ELK集群搭建过程记录—7.6.2版本

搭建过程

1、Elasticsearch集群搭建

2、Cerebro插件安装

    tar -zxvf cerebro-0.9.1.tgz                             解压cerebro压缩包

    配置cerebro文件夹下 application.conf          配置集群的地址

   ./cerebro -Dhttp.port=8080                            启动cerebro插件，配置端口

    nohup ./cerebro -Dhttp.port=8080 &             解决ctrl+c退出的问题

    http://127.0.0.1:8080/#/connect                    插件浏览器访问地址

    http://127.0.0.1:9200                                    连接集群的地址

3、Kibana安装

4、Kibana管理Elasticsearch

搭建过程中遇到的问题汇总（更新中）

1、Cerebro无法访问

2、ES集群脑裂问题

     ES集群搭建了3个节点，node-1、node-2、node-3，搭建完以后，在cerebro中进行查看，生成了2个集群，node-1自己成了一个集群，node-2、node-3这2个节点成了一个集群

org.elasticsearch.transport.RemoteTransportException: [node-2][127.0.0.1:9300][internal:cluster/coordination/join/validate]
Caused by: org.elasticsearch.cluster.coordination.CoordinationStateRejectedException: join validation on cluster state with a different cluster uuid E4a-eGNOSCG7_VDmzQPs8w than local cluster uuid RluWhBm3RA-nOJzKIP-NSw, rejecting

org.elasticsearch.transport.RemoteTransportException: [node-2][127.0.0.1:9300][internal:cluster/coordination/join]
Caused by: org.elasticsearch.cluster.coordination.CoordinationStateRejectedException: incoming term 44 does not match current term 45

尝试解决：重启，修改elasticsearch.yml配置参数，都没解决

最后解决方法：删除data文件夹
原因：因为该节点之前启动过ES，已经创建了data文件夹，与要加入的集群冲突。

3、kibana启动报错问题

  log   [09:21:17.452] [warning][savedobjects-service] Unable to connect to Elasticsearch. Error: [resource_already_exists_exception] index [.kibana_1/-eb6AR3SQ3usPaLJN76t5w] already exists, with { index_uuid="-eb6AR3SQ3usPaLJN76t5w" & index=".kibana_1" }
  log   [09:21:17.453] [warning][savedobjects-service] Another Kibana instance appears to be migrating the index. Waiting for that migration to complete. If no other Kibana instance is attempting migrations, you can get past this message by deleting index .kibana_1 and restarting Kibana.
  log   [09:21:17.493] [info][savedobjects-service] Creating index .kibana_task_manager_1.
  log   [09:21:17.496] [warning][savedobjects-service] Unable to connect to Elasticsearch. Error: [resource_already_exists_exception] index [.kibana_task_manager_1/whkoKPqJSYGAzgXMGxQXbQ] already exists, with { index_uuid="whkoKPqJSYGAzgXMGxQXbQ" & index=".kibana_task_manager_1" }
  log   [09:21:17.497] [warning][savedobjects-service] Another Kibana instance appears to be migrating the index. Waiting for that migration to complete. If no other Kibana instance is attempting migrations, you can get past this message by deleting index .kibana_task_manager_1 and restarting Kibana.
 Generating a random key for xpack.encryptedSavedObjects.encryptionKey. To be able to decrypt encrypted saved objects attributes after restart, please set xpack.encryptedSavedObjects.encryptionKey in kibana.yml

解决方法：在elastic中删除kibana的索引

cd /u02/tomcat/elasticsearch-7.6.2
curl -XDELETE http://127.0.0.1:9200/.kibana*

原因：索引已经存在

4、kibana链接无法访问

kibana启动后，http://127.0.0.1:5601访问不了

解决方法：把端口号修改为8088

访问链接：http://127.0.0.1:8088

5、kibana中如何管理ES的索引，并进行对应关联