flowchart TB
    subgraph Client["客户端层"]
        HTTP[HTTP/REST 客户端]
        TC[Transport Client]
        SDK[语言 SDK]
    end

    subgraph Gateway["网关层"]
        REST[REST API Handler]
        AUTH[认证/授权]
    end

    subgraph Coordination["协调层"]
        COORD[Coordinator<br/>集群协调器]
        MASTER[Master Service<br/>主节点服务]
        DISCO[Discovery<br/>节点发现]
    end

    subgraph Action["动作处理层"]
        AM[Action Module<br/>动作模块]
        TM[Task Manager<br/>任务管理器]
    end

    subgraph Core["核心业务层"]
        INDEX[Index Module<br/>索引模块]
        SEARCH[Search Module<br/>搜索模块]
        CLUSTER[Cluster Module<br/>集群管理模块]
        INGEST[Ingest Pipeline<br/>数据摄入管道]
    end

    subgraph Storage["存储引擎层"]
        ENGINE[Engine<br/>存储引擎]
        SHARD[Index Shard<br/>分片]
        LUCENE[Apache Lucene<br/>全文检索库]
        TRANSLOG[Translog<br/>事务日志]
    end

    subgraph Transport["传输层"]
        TS[Transport Service<br/>传输服务]
        TCP[TCP Transport]
        NETTY[Netty 网络框架]
    end

    subgraph Infra["基础设施层"]
        THREAD[Thread Pool<br/>线程池]
        BREAKER[Circuit Breaker<br/>熔断器]
        MONITOR[Monitor<br/>监控]
        GATEWAY[Gateway<br/>网关持久化]
    end

    HTTP --> REST
    TC --> TS
    SDK --> HTTP

    REST --> AUTH
    AUTH --> AM

    AM --> INDEX
    AM --> SEARCH
    AM --> CLUSTER
    AM --> INGEST

    COORD --> MASTER
    DISCO --> COORD
    CLUSTER --> COORD

    INDEX --> SHARD
    SEARCH --> SHARD
    SHARD --> ENGINE
    ENGINE --> LUCENE
    ENGINE --> TRANSLOG

    AM --> TM
    AM --> TS
    TS --> TCP
    TCP --> NETTY

    INDEX --> THREAD
    SEARCH --> THREAD
    ENGINE --> BREAKER
    COORD --> GATEWAY

    style Client fill:#e1f5ff
    style Gateway fill:#fff4e1
    style Coordination fill:#ffe1f5
    style Action fill:#f5e1ff
    style Core fill:#e1ffe1
    style Storage fill:#ffe1e1
    style Transport fill:#f5f5e1
    style Infra fill:#e1e1f5

sequenceDiagram
    autonumber
    participant Client as 客户端
    participant REST as REST Handler
    participant Action as Action Module
    participant Primary as Primary Shard
    participant Replica as Replica Shard
    participant Engine as Storage Engine
    participant Lucene as Lucene Index
    participant Translog as Transaction Log

    Client->>REST: POST /index/_doc/id<br/>{document}
    REST->>REST: 解析请求,验证参数
    REST->>Action: IndexRequest

    Action->>Action: 路由计算<br/>hash(routing) % num_primary_shards
    Action->>Primary: 转发到主分片节点

    Primary->>Primary: 版本检查,序列号分配
    Primary->>Engine: index(doc, seqNo, version)

    Engine->>Engine: 获取 UID 锁
    Engine->>Engine: 版本冲突检测

    alt 新文档
        Engine->>Lucene: addDocument(doc)
    else 更新文档
        Engine->>Lucene: updateDocument(uid, doc)
    end

    Engine->>Translog: append(operation)
    Translog-->>Engine: fsync (可选)
    Engine-->>Primary: IndexResult

    par 并行复制到副本
        Primary->>Replica: ReplicationRequest<br/>(doc, seqNo, version)
        Replica->>Engine: index(doc, seqNo, version)
        Engine->>Lucene: addDocument/updateDocument
        Engine->>Translog: append(operation)
        Translog-->>Engine: fsync (可选)
        Engine-->>Replica: success
        Replica-->>Primary: ACK
    end

    Primary-->>Action: IndexResponse<br/>(result, version, seqNo)
    Action-->>REST: success
    REST-->>Client: 201 Created<br/>{_id, _version, result}

sequenceDiagram
    autonumber
    participant Client as 客户端
    participant REST as REST Handler
    participant Action as Action Module
    participant Coord as Coordinating Node
    participant Shard1 as Shard 1
    participant Shard2 as Shard 2
    participant Lucene as Lucene Searcher

    Client->>REST: POST /index/_search<br/>{query, size, from}
    REST->>Action: SearchRequest
    Action->>Coord: 协调节点处理

