使用 Amazon EventBridge 監控 OpenSearch Service 事件 - Amazon OpenSearch Service

使用 Amazon EventBridge 監控 OpenSearch Service 事件

Amazon OpenSearch Service 與 Amazon EventBridge 整合,可通知您影響您的網域的特定事件。AWS 服務的事件會以接近即時的方式傳送到 EventBridge。相同的事件也會傳送至 Amazon CloudWatch Events,或 Amazon EventBridge 的前身產品。您可編寫簡單的規則,來指示您在意的事件,以及當事件符合規則時所要自動執行的動作。可以自動觸發的動作如下:

  • 呼叫 AWS Lambda 函數

  • 叫用 Amazon EC2 執行命令

  • 將事件轉傳至 Amazon Kinesis Data Streams

  • 啟動 AWS Step Functions 狀態機器

  • 通知 Amazon SNS 主題或 Amazon SQS 佇列

如需詳細資訊,請參閱 Amazon EventBridge 使用者指南中的 Amazon EventBridge 入門

服務軟體更新事件

當以下其中一個服務軟體更新事件發生時,OpenSearch Service 會將事件傳送至 EventBridge。

可用的服務軟體更新

OpenSearch Service 會在服務軟體更新可用時傳送此事件。

範例

以下為此類事件的範例:

{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Amazon OpenSearch Service Software Update Notification", "source": "aws.es", "account": "123456789012", "time": "2016-11-01T13:12:22Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Service Software Update", "status": "Available", "severity": "Informational", "description": "Service software update [R20200330-p1] available." } }

服務軟體更新已開始

OpenSearch Service 會在服務軟體更新已開始時傳送此事件。

範例

以下為此類事件的範例:

{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Amazon OpenSearch Service Software Update Notification", "source": "aws.es", "account": "123456789012", "time": "2016-11-01T13:12:22Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Service Software Update", "status": "Started", "severity": "Informational", "description": "Service software update [R20200330-p1] started." } }

服務軟體更新已完成

OpenSearch Service 會在服務軟體更新已完成時傳送此事件。

範例

以下為此類事件的範例:

{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Amazon OpenSearch Service Software Update Notification", "source": "aws.es", "account": "123456789012", "time": "2016-11-01T13:12:22Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Service Software Update", "status": "Completed", "severity": "Informational", "description": "Service software update [R20200330-p1] completed." } }

服務軟體更新已失敗

OpenSearch Service 會在服務軟體更新已失敗時傳送此事件。

範例

以下為此類事件的範例:

{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Amazon OpenSearch Service Software Update Notification", "source": "aws.es", "account": "123456789012", "time": "2016-11-01T13:12:22Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Service Software Update", "status": "Failed", "severity": "Medium", "description": "Service software update [R20200330-p1] failed." } }

需要服務軟體更新

OpenSearch Service 會在需要服務軟體更新時傳送此事件。

範例

以下為此類事件的範例:

{ "version": "0", "id": "01234567-0123-0123-0123-012345678901", "detail-type": "Amazon OpenSearch Service Software Update Notification", "source": "aws.es", "account": "123456789012", "time": "2016-11-01T13:12:22Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Service Software Update", "status": "Required", "severity": "High", "description": "Service software update [R20200330-p1] available. Update will be automatically installed after [30/04/2020] if no action is taken." } }

自動調整事件

當以下其中一個自動調整事件發生時,OpenSearch Service 會將事件傳送至 EventBridge。

自動調整待定

當「自動調整」已找到可改善叢集效能和可用性的調整建議時,OpenSearch Service 會傳送此事件。您只能在已停用「自動調整」的網域中看到此事件。

範例

以下為此類事件的範例:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Auto-Tune Event", "severity": "Informational", "status": "Pending", "description": "Auto-Tune recommends new settings for your domain. Enable Auto-Tune to improve cluster stability and performance.", "scheduleTime": "{iso8601-timestamp}" } }

自動調整已開始

當「自動調整」開始將新設定套用至您的網域時,OpenSearch Service 會傳送此事件。

範例

以下為此類事件的範例:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Auto-Tune Events", "severity": "Informational", "status": "Started", "scheduleTime": "{iso8601-timestamp}", "startTime": "{iso8601-timestamp}", "description" : "Auto-Tune is applying new settings to your domain." } }

自動調整需要排程的藍/綠部署

當「自動調整」已找到需要排程藍/綠部署的調整建議時,OpenSearch Service 會傳送此事件。

範例

以下為此類事件的範例:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Auto-Tune Event", "severity": "Low", "status": "Pending", "startTime": "{iso8601-timestamp}", "description": "Auto-Tune has identified new settings for your domain that require a blue/green deployment. You can schedule the deployment for your preferred time." } }

