script to check ElasticSearch indexes' size and compare to their average #elasticsearch #admin #health #indexes

health_es_indexes.sh

#!/bin/bash

# script to check ElasticSearch indexes' size and compare to their average.
# send an email if current index size is lower or grater than average +20%
# averages are in the config file, for example:
#
#declare -A index
#index[logcdn]=25000000
#index[logjboss]=950000
#index[logmonitor]=12000
#index[logstash]=2000000

# read conf: avg size (nr of documents) in ES indexes
# and compare it to yesterday's indexes to catch up
# all abnormalities
. conf/healthcheck/es_index_size_avg.conf

es_host=10.1.1.1:9200  #your ES master node
email_rcpt=your_email@address.com

email_body=''
arg=$2
#function v { [ -z $arg ] && return; echo `date "+%c"`" $1"; }
function v {  return; echo `date "+%c"`" $1"; }

function email()
{
        local subject=$1 rcpt=$2
         echo -e "$email_body\n\n\n" | mail -s "$subject" -r noreply@talktalkplc.com "$rcpt"
}

function emsg() { email_body="$email_body\n${1}"; }

day=$1
[ -z $day ] && day=`date "+%Y.%m.%d" -d '-1 day'`

while read a ; do
        t=($a)
        ind=${t[2]}
        ind=${ind%-*}
        [ -z ${index[$ind]} ] && continue
        [ ${t[5]} -eq 0 ] && { echo "${t[2]} size is zero"; continue; }
        prcnt=$(( ${t[5]} * 20/100))
        abs=$(( ${t[5]} - ${index[$ind]} ))
        abs=${abs/-/}
        v  "${t[5]} $ind ${index[$ind]} $prcnt $abs"
        [ $abs -gt $prcnt ] &&  emsg "$email_body ${t[2]} size problem! avg is ${index[$ind]}, cur is ${t[5]}, 20% allowed diference is $prcnt"
done < <(curl -s "$eshost/_cat/indices?v" | sort | grep $day )

[ "$email_body" != '' ] && email 'ES index health' "$email_rcpt"