ELK

注意：Elasticsearch-6.8.13 运行需要安装jdk1.8+

#创建es用户，Elasticsearch不支持root用户运行
useradd es
#创建文件夹
mkdir /usr/elasticsearch
#上传Elasticsearch 到/usr/elasticsearch，并解压安装包
cd /usr/elasticsearch
tar xvf elasticsearch-6.8.13.tar.gz

#修改机器的配置文件
#说明：在Elasticsearch中如果，network.host不是localhost或者127.0.0.1的话，就会认为是生产环境，
会对环境的要求比较高，我们的测试环境不一定能够满足，一般情况下需要修改2处配置，如下：
#1：修改jvm启动参数
cd /usr/elasticsearch/elasticsearch-6.8.13/config
vim jvm.options
-Xms128m #根据自己机器情况修改
-Xmx128m
#2：一个进程在VMAs(虚拟内存区域)创建内存映射最大数量
vim /etc/sysctl.conf
vm.max_map_count=655360
sysctl -p #配置生效

#修改配置文件
cd /usr/elasticsearch/elasticsearch-6.8.13/config
vi elasticsearch.yml

#node01的配置：
cluster.name: es-cluster
node.name: node01
node.master: true
node.data: true
network.host: 0.0.0.0    
http.port: 9200
discovery.zen.ping.unicast.hosts: ["192.168.50.150","192.168.50.151","192.168.50.152"]
discovery.zen.minimum_master_nodes: 2
http.cors.enabled: true
http.cors.allow-origin: "*"

#node02的配置：
cluster.name: es-cluster
node.name: node02
node.master: true
node.data: true
network.host: 0.0.0.0
http.port: 9200
discovery.zen.ping.unicast.hosts: ["192.168.50.150","192.168.50.151","192.168.50.152"]
discovery.zen.minimum_master_nodes: 2
http.cors.enabled: true
http.cors.allow-origin: "*"

#node03的配置：
cluster.name: es-cluster
node.name: node03
node.master: true
node.data: true
network.host: 0.0.0.0
http.port: 9200
discovery.zen.ping.unicast.hosts: ["192.168.50.150","192.168.50.151","192.168.50.152"]
discovery.zen.minimum_master_nodes: 2
http.cors.enabled: true
http.cors.allow-origin: "*"

#启动ES服务
su es;
cd /usr/elasticsearch/elasticsearch-6.8.13/bin
./elasticsearch 或 ./elasticsearch -d #后台启动

#安装过程可能出现的问题及解决方案
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at
least [65536]
#解决：切换到root用户，编辑limits.conf 添加类似如下内容
vi /etc/security/limits.conf
添加如下内容:
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096

[2]: max number of threads [1024] for user [elsearch] is too low, increase to at least
[4096]
#解决：切换到root用户，进入limits.d目录下修改配置文件。
vi /etc/security/limits.d/90-nproc.conf
#修改如下内容：
* soft nproc 1024
#修改为
* soft nproc 4096

[3]: system call filters failed to install; check the logs and fix your configuration
or disable system call filters at your own risk
#解决：Centos6不支持SecComp，而ES5.2.0默认bootstrap.system_call_filter为true
cd /usr/elasticsearch/elasticsearch-6.8.13/config;
vim elasticsearch.yml
添加：
bootstrap.system_call_filter: false

[4]java.nio.file.AccessDeniedException: /usr/elasticsearch/elasticsearch-6.4.2/config/jvm.options
切换到root，给es授权
su root;  #输入密码
chown -R es /usr/elasticsearch/elasticsearch-6.4.2

注意事项：关闭防火墙，以免访问受限
1:查看防火状态
systemctl status firewalld
service  iptables status
2:暂时关闭防火墙
systemctl stop firewalld
service  iptables stop
3:永久关闭防火墙
systemctl disable firewalld
chkconfig iptables off
4:重启防火墙
systemctl enable firewalld
service iptables restart