本文最后更新于 2020年10月27日，距今已 2190 天，其中的信息可能已经发生变化，请注意甄别。
在 Elasticsearch 中，cat API 仅适用于使用 Kibana 控制台或命令行供人类使用。 它们不适合应用程序使用。 对于应用程序消耗，我们建议使用相应的 JSON API。所有的 cat 命令都接受查询字符串参数 help，以查看它们提供的所有 header 和信息，并且 /_cat命令仅列出所有可用的命令。
在我们的实际使用中，我们，我们有时看到别人打入如下的命令：
GET _cat/nodes?v&h=name,disk.avail,search.query_total,heap.percent
可是在很多的情况下，我们并不知道这些参数的名字，我们该如何使用这个命令呢？今天以 _cat 终点为例来简单描述一下该如何使用这个命令。
罗列 _cat 支持的所有命令
我们可以使用如下的命令来罗列所有的命令：
GET /_cat
上面将列车 _cat 所支持的索引的命令：
=^.^=
/_cat/allocation
/_cat/shards
/_cat/shards/{index}
/_cat/master
/_cat/nodes
/_cat/tasks
/_cat/indices
/_cat/indices/{index}
/_cat/segments
/_cat/segments/{index}
/_cat/count
/_cat/count/{index}
/_cat/recovery
/_cat/recovery/{index}
/_cat/health
/_cat/pending_tasks
/_cat/aliases
/_cat/aliases/{alias}
/_cat/thread_pool
/_cat/thread_pool/{thread_pools}
/_cat/plugins
/_cat/fielddata
/_cat/fielddata/{fields}
/_cat/nodeattrs
/_cat/repositories
/_cat/snapshots/{repository}
/_cat/templates
/_cat/ml/anomaly_detectors
/_cat/ml/anomaly_detectors/{job_id}
/_cat/ml/trained_models
/_cat/ml/trained_models/{model_id}
/_cat/ml/datafeeds
/_cat/ml/datafeeds/{datafeed_id}
/_cat/ml/data_frame/analytics
/_cat/ml/data_frame/analytics/{id}
/_cat/transforms
/_cat/transforms/{transform_id}
上面有我们非常常用的一些命令，比如：
/_cat/shards
/_cat/shards/{index}
/_cat/master
/_cat/nodes
/_cat/tasks
/_cat/indices
/_cat/indices/{index}
/_cat/health
/_cat/nodeattrs
今天我们就以其中的一个或两个来进行描述。
使用 _cat 命令示例
我们就以如下的 API 来作为例子：
GET /_cat/shards
上面的命令用来显示所有的 shard 的情况：
.apm-custom-link 0 p STARTED 0 208b 127.0.0.1 node1 .apm-custom-link 0 r STARTED 0 208b 127.0.0.1 node2 logs_server1 0 p STARTED 194744 76.2mb 127.0.0.1 node1 logs_server1 0 r STARTED 194744 76.2mb 127.0.0.1 node2 .apm-agent-configuration 0 r STARTED 0 208b 127.0.0.1 node1 .apm-agent-configuration 0 p STARTED 0 208b 127.0.0.1 node2 .tasks 0 r UNASSIGNED .tasks 0 p UNASSIGNED logs_server4 0 p STARTED 2 18.9kb 127.0.0.1 node1 logs_server4 0 r STARTED 2 37.3kb 127.0.0.1 node2 temp1 0 p STARTED 0 208b 127.0.0.1 node1 temp1 0 r STARTED 0 208b 127.0.0.1 node2 temp3 2 r STARTED 233798 91mb 127.0.0.1 node1 temp3 2 p STARTED 233798 91mb 127.0.0.1 node2 temp3 1 p STARTED 233881 91.1mb 127.0.0.1 node1 temp3 1 r STARTED 233881 91.1mb 127.0.0.1 node2 ...
