ELK -- ElasticSearch集群安装、配置及错误处理

ElasticSearch

现有三台服务器[192.168.1.30, 192.168.1.31, 192.168.1.32],使用这三台服务器搭建ElasticSearch集群

CentOS 使用 yum 安装

编辑 repo

vim /etc/yum.repos.d/elasticsearch.repo

# 内容如下

[elasticsearch-6.x]
name=Elasticsearch repository for 6.x packages
baseurl=https://artifacts.elastic.co/packages/6.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

使用yum安装

yum install elasticsearch

创建用户

useradd elastic

修改权限

# 数据
chown -R elastic:elastic /var/lib/elasticsearch

# 日志
chown -R elastic:elastic /var/log/elasticsearch

# 配置
chown -R elastic:elastic /etc/elasticsearch
chown -R elastic:elastic /etc/sysconfig/elasticsearch

# 指令
chown -R elastic:elastic /usr/share/elasticsearch

配置

# 主节点 192.168.1.30

vim /etc/elasticsearch/elasticsearch.yml

# 修改以下几项

cluster.name: etl_es

node.name: node-30
node.master: true
node.data: false

bootstrap.memory_lock: false
bootstrap.system_call_filter: false

network.host: 0.0.0.0
http.port: 9200
http.cors.enabled: true
http.cors.allow-origin: "*"

discovery.zen.ping.unicast.hosts: ["192.168.1.30"]

# 从节点 192.168.1.31

vim /etc/elasticsearch/elasticsearch.yml

# 修改以下几项

cluster.name: etl_es

node.name: node-31
node.master: false
node.data: true

bootstrap.memory_lock: false
bootstrap.system_call_filter: false

network.host: 0.0.0.0
http.port: 9200
http.cors.enabled: true
http.cors.allow-origin: "*"

discovery.zen.ping.unicast.hosts: ["192.168.1.30"]

# 从节点 192.168.1.32

vim /etc/elasticsearch/elasticsearch.yml

# 修改以下几项
# 其他项配置与1.31配置相同

node.name: node-32

启动 参数-d为后台运行(测试通过后 可加上此参数)

su elastic
/usr/share/elasticsearch/bin/elasticsearch -d

可能遇到的错误

ERROR: [4] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
[2]: max number of threads [1024] for user [elastic] is too low, increase to at least [4096]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[4]: system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk



# 解决
1. 首先切换到root身份
2. 针对 问题[1]

    vim /etc/security/limits.conf
    # 添加以下内容:
        * soft nofile 65536
        * hard nofile 131072
        * soft nproc 2048
        * hard nproc 4096

3. 针对 问题[2]
    vim /etc/security/limits.d/90-nproc.conf
    修改"* soft nproc 1024"为"* soft nproc 4096"

4. 针对 问题[3]
    # 编辑
    vim /etc/sysctl.conf 
    #添加如下内容:
    vm.max_map_count=655360
    # 执行
    sysctl -p

5. 针对 问题[4]
    编辑 /etc/elasticsearch/elasticsearch.yml, Memory下修改:
        bootstrap.memory_lock: false
        bootstrap.system_call_filter: false