通过 Amazon EventBridge 监控 OpenSearch Service 事件 - Amazon Opensearch Service
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 Amazon Web Services 服务入门

通过 Amazon EventBridge 监控 OpenSearch Service 事件

Amazon OpenSearch Service 与 Amazon EventBridge 集成,以通知您影响您的域的特定事件。Amazon 服务中的事件将近乎实时传输到 EventBridge。同样的事件也会发送到 Amazon EventBridge 的前身 Amazon CloudWatch Events 中。您可以编写简单规则来指示您关注的事件,并指示要在事件匹配规则时执行的自动化操作。可自动触发的操作包括:

  • 调用 Amazon Lambda 函数

  • 调用 Amazon EC2 Run Command

  • 将事件中继到 Amazon Kinesis Data Streams

  • 激活 Amazon Step Functions 状态机

  • 通知 Amazon SNS 主题或 Amazon SQS 队列

有关更多信息,请参阅 Amazon EventBridge 用户指南中的 Amazon EventBridge 入门

服务软件更新事件

当以下任一服务软件更新事件发生时,OpenSearch Service 将事件发送到 EventBridge。

可用服务软件更新

OpenSearch Service 将此事件发送到服务软件更新可用。

示例

以下是该类型的示例事件:

{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Amazon OpenSearch Service Software Update Notification", "source": "aws.es", "account": "123456789012", "time": "2016-11-01T13:12:22Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Service Software Update", "status": "Available", "severity": "Informational", "description": "Service software update [R20200330-p1] available." } }

服务软件更新已启动

OpenSearch Service 将此事件发送到服务软件更新已启动。

示例

以下是该类型的示例事件:

{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Amazon OpenSearch Service Software Update Notification", "source": "aws.es", "account": "123456789012", "time": "2016-11-01T13:12:22Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Service Software Update", "status": "Started", "severity": "Informational", "description": "Service software update [R20200330-p1] started." } }

服务软件更新已完成

OpenSearch Service 将此事件发送到服务软件更新已完成。

示例

以下是该类型的示例事件:

{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Amazon OpenSearch Service Software Update Notification", "source": "aws.es", "account": "123456789012", "time": "2016-11-01T13:12:22Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Service Software Update", "status": "Completed", "severity": "Informational", "description": "Service software update [R20200330-p1] completed." } }

服务软件更新失败

OpenSearch Service 将此事件发送到服务软件更新失败。

示例

以下是该类型的示例事件:

{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Amazon OpenSearch Service Software Update Notification", "source": "aws.es", "account": "123456789012", "time": "2016-11-01T13:12:22Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Service Software Update", "status": "Failed", "severity": "Medium", "description": "Service software update [R20200330-p1] failed." } }

已要求服务软件更新

当需要更新服务软件时,OpenSearch Service 会发送此事件。

示例

以下是该类型的示例事件:

{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Amazon OpenSearch Service Software Update Notification", "source": "aws.es", "account": "123456789012", "time": "2016-11-01T13:12:22Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Service Software Update", "status": "Required", "severity": "High", "description": "Service software update [R20200330-p1] available. Update will be automatically installed after [30/04/2020] if no action is taken." } }

自动调整事件

当以下任一自动调整事件发生时,OpenSearch Service 将事件发送到 EventBridge。

自动调整挂起

OpenSearch Service 发送此事件时,自动调整已确定改进群集性能和可用性的优化建议。您只能看到已禁用自动调整的域的此事件。

示例

以下是该类型的示例事件:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Auto-Tune Event", "severity": "Informational", "status": "Pending", "description": "Auto-Tune recommends new settings for your domain. Enable Auto-Tune to improve cluster stability and performance.", "scheduleTime": "{iso8601-timestamp}" } }

自动调整已开始

OpenSearch Service 会在自动调整开始将新设置应用到您的域时发送此事件。

示例

以下是该类型的示例事件:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Auto-Tune Events", "severity": "Informational", "status": "Started", "scheduleTime": "{iso8601-timestamp}", "startTime": "{iso8601-timestamp}", "description" : "Auto-Tune is applying new settings to your domain." } }

自动调节需要计划蓝色/绿色部署

OpenSearch Service 发送此事件时,自动调整已确定需要计划的蓝色/绿色部署的调整建议。

示例

以下是该类型的示例事件:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Auto-Tune Event", "severity": "Low", "status": "Pending", "startTime": "{iso8601-timestamp}", "description": "Auto-Tune has identified new settings for your domain that require a blue/green deployment. You can schedule the deployment for your preferred time." } }