显然，我们还不知道每个列的意思是什么。我们可以通过如下的方法来显示 header：
GET /_cat/shards?v
index shard prirep state docs store ip node .kibana-event-log-7.8.0-000001 0 p UNASSIGNED .kibana-event-log-7.8.0-000001 0 r UNASSIGNED logs_server4 0 p STARTED 2 18.9kb 127.0.0.1 node1 logs_server4 0 r STARTED 2 37.3kb 127.0.0.1 node2 dynamic_test 0 p STARTED 1 3.5kb 127.0.0.1 node1 dynamic_test 0 r STARTED 1 3.5kb 127.0.0.1 node2 ilm-history-2-000001 0 p UNASSIGNED ilm-history-2-000001 0 r UNASSIGNED .apm-agent-configuration 0 r STARTED 0 208b 127.0.0.1 node1 .apm-agent-configuration 0 p STARTED 0 208b 127.0.0.1 node2 surveys 0 p STARTED 2 5.3kb 127.0.0.1 node1 surveys 0 r STARTED 2 5.3kb 127.0.0.1 node2 blogs 0 r STARTED 1594 5.6mb 127.0.0.1 node1 blogs 0 p STARTED 1594 5.6mb 127.0.0.1 node2
从上面的输出中，我们可以看出来，第一例展示的是 index，第二例展示的是 shard，第三列指的是 primary 或 replica shard。显然这样的展示比之前的那个展示更加清楚。
那么我们除了能展示上面的这个列之外，还有没有其它的可以展示的呢？如果能，它们的名称又是什么呢？
我们可以使用 help 参数来获得更多的帮助：
GET /_cat/shards?help
上面的命令展示：
index | i,idx | index name shard | s,sh | shard name prirep | p,pr,primaryOrReplica | primary or replica state | st | shard state docs | d,dc | number of docs in shard store | sto | store size of shard (how much disk it uses) ip | | ip of node where it lives id | | unique id of node where it lives node | n | name of node where it lives sync_id | sync_id | sync id unassigned.reason | ur | reason shard is unassigned unassigned.at | ua | time shard became unassigned (UTC) unassigned.for | uf | time has been unassigned unassigned.details | ud | additional details as to why the shard became unassigned recoverysource.type | rs | recovery source type completion.size | cs,completionSize | size of completion fielddata.memory_size | fm,fielddataMemory | used fielddata cache fielddata.evictions | fe,fielddataEvictions | fielddata evictions query_cache.memory_size | qcm,queryCacheMemory | used query cache query_cache.evictions | qce,queryCacheEvictions | query cache evictions flush.total | ft,flushTotal | number of flushes flush.total_time | ftt,flushTotalTime | time spent in flush get.current | gc,getCurrent | number of current get ops get.time | gti,getTime | time spent in get get.total | gto,getTotal | number of get ops get.exists_time | geti,getExistsTime | time spent in successful gets get.exists_total | geto,getExistsTotal | number of successful gets get.missing_time | gmti,getMissingTime | time spent in failed gets get.missing_total | gmto,getMissingTotal | number of failed gets indexing.delete_current | idc,indexingDeleteCurrent | number of current deletions indexing.delete_time | idti,indexingDeleteTime | time spent in deletions indexing.delete_total | idto,indexingDeleteTotal | number of delete ops indexing.index_current | iic,indexingIndexCurrent | number of current indexing ops indexing.index_time | iiti,indexingIndexTime | time spent in indexing indexing.index_total | iito,indexingIndexTotal | number of indexing ops indexing.index_failed | iif,indexingIndexFailed | number of failed indexing ops merges.current | mc,mergesCurrent | number of current merges merges.current_docs | mcd,mergesCurrentDocs | number of current merging docs merges.current_size | mcs,mergesCurrentSize | size of current merges merges.total | mt,mergesTotal | number of completed merge ops merges.total_docs | mtd,mergesTotalDocs | docs merged merges.total_size | mts,mergesTotalSize | size merged merges.total_time | mtt,mergesTotalTime | time spent in merges refresh.total | rto,refreshTotal | total refreshes refresh.time | rti,refreshTime | time spent in refreshes refresh.external_total | rto,refreshTotal | total external refreshes refresh.external_time | rti,refreshTime | time spent in external refreshes refresh.listeners | rli,refreshListeners | number of pending refresh listeners search.fetch_current | sfc,searchFetchCurrent | current fetch phase ops search.fetch_time | sfti,searchFetchTime | time spent in fetch phase search.fetch_total | sfto,searchFetchTotal | total fetch ops search.open_contexts | so,searchOpenContexts | open search contexts search.query_current | sqc,searchQueryCurrent | current query phase ops search.query_time | sqti,searchQueryTime | time spent in query phase search.query_total | sqto,searchQueryTotal | total query