如何在ECK Operator中配置Elasticsearch ILM及各类扩展功能

下面针对你提到的索引生命周期策略、数据视图、索引模板、数据流、仪表板等功能，给出基于ECK Operator的具体配置方案：

1. 索引生命周期策略（ILM） #

方式一：嵌入到Elasticsearch自定义资源（CR）中 #

直接在Elasticsearch资源的配置段添加ILM策略，ECK会自动将其加载到集群：

apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: quickstart
spec:
  version: 8.11.0
  nodeSets:
  - name: default
    count: 1
    config:
      node.store.allow_mmap: false
  # 配置ILM策略
  elasticsearchConfig:
    ilm_policies:
      my_log_policy.json: |-
        {
          "policy": {
            "phases": {
              "hot": {
                "actions": {
                  "rollover": {
                    "max_age": "30d",
                    "max_size": "50gb"
                  }
                }
              },
              "delete": {
                "min_age": "90d",
                "actions": {
                  "delete": {}
                }
              }
            }
          }
        }

方式二：通过API/Kibana UI创建 #

集群就绪后，端口转发访问Elasticsearch或Kibana：

# 端口转发Elasticsearch
kubectl port-forward service/quickstart-es-http 9200:9200

调用API创建策略：

curl -X PUT "http://localhost:9200/_ilm/policy/my_log_policy" -H "Content-Type: application/json" -d'
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_age": "30d",
            "max_size": "50gb"
          }
        }
      },
      "delete": {
        "min_age": "90d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}
'

也可以在Kibana的Stack Management > Index Lifecycle Policies页面可视化创建。

2. 索引模板与数据流（Data Streams） #

索引模板配置 #

同样支持嵌入到Elasticsearch CR或API/UI创建：

apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: quickstart
spec:
  version: 8.11.0
  nodeSets:
  - name: default
    count: 1
    config:
      node.store.allow_mmap: false
  elasticsearchConfig:
    index_templates:
      logs_template.json: |-
        {
          "index_patterns": ["logs-*"],
          "template": {
            "settings": {
              "index.lifecycle.name": "my_log_policy",
              "index.lifecycle.rollover_alias": "logs"
            },
            "mappings": {
              "properties": {
                "@timestamp": { "type": "date" },
                "message": { "type": "text" }
              }
            }
          },
          "priority": 500
        }

数据流创建 #

数据流依赖匹配的索引模板，创建方式如下：

curl -X PUT "http://localhost:9200/_data_stream/logs" -H "Content-Type: application/json"

或在Kibana的Stack Management > Data Streams页面关联已创建的索引模板完成创建。

3. Kibana数据视图 #

数据视图属于Kibana的Saved Object，有两种配置方式：

方式一：Kibana UI创建 #

端口转发访问Kibana后，进入Stack Management > Data Views，点击「Create data view」，设置索引模式（如logs-*或数据流logs），指定时间字段为@timestamp即可。

方式二：通过ECK导入Saved Object #

将数据视图的JSON配置嵌入到Kibana资源中：

apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
  name: quickstart
spec:
  version: 8.11.0
  count: 1
  elasticsearchRef:
    name: quickstart
  kibanaConfig:
    saved_objects:
      logs_data_view.json: |-
        [
          {
            "id": "logs-view",
            "type": "data_view",
            "attributes": {
              "title": "Logs",
              "index_patterns": ["logs-*"],
              "timeFieldName": "@timestamp",
              "fields": "*"
            }
          }
        ]

4. Kibana仪表板 #

仪表板同样是Saved Object，配置逻辑与数据视图一致：

UI创建与导入 #

在Kibana创建仪表板并添加可视化后，导出为NDJSON文件，通过Secret挂载到Kibana实例：

# 创建存储Saved Object的Secret
kubectl create secret generic kibana-dashboards --from-file=my_dashboard.ndjson

在Kibana资源中引用该Secret：

apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
  name: quickstart
spec:
  version: 8.11.0
  count: 1
  elasticsearchRef:
    name: quickstart
  podTemplate:
    spec:
      volumes:
      - name: dashboards
        secret:
          secretName: kibana-dashboards
      containers:
      - name: kibana
        volumeMounts:
        - name: dashboards
          mountPath: /usr/share/kibana/data/saved_objects
          readOnly: true

ECK会自动加载该目录下的Saved Object并导入到Kibana。

内容的提问来源于stack exchange，提问作者DevoPsky