自動調整已取消

當「自動調整」排程因為沒有待定調整建議而取消時,OpenSearch Service 會傳送此事件。

範例

以下為此類事件的範例:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Auto-Tune Event", "severity": "Low", "status": "Cancelled", "scheduleTime": "{iso8601-timestamp}", "description": "Auto-Tune has cancelled the upcoming blue/green deployment." } }

自動調整已完成

當「自動調整」已完成藍/綠部署,且叢集正在使用新 JVM 設定運作時,OpenSearch Service 會傳送此事件。

範例

以下為此類事件的範例:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Auto-Tune Event", "severity": "Informational", "status": "Completed", "completionTime": "{iso8601-timestamp}", "description": "Auto-Tune has completed the blue/green deployment and successfully applied the updated settings." } }

自動調整已停用且變更已還原

當「自動調整」已停用且套用的變更已復原時,OpenSearch Service 會傳送此事件。

範例

以下為此類事件的範例:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": [ "arn:aws:es:us-east-1:123456789012:domain/test-domain" ], "detail": { "event": "Auto-Tune Event", "severity": "Informational", "status": "Completed", "description": "Auto-Tune is now disabled. All settings have been reverted. Auto-Tune will continue to evaluate cluster performance and provide recommendations.", "completionTime": "{iso8601-timestamp}" } }

自動調整已停用且變更已保留

當「自動調整」已停用且套用的變更已保留時,OpenSearch Service 會傳送此事件。

範例

以下為此類事件的範例:

{ "version": "0", "id": "3acb26c8-397c-4c89-a80a-ce672a864c55", "detail-type": "Amazon OpenSearch Service Auto-Tune Notification", "source": "aws.es", "account": "123456789012", "time": "2020-10-30T22:06:31Z", "region": "us-east-1", "resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail": { "event": "Auto-Tune Event", "severity": "Informational", "status": "Completed", "description": "Auto-Tune is now disabled. The most-recent settings by Auto-Tune have been retained. Auto-Tune will continue to evaluate cluster performance and provide recommendations.", "completionTime": "{iso8601-timestamp}" } }

叢集運作狀態事件

OpenSearch Service 會在叢集運作狀態受影響時,向 EventBridge 傳送特定事件。

紅色叢集恢復已啟動

OpenSearch Service 會在您的叢集狀態連續為紅色超過一小時後發送此事件。其會嘗試自動從快照中恢復一個或多個紅色索引,以修復叢集狀態。

範例

以下為此類事件的範例:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Cluster Status Notification", "source":"aws.es", "account":"123456789012", "time":"2016-11-01T13:12:22Z", "region":"us-east-1", "resources":[ "arn:aws:es:us-east-1:123456789012:domain/test-domain" ], "detail":{ "event":"Automatic Snapshot Restore for Red Indices", "status":"Started", "Severity":"High", "description":"Your cluster status is red. We have started automatic snapshot restore for the red indices. No action is needed from your side. Red indices [red-index-0, red-index-1]" } }

紅色叢集恢復部分完成

當 OpenSearch Service 在嘗試修復紅色叢集狀態時,若只能從快照恢復紅色索引的子集,即會發送此事件。

範例

以下為此類事件的範例:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Cluster Status Notification", "source":"aws.es", "account":"123456789012", "time":"2016-11-01T13:12:22Z", "region":"us-east-1", "resources":[ "arn:aws:es:us-east-1:123456789012:domain/test-domain" ], "detail":{ "event":"Automatic Snapshot Restore for Red Indices", "status":"Partially Restored", "Severity":"High", "description":"Your cluster status is red. We were able to restore the following Red indices from snapshot: [red-index-0]. Indices not restored: [red-index-1]. Please refer https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-red-cluster-status for troubleshooting steps." } }

紅色叢集恢復失敗

當 OpenSearch Service 在嘗試修復紅色叢集狀態時,若無法恢復任何索引,即會發送此事件。

範例

以下為此類事件的範例:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Cluster Status Notification", "source":"aws.es", "account":"123456789012", "time":"2016-11-01T13:12:22Z", "region":"us-east-1", "resources":[ "arn:aws:es:us-east-1:123456789012:domain/test-domain" ], "detail":{ "event":"Automatic Snapshot Restore for Red Indices", "status":"Failed", "Severity":"High", "description":"Your cluster status is red. We were unable to restore the Red indices automatically. Indices not restored: [red-index-0, red-index-1]. Please refer https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-red-cluster-status for troubleshooting steps." } }

待刪除的碎片

當 OpenSearch Service 嘗試自動修復連續 14 天為紅色的紅色叢集狀態後,若仍有一個或多個索引保持紅色狀態,即會發送此事件。再經過 7 天(總共 21 天連續紅色)後,OpenSearch Service 將著手在所有紅色索引進行刪除未指派的碎片