phase ops search.scroll_current | scc,searchScrollCurrent | open scroll contexts search.scroll_time | scti,searchScrollTime | time scroll contexts held open search.scroll_total | scto,searchScrollTotal | completed scroll contexts segments.count | sc,segmentsCount | number of segments segments.memory | sm,segmentsMemory | memory used by segments segments.index_writer_memory | siwm,segmentsIndexWriterMemory | memory used by index writer segments.version_map_memory | svmm,segmentsVersionMapMemory | memory used by version map segments.fixed_bitset_memory | sfbm,fixedBitsetMemory | memory used by fixed bit sets for nested object field types and type filters for types referred in _parent fields seq_no.max | sqm,maxSeqNo | max sequence number seq_no.local_checkpoint | sql,localCheckpoint | local checkpoint seq_no.global_checkpoint | sqg,globalCheckpoint | global checkpoint warmer.current | wc,warmerCurrent | current warmer ops warmer.total | wto,warmerTotal | total warmer ops warmer.total_time | wtt,warmerTotalTime | time spent in warmers path.data | pd,dataPath | shard data path path.state | ps,statsPath | shard state path
显示这是一个非常丰富的列表，它可以展示我们想要的很多内容。比如我们使用如下的命令：
GET /_cat/shards?v&h=*
上面的意思是，我们想展示 header 已经 header 是所有的项：
index shard prirep state docs store ip id node sync_id unassigned.reason unassigned.at unassigned.for unassigned.details recoverysource.type completion.size fielddata.memory_size fielddata.evictions query_cache.memory_size query_cache.evictions flush.total flush.total_time get.current get.time get.total get.exists_time get.exists_total get.missing_time get.missing_total indexing.delete_current indexing.delete_time indexing.delete_total indexing.index_current indexing.index_time indexing.index_total indexing.index_failed merges.current merges.current_docs merges.current_size merges.total merges.total_docs merges.total_size merges.total_time refresh.total refresh.time refresh.external_total refresh.external_time refresh.listeners search.fetch_current search.fetch_time search.fetch_total search.open_contexts search.query_current search.query_time search.query_total search.scroll_current search.scroll_time search.scroll_total segments.count segments.memory segments.index_writer_memory segments.version_map_memory segments.fixed_bitset_memory seq_no.max seq_no.local_checkpoint seq_no.global_checkpoint warmer.current warmer.total warmer.total_time path.data path.state logs_server1 0 p STARTED 194744 76.2mb 127.0.0.1 7JrI3NYFSLarYmE-8r6GLg node1 0b 31.9kb 0 24.2kb 0 1 0s 0 0s 0 0s 0 0s 0 0 0s 0 0 0s 0 0 0 0 0b 0 0 0b 0s 6 0s 2 0s 0 0 12ms 7 0 0 342ms 23 0 0s 0 7 92.5kb 0b 0b 0b 194743 194743 194743 0 1 0s /Users/liuxg/elastic0/elasticsearch-7.8.0/data/nodes/0 /Users/liuxg/elastic0/elasticsearch-7.8.0/data/nodes/0 logs_server1 0 r STARTED 194744 76.2mb 127.0.0.1 lvoe3NMWQKO4IOAYYQMJLg node2 0b 31.9kb 0 48.6kb 0 1 0s 0 0s 0 0s 0 0s 0 0 0s 0 0 0s 0 0 0 0 0b 0 0 0b 0s 3 16ms 2 0s 0 0 438ms 4 0 0 403ms 25 0 0s 0 7 92.5kb 0b 0b 0b 194743 194743 194743 0 1 0s /Users/liuxg/elastic0/elasticsearch-7.8.0/data/nodes/1 /Users/liuxg/elastic0/elasticsearch-7.8.0/data/nodes/1 .kibana_task_manager_1 0 p STARTED 5 30.5kb 127.0.0.1 7JrI3NYFSLarYmE-8r6GLg node1 0b 0b 0 0b 0 6 976ms 0 416ms 35 416ms 35 0s 0 0 0s 0 0 213ms 45 5 0 0 0b 4 43 165.1kb 126ms 37 792ms 26 650ms 0 0 416ms 16142 0 0 5.3s 16145 0 19.3s 16126 2 6.2kb 0b 0b 96b 64 64
上面的展示在很多的时候非常凌乱，不好阅读。在很多的时候，我们希望能够控制这个输出，比如：
GET /_cat/shards?v&h=index,shard,prirep,state,node,ip
上面的输出为：
index shard prirep state node ip blogs 0 r STARTED node1 127.0.0.1 blogs 0 p STARTED node2 127.0.0.1 temp3 2 r STARTED node1 127.0.0.1 temp3 2 p STARTED node2 127.0.0.1 temp3 1 p STARTED node1 127.0.0.1 temp3 1 r STARTED node2 127.0.0.1 temp3 0 r UNASSIGNED temp3 0 p UNASSIGNED surveys2 0 p STARTED node1 127.0.0.1 surveys2 0 r STARTED node2 127.0.0.1 temp1 0 p STARTED node1 127.0.0.1 temp1 0 r STARTED node2 127.0.0.1 logs_server2 0 p UNASSIGNED logs_server2 0 r UNASSIGNED twitter 0 p STARTED node1 127.0.0.1 twitter 0 r STARTED node2 127.0.0.1 designs 0 p STARTED node1 127.0.0.1 designs 0 r STARTED node2 127.0.0.1 .apm-custom-link 0 p STARTED node1 127.0.0.1 .apm-custom-link 0 r STARTED node2 127.0.0.11 designs 0 r STARTED node2 ....