自动调整已取消

OpenSearch Service 会在自动调整计划被取消时发送此事件,因为没有待处理的优化建议。

示例

以下是该类型的示例事件:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Auto-Tune Event", "severity": "Low", "status": "Cancelled", "scheduleTime": "{iso8601-timestamp}", "description": "Auto-Tune has cancelled the upcoming blue/green deployment." } }

自动调整已完成

OpenSearch Service 发送此事件时,自动调整已完成蓝色/绿色部署,并且集群在新 JVM 设置的情况下运行。

示例

以下是该类型的示例事件:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Auto-Tune Event", "severity": "Informational", "status": "Completed", "completionTime": "{iso8601-timestamp}", "description": "Auto-Tune has completed the blue/green deployment and successfully applied the updated settings." } }

已禁用自动调整并恢复更改

OpenSearch Service 会在禁用自动调整并回滚应用的更改时发送此事件。

示例

以下是该类型的示例事件:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": [ "arn:aws:es:us-east-1:123456789012:domain/test-domain" ], "detail": { "event": "Auto-Tune Event", "severity": "Informational", "status": "Completed", "description": "Auto-Tune is now disabled. All settings have been reverted. Auto-Tune will continue to evaluate cluster performance and provide recommendations.", "completionTime": "{iso8601-timestamp}" } }

已禁用自动调整并保留更改

OpenSearch Service 会在禁用自动调整并保留应用的更改时发送此事件。

示例

以下是该类型的示例事件:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Auto-Tune Event", "severity": "Informational", "status": "Completed", "description": "Auto-Tune is now disabled. The most-recent settings by Auto-Tune have been retained. Auto-Tune will continue to evaluate cluster performance and provide recommendations.", "completionTime": "{iso8601-timestamp}" } }

集群运行状况事件

当集群的运行状况受到影响时,OpenSearch Service 会向 EventBridge 发送某些事件。

红色集群恢复已开始

OpenSearch Service 会在集群状态持续变为红色超过一个小时后发送此事件。它会尝试从快照中自动还原一个或多个红色索引,以修复集群状态。

示例

以下是该类型的示例事件:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Cluster Status Notification", "source":"aws.es", "account":"123456789012", "time":"2016-11-01T13:12:22Z", "region":"us-east-1", "resources":[ "arn:aws:es:us-east-1:123456789012:domain/test-domain" ], "detail":{ "event":"Automatic Snapshot Restore for Red Indices", "status":"Started", "Severity":"High", "description":"Your cluster status is red. We have started automatic snapshot restore for the red indices. No action is needed from your side. Red indices [red-index-0, red-index-1]" } }

红色集群恢复部分完成

在尝试修复红色集群状态期间,OpenSearch Service 仅在其只能从快照还原部分红色索引时,才会发送此事件。

示例

以下是该类型的示例事件:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Cluster Status Notification", "source":"aws.es", "account":"123456789012", "time":"2016-11-01T13:12:22Z", "region":"us-east-1", "resources":[ "arn:aws:es:us-east-1:123456789012:domain/test-domain" ], "detail":{ "event":"Automatic Snapshot Restore for Red Indices", "status":"Partially Restored", "Severity":"High", "description":"Your cluster status is red. We were able to restore the following Red indices from snapshot: [red-index-0]. Indices not restored: [red-index-1]. Please refer https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-red-cluster-status for troubleshooting steps." } }

红色集群恢复失败

在尝试修复红色集群状态时,如果 OpenSearch Service 无法恢复任何索引,则会发送此事件。

示例

以下是该类型的示例事件:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Cluster Status Notification", "source":"aws.es", "account":"123456789012", "time":"2016-11-01T13:12:22Z", "region":"us-east-1", "resources":[ "arn:aws:es:us-east-1:123456789012:domain/test-domain" ], "detail":{ "event":"Automatic Snapshot Restore for Red Indices", "status":"Failed", "Severity":"High", "description":"Your cluster status is red. We were unable to restore the Red indices automatically. Indices not restored: [red-index-0, red-index-1]. Please refer https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-red-cluster-status for troubleshooting steps." } }

要删除的分片

OpenSearch Service 在红色集群持续为红色 14 天后尝试自动修复红色集群状态时,如果仍有一个或多个索引为红色,则会发送此事件。再过 7 天(总共 21 天持续变为红色)之后,OpenSearch Service 将在所有红色索引上删除未分配的分片