    Coord->>Coord: 计算需要查询的分片<br/>(主分片或副本)

    par Query Phase - 并行查询所有分片
        Coord->>Shard1: SearchShardRequest
        Shard1->>Lucene: search(query, size+from)
        Lucene-->>Shard1: TopDocs(docIds, scores)
        Shard1-->>Coord: QueryResult<br/>(docIds, scores, aggr)
    and
        Coord->>Shard2: SearchShardRequest
        Shard2->>Lucene: search(query, size+from)
        Lucene-->>Shard2: TopDocs(docIds, scores)
        Shard2-->>Coord: QueryResult<br/>(docIds, scores, aggr)
    end

    Coord->>Coord: 归并排序所有分片结果<br/>取 Top (size)
    Coord->>Coord: 确定需要获取的文档<br/>(shardId, docId)

    par Fetch Phase - 并行获取文档内容
        Coord->>Shard1: FetchRequest<br/>(docIds[])
        Shard1->>Lucene: document(docId)
        Lucene-->>Shard1: Document
        Shard1-->>Coord: FetchResult<br/>(documents[])
    and
        Coord->>Shard2: FetchRequest<br/>(docIds[])
        Shard2->>Lucene: document(docId)
        Lucene-->>Shard2: Document
        Shard2-->>Coord: FetchResult<br/>(documents[])
    end

    Coord->>Coord: 组装最终结果<br/>(hits, aggregations, took)
    Coord-->>Action: SearchResponse
    Action-->>REST: success
    REST-->>Client: 200 OK<br/>{hits[], total, took, aggs}

sequenceDiagram
    autonumber
    participant Client as 管理客户端
    participant Master as Master Node
    participant Coord as Coordinator
    participant Cluster as Cluster Service
    participant Nodes as Data Nodes
    participant Gateway as Gateway

    Client->>Master: PUT /_cluster/settings<br/>{persistent: {...}}
    Master->>Cluster: ClusterStateUpdateTask

    Cluster->>Cluster: 加入队列<br/>(单线程执行)
    Cluster->>Cluster: execute(currentState)
    Cluster->>Cluster: 构建新的 ClusterState<br/>(version++)

    Cluster->>Gateway: persistMetaState(newState)
    Gateway->>Gateway: 写入磁盘<br/>(cluster metadata)
    Gateway-->>Cluster: success

    Cluster->>Coord: publish(newState)

    par 发布到所有节点
        Coord->>Nodes: PublishRequest<br/>(clusterState, version)
        Nodes->>Nodes: 验证版本号<br/>version > currentVersion
        Nodes->>Nodes: 应用新状态<br/>(原子替换)
        Nodes->>Nodes: 触发监听器<br/>(ClusterStateListener)
        Nodes-->>Coord: ACK
    end

    Coord->>Coord: 等待多数节点确认<br/>(quorum)

    opt 提交阶段
        Coord->>Nodes: Commit(version)
        Nodes->>Gateway: persistMetaState(newState)
        Nodes->>Nodes: 标记已提交
    end

    Coord-->>Cluster: PublishResponse
    Cluster-->>Master: ClusterStateUpdateResponse
    Master-->>Client: 200 OK<br/>{acknowledged: true}

flowchart TD
    REST[REST Layer] --> ACTION[Action Module]
    ACTION --> TRANSPORT[Transport Service]
    ACTION --> CLUSTER[Cluster Module]

    TRANSPORT --> TCP[TCP Transport]

    ACTION --> INDEX[Index Module]
    ACTION --> SEARCH[Search Module]

    INDEX --> SHARD[Index Shard]
    SEARCH --> SHARD

    SHARD --> ENGINE[Storage Engine]
    ENGINE --> LUCENE[Apache Lucene]
    ENGINE --> TRANSLOG[Translog]

    CLUSTER --> COORDINATOR[Coordinator]
    CLUSTER --> MASTER[Master Service]
    COORDINATOR --> TRANSPORT
    MASTER --> GATEWAY[Gateway]

    INDEX --> THREADPOOL[Thread Pool]
    SEARCH --> THREADPOOL
    TRANSPORT --> THREADPOOL

    ENGINE --> BREAKER[Circuit Breaker]
    SEARCH --> BREAKER

    style REST fill:#FFE4B5
    style ACTION fill:#98FB98
    style TRANSPORT fill:#87CEEB
    style INDEX fill:#DDA0DD
    style SEARCH fill:#F0E68C
    style CLUSTER fill:#FFA07A
    style ENGINE fill:#FF6347
    style LUCENE fill:#4682B4

# 下载并解压 Elasticsearch
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.11.0-linux-x86_64.tar.gz
tar -xzf elasticsearch-8.11.0-linux-x86_64.tar.gz
cd elasticsearch-8.11.0