现在的内容展示是不是可以完全由我们自己来控制啊？
接下来，我们想对这个输出来进行排序，这样更容易使得我们阅读：
GET /_cat/shards?v&h=index,shard,prirep,state,node,ip&s=index,shard,prirep
在上面，我们添加了 s=index,shard,prirep，这个是用来按照 index，shard，以及 prirep 来进行排序的。这样上面的显示结果为：
index shard prirep state node ip .apm-agent-configuration 0 p STARTED node2 127.0.0.1 .apm-agent-configuration 0 r STARTED node1 127.0.0.1 .apm-custom-link 0 p STARTED node1 127.0.0.1 .apm-custom-link 0 r STARTED node2 127.0.0.1 .kibana-event-log-7.8.0-000001 0 p UNASSIGNED .kibana-event-log-7.8.0-000001 0 r UNASSIGNED .kibana_1 0 p STARTED node2 127.0.0.1 .kibana_1 0 r STARTED node1 127.0.0.1 .kibana_task_manager_1 0 p STARTED node1 127.0.0.1 .kibana_task_manager_1 0 r STARTED node2 127.0.0.1 .tasks 0 p UNASSIGNED .tasks 0 r UNASSIGNED blogs 0 p STARTED node2 127.0.0.1 blogs 0 r STARTED node1 127.0.0.1 designs 0 p STARTED node1 127.0.0.1 designs 0 r STARTED node2 127.0.0.1 dynamic_test 0 p STARTED node1 127.0.0.1 dynamic_test 0 r STARTED node2 127.0.0.1 ...
这样是不是更容易让我们进行阅读啊。
当然，如果我们只对其中某个索引感兴趣，我们可以使用如下的命令：
GET /_cat/shards/logs_server1?v&h=index,shard,prirep,state,node,ip&s=index,shard,prirep
上面命令展示的内容如下：
index shard prirep state node ip logs_server1 0 p STARTED node1 127.0.0.1 logs_server1 0 r STARTED node2 127.0.0.1
我们可以把上面的 trick 应用到其它的 _cat 命令中，这样无论是什么样的命令，我们都可以随心控制想要的输出了。回到我们文章一开始的例子：
GET _cat/nodes?help
我们将得到所有的每个 header 的解释：
id | id,nodeId | unique node id pid | p | process id ip | i | ip address port | po | bound transport port http_address | http | bound http address version | v | es version flavor | f | es distribution flavor type | t | es distribution type build | b | es build hash jdk | j | jdk version disk.total | dt,diskTotal | total disk space disk.used | du,diskUsed | used disk space disk.avail | d,da,disk,diskAvail | available disk space disk.used_percent | dup,diskUsedPercent | used disk space percentage heap.current | hc,heapCurrent | used heap heap.percent | hp,heapPercent | used heap ratio heap.max | hm,heapMax | max configured heap ram.current | rc,ramCurrent | used machine memory ram.percent | rp,ramPercent | used machine memory ratio ram.max | rm,ramMax | total machine memory file_desc.current | fdc,fileDescriptorCurrent | used file descriptors file_desc.percent | fdp,fileDescriptorPercent | used file descriptor ratio file_desc.max | fdm,fileDescriptorMax | max file descriptors cpu | cpu | recent cpu usage load_1m | l | 1m load avg load_5m | l | 5m load avg load_15m | l | 15m load avg uptime | u | node uptime node.role | r,role,nodeRole | m:master eligible node, d:data node, i:ingest node, -:coordinating node only master | m | *:current master name | n | node name completion.size | cs,completionSize | size of completion fielddata.memory_size | fm,fielddataMemory | used fielddata cache fielddata.evictions | fe,fielddataEvictions | fielddata evictions query_cache.memory_size | qcm,queryCacheMemory | used query cache query_cache.evictions | qce,queryCacheEvictions | query cache evictions request_cache.memory_size | rcm,requestCacheMemory | used request cache request_cache.evictions | rce,requestCacheEvictions | request cache evictions request_cache.hit_count | rchc,requestCacheHitCount | request cache hit counts request_cache.miss_count | rcmc,requestCacheMissCount | request cache miss counts flush.total | ft,flushTotal | number of flushes flush.total_time | ftt,flushTotalTime | time spent in flush get.current | gc,getCurrent | number of current get ops get.time | gti,getTime | time spent in get get.total | gto,getTotal | number