範例

以下為此類事件的範例:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Cluster Status Notification", "source":"aws.es", "account":"123456789012", "time":"2022-04-09T10:36:48Z", "region":"us-east-1", "resources":[ "arn:aws:es:us-east-1:123456789012:domain/test-domain" ], "detail":{ "severity":"Medium", "description":"Your cluster status is red. Please fix the red indices as soon as possible. If not fixed by 2022-04-12 01:51:47+00:00, we will delete all unassigned shards, the unit of storage and compute, for these red indices to recover your domain and make it green. Please refer to https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-red-cluster-status for troubleshooting steps. test_data, test_data1", "event":"Automatic Snapshot Restore for Red Indices", "status":"Shard(s) to be deleted" } }

碎片已刪除

OpenSearch Service 會在您的叢集狀態連續為紅色超過 21 天後發送此事件。其會著手刪除所有紅色索引上的未指派碎片(儲存和運算)。如需詳細資訊,請參閱紅色叢集的自動修復

範例

以下為此類事件的範例:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Cluster Status Notification", "source":"aws.es", "account":"123456789012", "time":"2022-04-09T10:54:48Z", "region":"us-east-1", "resources":[ "arn:aws:es:us-east-1:123456789012:domain/test-domain" ], "detail":{ "severity":"High", "description":"We have deleted unassinged shards, the unit of storage and compute, in red indices: index-1, index-2 because these indices were red for more than 21 days and could not be restored with the automated restore process. Please refer to https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-red-cluster-status for troubleshooting steps.", "event":"Automatic Snapshot Restore for Red Indices", "status":"Shard(s) deleted" } }

高碎片計數警告

在熱資料節點的平均碎片計數超過建議預設限制 (1,000) 的 90% 時,OpenSearch Service 便會傳送此事件。雖然較高版本的 Elasticsearch 和 OpenSearch 支援可設定之每節點最大碎片數限制,但我們建議每個節點不要超過 1,000 個碎片。請參閱選擇碎片數

範例

以下為此類事件的範例:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Notification", "source":"aws.es", "account":"123456789012", "time":"2016-11-01T13:12:22Z", "region":"us-east-1", "resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail":{ "event":"High Shard Count", "status":"Warning", "severity":"Low", "description":"One or more data nodes have close to 1000 shards. To ensure optimum performance and stability of your cluster, please refer to the best practice guidelines - https://docs.aws.amazon.com/opensearch-service/latest/developerguide/sizing-domains.html#bp-sharding." } }

已超過碎片數量限制

在熱資料節點的平均碎片計數超過建議預設限制 (1,000) 時,OpenSearch Service 便會傳送此事件。雖然較高版本的 Elasticsearch 和 OpenSearch 支援可設定之每節點最大碎片數限制,但我們建議每個節點不要超過 1,000 個碎片。請參閱選擇碎片數

範例

以下為此類事件的範例:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Notification", "source":"aws.es", "account":"123456789012", "time":"2016-11-01T13:12:22Z", "region":"us-east-1", "resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail":{ "event":"High Shard Count", "status":"Warning", "severity":"Medium", "description":"One or more data nodes have more than 1000 shards. To ensure optimum performance and stability of your cluster, please refer to the best practice guidelines - https://docs.aws.amazon.com/opensearch-service/latest/developerguide/sizing-domains.html#bp-sharding." } }

磁碟空間不足

在叢集中一個或多個節點的可用儲存空間少於 25% 或小於 25 GB 時,OpenSearch Service 便會傳送此事件。

範例

以下為此類事件的範例:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Amazon OpenSearch Service Notification", "source":"aws.es", "account":"123456789012", "time":"2017-12-01T13:12:22Z", "region":"us-east-1", "resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail":{ "event":"Low Disk Space", "status":"Warning", "severity":"Medium", "description":"One or more data nodes in your cluster has less than 25% of storage space or less than 25GB. Your cluster will be blocked for writes at 20% or 20GB. Please refer to the documentation for more information - https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#troubleshooting-cluster-block" } }

網域錯誤事件

當發生以下其中一個網域錯誤時,OpenSearch Service 會將事件傳送至 EventBridge。

無法存取 KMS 金鑰

OpenSearch Service 會在無法存取 AWS KMS 金鑰時傳送此事件。

範例

以下為此類事件的範例:

{ "version":"0", "id":"01234567-0123-0123-0123-012345678901", "detail-type":"Domain Error Notification", "source":"aws.es", "account":"123456789012", "time":"2016-11-01T13:12:22Z", "region":"us-east-1", "resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"], "detail":{ "event":"KMS Key Inaccessible", "status":"Error", "severity":"High", "description":"The KMS key associated with this domain is inaccessible. You are at risk of losing access to your domain. For more information, please refer https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html#disabled-key." } }