# 配置单节点模式
cat > config/elasticsearch.yml <<EOF
cluster.name: my-cluster
node.name: node-1
network.host: 0.0.0.0
discovery.type: single-node
xpack.security.enabled: false
EOF

# 启动节点
./bin/elasticsearch

# 创建索引
curl -X PUT "localhost:9200/products" -H 'Content-Type: application/json' -d'
{
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 0
  },
  "mappings": {
    "properties": {
      "name": { "type": "text" },
      "price": { "type": "double" },
      "category": { "type": "keyword" },
      "created_at": { "type": "date" }
    }
  }
}'

# 索引文档
curl -X POST "localhost:9200/products/_doc" -H 'Content-Type: application/json' -d'
{
  "name": "Laptop",
  "price": 999.99,
  "category": "Electronics",
  "created_at": "2024-01-01T10:00:00Z"
}'

# 搜索文档
curl -X GET "localhost:9200/products/_search" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match": {
      "name": "laptop"
    }
  }
}'

public class MyAnalysisPlugin extends Plugin implements AnalysisPlugin {

    @Override
    public Map<String, AnalysisProvider<TokenFilterFactory>> getTokenFilters() {
        return Collections.singletonMap("my_filter", MyTokenFilterFactory::new);
    }
}

public class MyTokenFilterFactory extends AbstractTokenFilterFactory {

    public MyTokenFilterFactory(IndexSettings indexSettings,
                                Environment environment,
                                String name,
                                Settings settings) {
        super(name, settings);
    }

    @Override
    public TokenStream create(TokenStream tokenStream) {
        return new MyTokenFilter(tokenStream);
    }
}

public class MyAggregationPlugin extends Plugin implements SearchPlugin {

    @Override
    public List<AggregationSpec> getAggregations() {
        return Collections.singletonList(
            new AggregationSpec(
                "my_agg",
                MyAggregationBuilder::new,
                MyAggregationBuilder.PARSER
            ).addResultReader(InternalMyAggregation::new)
        );
    }
}

# 安装插件
./bin/elasticsearch-plugin install file:///path/to/my-plugin.zip

# 验证插件
./bin/elasticsearch-plugin list

# 移除插件
./bin/elasticsearch-plugin remove my-plugin

# jvm.options
-Xms31g
-Xmx31g
-XX:+UseG1GC
-XX:G1ReservePercent=25
-XX:InitiatingHeapOccupancyPercent=30

# 关闭 swap
sudo swapoff -a

# 增加文件描述符限制
ulimit -n 65535

# 增加虚拟内存区域
sysctl -w vm.max_map_count=262144

# 禁用 THP (Transparent Huge Pages)
echo never > /sys/kernel/mm/transparent_hugepage/enabled

# elasticsearch.yml (生产环境三节点集群)
cluster.name: prod-cluster
node.name: ${HOSTNAME}
node.roles: [master, data, ingest]

# 网络配置
network.host: 0.0.0.0
http.port: 9200
transport.port: 9300

# 发现配置
discovery.seed_hosts:
  - 10.0.0.1:9300
  - 10.0.0.2:9300
  - 10.0.0.3:9300
cluster.initial_master_nodes:
  - node-1
  - node-2
  - node-3

# 路径配置
path.data: /data/elasticsearch
path.logs: /var/log/elasticsearch

# 内存配置
indices.memory.index_buffer_size: 20%
indices.queries.cache.size: 15%

# 线程池配置
thread_pool.write.queue_size: 1000
thread_pool.search.queue_size: 2000

{
  "index_patterns": ["logs-*"],
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1,
    "refresh_interval": "5s",
    "index.translog.durability": "async",
    "index.translog.sync_interval": "5s"
  },
  "mappings": {
    "properties": {
      "timestamp": {
        "type": "date"
      },
      "message": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      }
    }
  }
}

# 检查集群健康
curl -X GET "localhost:9200/_cluster/health?pretty"

# 检查节点统计
curl -X GET "localhost:9200/_nodes/stats?pretty"

# 检查索引统计
curl -X GET "localhost:9200/_stats?pretty"

# 检查慢查询日志
tail -f /var/log/elasticsearch/prod-cluster_index_search_slowlog.log

# 配置快照仓库
curl -X PUT "localhost:9200/_snapshot/my_backup" -H 'Content-Type: application/json' -d'
{
  "type": "fs",
  "settings": {
    "location": "/mount/backups/elasticsearch"
  }
}'

# 创建快照
curl -X PUT "localhost:9200/_snapshot/my_backup/snapshot_1?wait_for_completion=true"

# 恢复快照
curl -X POST "localhost:9200/_snapshot/my_backup/snapshot_1/_restore"