示例

以下是该类型的示例事件:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Cluster Status Notification", "source":"aws.es", "account":"123456789012", "time":"2022-04-09T10:36:48Z", "region":"us-east-1", "resources":[ "arn:aws:es:us-east-1:123456789012:domain/test-domain" ], "detail":{ "severity":"Medium", "description":"Your cluster status is red. Please fix the red indices as soon as possible. If not fixed by 2022-04-12 01:51:47+00:00, we will delete all unassigned shards, the unit of storage and compute, for these red indices to recover your domain and make it green. Please refer to https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-red-cluster-status for troubleshooting steps. test_data, test_data1", "event":"Automatic Snapshot Restore for Red Indices", "status":"Shard(s) to be deleted" } }

分片已删除

OpenSearch Service 会在集群状态持续变为红色 21 天之后发送此事件。它会删除所有红色索引上未分配的分片(存储和计算)。有关详细信息,请参阅自动修复红色集群

示例

以下是该类型的示例事件:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Cluster Status Notification", "source":"aws.es", "account":"123456789012", "time":"2022-04-09T10:54:48Z", "region":"us-east-1", "resources":[ "arn:aws:es:us-east-1:123456789012:domain/test-domain" ], "detail":{ "severity":"High", "description":"We have deleted unassinged shards, the unit of storage and compute, in red indices: index-1, index-2 because these indices were red for more than 21 days and could not be restored with the automated restore process. Please refer to https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-red-cluster-status for troubleshooting steps.", "event":"Automatic Snapshot Restore for Red Indices", "status":"Shard(s) deleted" } }

高分片数警告

当热数据节点中的平均分片数超过建议的默认限制 1,000 的 90% 时,OpenSearch Service 将会发送此事件。尽管较新版本的 Elasticsearch 和 OpenSearch 支持可配置最大分片数单个节点限制,但我们还是建议每个节点上拥有不超过 1,000 个分片。请参阅选择分片数

示例

以下是该类型的示例事件:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Notification", "source":"aws.es", "account":"123456789012", "time":"2016-11-01T13:12:22Z", "region":"us-east-1", "resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail":{ "event":"High Shard Count", "status":"Warning", "severity":"Low", "description":"One or more data nodes have close to 1000 shards. To ensure optimum performance and stability of your cluster, please refer to the best practice guidelines - https://docs.aws.amazon.com/opensearch-service/latest/developerguide/sizing-domains.html#bp-sharding." } }

超出分片数限制

当热数据节点中的平均分片数超过建议的默认限制 1,000 时,OpenSearch Service 将会发送此事件。尽管较新版本的 Elasticsearch 和 OpenSearch 支持可配置最大分片数单个节点限制,但我们还是建议每个节点上拥有不超过 1,000 个分片。请参阅选择分片数

示例

以下是该类型的示例事件:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Notification", "source":"aws.es", "account":"123456789012", "time":"2016-11-01T13:12:22Z", "region":"us-east-1", "resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail":{ "event":"High Shard Count", "status":"Warning", "severity":"Medium", "description":"One or more data nodes have more than 1000 shards. To ensure optimum performance and stability of your cluster, please refer to the best practice guidelines - https://docs.aws.amazon.com/opensearch-service/latest/developerguide/sizing-domains.html#bp-sharding." } }

磁盘空间不足

当集群中的一个或多个节点的可用存储空间低于 25%(也就是少于 25GB)时,OpenSearch Service 将会发送此事件。

示例

以下是该类型的示例事件:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Notification", "source":"aws.es", "account":"123456789012", "time":"2017-12-01T13:12:22Z", "region":"us-east-1", "resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail":{ "event":"Low Disk Space", "status":"Warning", "severity":"Medium", "description":"One or more data nodes in your cluster has less than 25% of storage space or less than 25GB. Your cluster will be blocked for writes at 20% or 20GB. Please refer to the documentation for more information - https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#troubleshooting-cluster-block" } }

域错误事件

当发生以下任一域错误时,OpenSearch Service 会将事件发送到 EventBridge。

KMS 密钥不可访问

无法访问您的 Amazon KMS 密钥时,OpenSearch Service 将会发送此事件。

示例

以下是该类型的示例事件:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Domain Error Notification", "source":"aws.es", "account":"123456789012", "time":"2016-11-01T13:12:22Z", "region":"us-east-1", "resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail":{ "event":"KMS Key Inaccessible", "status":"Error", "severity":"High", "description":"The KMS key associated with this domain is inaccessible. You are at risk of losing access to your domain. For more information, please refer https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html#disabled-key." } }