearch
sudo systemctl start elasticsearch

{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_size": "50gb",
            "max_age": "30d"
          },
          "set_priority": {
            "priority": 100
          }
        }
      },
      "warm": {
        "min_age": "30d",
        "actions": {
          "set_priority": {
            "priority": 50
          },
          "allocate": {
            "number_of_replicas": 1,
            "include": {
              "box_type": "warm"
            }
          }
        }
      },
      "delete": {
        "min_age": "90d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

GET /_cluster/health

{
  "cluster_name": "elasticsearch",
  "status": "green",
  "timed_out": false,
  "number_of_nodes": 3,
  "number_of_data_nodes": 3,
  "active_primary_shards": 10,
  "active_shards": 20,
  "relocating_shards": 0,
  "initializing_shards": 0,
  "unassigned_shards": 0
}

{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "http": {
      "request": {
        "host": "localhost",
        "port": 9200,
        "path": "/_cluster/health"
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.status": {
        "equal": "red"
      }
    }
  },
  "actions": {
    "send_alert": {
      "email": {
        "to": ["admin@example.com"],
        "subject": "Elasticsearch Cluster is Red",
        "text": "Cluster health status is red. Immediate action required."
      }
    }
  }
}

cluster:
  routing:
    allocation:
      enable: all
      awareness:
        attributes: rack_id, zone
      disk:
        threshold_enabled: true
        watermark:
          low: 85%
          high: 90%
          flood_stage: 95%

PUT /_snapshot/my_backup
{
  "type": "fs",
  "settings": {
    "location": "/mnt/backups/elasticsearch",
    "compress": true,
    "max_snapshot_bytes_per_second": "20mb"
  }
}

# elasticsearch.yml
cluster.name: production-cluster
node.name: node-1
discovery.seed_hosts: ["host1:9300", "host2:9300", "host3:9300"]
cluster.initial_master_nodes: ["node-1", "node-2", "node-3"]
gateway.expected_nodes: 3

# Edit elasticsearch.yml
cluster.name: my-cluster
node.name: node-1
bootstrap.memory_lock: true

# Set heap size in jvm.options
-Xms4g
-Xmx4g

curl -X GET "localhost:9200/_cluster/health?pretty"

# elasticsearch-blue-green.yml
cluster.name: "elk-blue-green"
node.name: "elk-node-blue"

# Blue environment
network.host: 192.168.1.10
http.port: 9200

# For green environment, change node.name and http.port

# Example canary deployment config for ELK Stack
deployment:
  name: "canary-deployment"
  version: "8.10.0"
  strategy:
    type: "canary"
    steps:
      - percentage: 10
        duration: "5m"
      - percentage: 30
        duration: "10m"
      - percentage: 100
        duration: "15m"

# Runbook: Application Deployment

## Overview
This runbook outlines the steps to deploy the application to production.

## Prerequisites
- Access to production environment
- Approved deployment branch

## Steps
1. Validate deployment branch
2. Run integration tests
3. Deploy to production

## Rollback Procedure
In case of failure, rollback to previous version.