Elasticsearch是基于Lucene分布式、实时查询的搜索分析引擎。我目前应用在日志集中化处理上。。。
01、下载elasticsearch5.4
02、jdk配置
03、修改系统参数
vi /etc/security/limits.conf #限制调整
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096
vi /etc/security/limits.d/90-nproc.conf
* soft nproc 2048
vi /etc/sysctl.conf #内核参数调整
vm.max_map_count=655350
sysctl -p #刷新参数，立即生效
04、建立elk用户
tar zxf elasticsearch-5.4.0.tar.gz
useradd elk
chown -R elk.elk elasticsearch-5.4.0
05、修改es配置
vim elasticsearch.yml
[root@25 config]# cat elasticsearch.yml
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
#默认下满的没写，默认true
#node.master: true
#node.data: true
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
#path.data: /path/to/data
#
# Path to log files:
#
#path.logs: /path/to/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#内核35.以下不支持内存锁定
bootstrap.memory_lock: false
bootstrap.system_call_filter: false
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 172.24.0.25
#
# Set a custom port for HTTP:
#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#多节点需要配置单播地址
#discovery.zen.ping.unicast.hosts: ["host1", "host2"]
#
# Prevent the "split brain" by configuring the majority of nodes (total number of master-eligibl
e nodes / 2 + 1):#
#discovery.zen.minimum_master_nodes: 3
#
# For more information, consult the zen discovery module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
配置虚拟内存
[root@25 config]# cat jvm.options
## JVM configuration
################################################################
## IMPORTANT: JVM heap size
################################################################
##
## You should always set the min and max JVM heap
## size to the same value. For example, to set
## the heap to 4 GB, set:
##
## -Xms4g
## -Xmx4g
##
## See https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html
## for more information
##
################################################################
# Xms represents the initial size of total heap space
# Xmx represents the maximum size of total heap space
#根据服务器的配置适当调整，后续还有GC的调整
-Xms1g
-Xmx1g
06、启动
su - elk
./bin/elasticsearch
[elk@25 elasticsearch-5.4.0]$ ./bin/elasticsearch
[2017-05-14T15:09:33,260][INFO ][o.e.n.Node ] [] initializing ...
[2017-05-14T15:09:33,411][INFO ][o.e.e.NodeEnvironment ] [db0Zha8] using [1] data paths, moun
ts [[/ (/dev/sda2)]], net usable_space [25.3gb], net total_space [38.3gb], spins? [possibly], types [ext4][2017-05-14T15:09:33,411][INFO ][o.e.e.NodeEnvironment ] [db0Zha8] heap size [1015.6mb], comp
ressed ordinary object pointers [true][2017-05-14T15:09:33,414][INFO ][o.e.n.Node ] node name [db0Zha8] derived from nod
e ID [db0Zha8iQzSDCMcBL8bqiA]; set [node.name] to override[2017-05-14T15:09:33,415][INFO ][o.e.n.Node ] version[5.4.0], pid[5685], build[780
f8c4/2017-04-28T17:43:27.229Z], OS[Linux/2.6.32-431.el6.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0_131/25.131-b11][2017-05-14T15:09:35,090][INFO ][o.e.p.PluginsService ] [db0Zha8] loaded module [aggs-matrix
-stats][2017-05-14T15:09:35,091][INFO ][o.e.p.PluginsService ] [db0Zha8] loaded module [ingest-comm
on][2017-05-14T15:09:35,091][INFO ][o.e.p.PluginsService ] [db0Zha8] loaded module [lang-expres
sion][2017-05-14T15:09:35,091][INFO ][o.e.p.PluginsService ] [db0Zha8] loaded module [lang-groovy
][2017-05-14T15:09:35,091][INFO ][o.e.p.PluginsService ] [db0Zha8] loaded module [lang-mustac
he][2017-05-14T15:09:35,092][INFO ][o.e.p.PluginsService ] [db0Zha8] loaded module [lang-painle
ss][2017-05-14T15:09:35,092][INFO ][o.e.p.PluginsService ] [db0Zha8] loaded module [percolator]
[2017-05-14T15:09:35,096][INFO ][o.e.p.PluginsService ] [db0Zha8] loaded module [reindex]
[2017-05-14T15:09:35,096][INFO ][o.e.p.PluginsService ] [db0Zha8] loaded module [transport-n
etty3][2017-05-14T15:09:35,096][INFO ][o.e.p.PluginsService ] [db0Zha8] loaded module [transport-n
etty4][2017-05-14T15:09:35,098][INFO ][o.e.p.PluginsService ] [db0Zha8] no plugins loaded
[2017-05-14T15:09:38,305][INFO ][o.e.d.DiscoveryModule ] [db0Zha8] using discovery type [zen]
[2017-05-14T15:09:39,494][INFO ][o.e.n.Node ] initialized
[2017-05-14T15:09:39,495][INFO ][o.e.n.Node ] [db0Zha8] starting ...
[2017-05-14T15:09:39,773][INFO ][o.e.t.TransportService ] [db0Zha8] publish_address {172.24.0.
25:9300}, bound_addresses {172.24.0.25:9300}[2017-05-14T15:09:39,794][INFO ][o.e.b.BootstrapChecks ] [db0Zha8] bound or publishing to a n
on-loopback or non-link-local address, enforcing bootstrap checks
测试
_cat命令
07、脚本
#!/bin/bash
#判断用户
if [ `id -u` -eq 0 ]; then
echo "Not permit root"
exit 1
fi
#启动
start(){
cd /xxx/elasticsearch-5.3.0 #es家目录
./bin/elasticsearch -d #后台运行
}
#关闭
stop(){
ps -ef | grep elasticsearch | grep -v grep |awk '{print $2}' |xargs kill -9
}
case "$1" in
start)
start
;;
stop)
stop
;;
*)
echo "Use $0 start | stop"
esac
#官方指导说明