of get ops get.exists_time | geti,getExistsTime | time spent in successful gets get.exists_total | geto,getExistsTotal | number of successful gets get.missing_time | gmti,getMissingTime | time spent in failed gets get.missing_total | gmto,getMissingTotal | number of failed gets indexing.delete_current | idc,indexingDeleteCurrent | number of current deletions indexing.delete_time | idti,indexingDeleteTime | time spent in deletions indexing.delete_total | idto,indexingDeleteTotal | number of delete ops indexing.index_current | iic,indexingIndexCurrent | number of current indexing ops indexing.index_time | iiti,indexingIndexTime | time spent in indexing indexing.index_total | iito,indexingIndexTotal | number of indexing ops indexing.index_failed | iif,indexingIndexFailed | number of failed indexing ops merges.current | mc,mergesCurrent | number of current merges merges.current_docs | mcd,mergesCurrentDocs | number of current merging docs merges.current_size | mcs,mergesCurrentSize | size of current merges merges.total | mt,mergesTotal | number of completed merge ops merges.total_docs | mtd,mergesTotalDocs | docs merged merges.total_size | mts,mergesTotalSize | size merged merges.total_time | mtt,mergesTotalTime | time spent in merges refresh.total | rto,refreshTotal | total refreshes refresh.time | rti,refreshTime | time spent in refreshes refresh.external_total | rto,refreshTotal | total external refreshes refresh.external_time | rti,refreshTime | time spent in external refreshes refresh.listeners | rli,refreshListeners | number of pending refresh listeners script.compilations | scrcc,scriptCompilations | script compilations script.cache_evictions | scrce,scriptCacheEvictions | script cache evictions script.compilation_limit_triggered | scrclt,scriptCacheCompilationLimitTriggered | script cache compilation limit triggered search.fetch_current | sfc,searchFetchCurrent | current fetch phase ops search.fetch_time | sfti,searchFetchTime | time spent in fetch phase search.fetch_total | sfto,searchFetchTotal | total fetch ops search.open_contexts | so,searchOpenContexts | open search contexts search.query_current | sqc,searchQueryCurrent | current query phase ops search.query_time | sqti,searchQueryTime | time spent in query phase search.query_total | sqto,searchQueryTotal | total query phase ops search.scroll_current | scc,searchScrollCurrent | open scroll contexts search.scroll_time | scti,searchScrollTime | time scroll contexts held open search.scroll_total | scto,searchScrollTotal | completed scroll contexts segments.count | sc,segmentsCount | number of segments segments.memory | sm,segmentsMemory | memory used by segments segments.index_writer_memory | siwm,segmentsIndexWriterMemory | memory used by index writer segments.version_map_memory | svmm,segmentsVersionMapMemory | memory used by version map segments.fixed_bitset_memory | sfbm,fixedBitsetMemory | memory used by fixed bit sets for nested object field types and type filters for types referred in _parent fields suggest.current | suc,suggestCurrent | number of current suggest ops suggest.time | suti,suggestTime | time spend in suggest suggest.total | suto,suggestTotal | number of suggest ops
有了上面的这个表格，我们就很容易理解如下的这个命令了：
GET _cat/nodes?v&h=name,disk.avail,search.query_total,heap.percent
上面命令显示的结果为：
name disk.avail search.query_total heap.percent node1 117.2gb 18206 25 node2 117.2gb 2785 15
好了，今天的分享就到这里。希望大家学到知识，并能够把 _cat 命令灵活地应用到实践中。
原文链接：https://blog.csdn.net/UbuntuTouch/article/details/108823855
文章评论