ElasticSearch配置文档(v1.7.2)

ElasticSearch

安装java环境

  • sudo apt-get update
  • java -version
  • sudo apt-get install default-jre
  • sudo apt-get install default-jdk
  • (或者: yum -y install java-1.7.0-openjdk* )

设置JAVA_HOME

  • sudo update-alternatives --config java(返回YOUR_PATH)
  • sudo nano /etc/environment
  • JAVA_HOME="YOUR_PATH"
  • source /etc/environment
  • echo $JAVA_HOME

安装ElasticSearch(以1.7.2为例)


启动ElasticSearch

  • sudo service elasticsearch start
  • elasticsearch 结构目录位置: /var/lib/elasticsearch

配置ElasticSearch


配置防火墙

  • sudo ufw disable
  • sudo ufw allow from 192.168.1.141
  • sudo ufw enable

或者防火墙

 

#/usr/sbin/iptables -I INPUT -p tcp --dport 80 -j ACCEPT

#/usr/sbin/iptables -I INPUT -p tcp --dport 22 -j ACCEPT

#/usr/sbin/iptables -I INPUT -p tcp --dport 3306 -j ACCEPT

#/usr/sbin/iptables -I INPUT -p tcp --dport 8080 -j ACCEPT

 

/usr/sbin/iptables -I INPUT -p tcp --dport 9200 -j DROP

/usr/sbin/iptables -I INPUT -s 10.44.136.154 -p tcp --dport 9200 -j ACCEPT

/usr/sbin/iptables -I INPUT -s 某个ip -p tcp --dport 9200 -j ACCEPT

/usr/sbin/iptables -I INPUT -s 某个ip -p tcp --dport 9200 -j ACCEPT

 

 

/usr/sbin/service iptables save


创建快照

  • elasticsearch.yml添加: path.repo: ["/mount/backups", "/mount/longterm_backups"]
  • 创建目录: /mount/backups/my_backup,  /mount/longterm_backups
  • 添加权限: sudo chmod -R 777 /mount
  • 重启elasticsearch服务: sudo service elasticsearch restart
  • 创建仓库,并指定仓库类型:

curl -XPUT 'http://localhost:9200/_snapshot/my_backup' -d '

"type": "fs", 

"settings": { 

                "location": "/mount/backups/my_backup",

                "compress": true 

}

}'

 

curl -XPOST http://localhost:9200/_snapshot/my_backup/snapshot_1/_restore -d '

{

"indices": "index_1,index_2", 

"ignore_unavailable": "true",

"include_global_state": false, 

"rename_pattern": "index_(.+)", 

"rename_replacement": "restored_index_$1"

}'


配置ik分词

  • 版本参考
IK versionES version
master2.1.0 -> master
1.6.02.1.0
1.5.02.0.0
1.4.11.7.2
1.4.01.6.0
1.3.01.5.0
1.2.91.4.0
1.2.81.3.2
1.2.71.2.1
1.2.61.0.0
1.2.50.90.2
1.2.30.90.2
1.2.00.90.0
1.1.30.20.2
1.1.20.19.x
1.0.00.16.2 -> 0.19.0
  • checkout对应tag:  git checkout tags/v1.4.1 -b v1.4.1
  • 安装maven: (略)
  • 编译jar包: sudo mvn package
  • copy ik文件夹到/etc/elasticsearch/: sudo cp config/ik /etc/elasticsearch/ 
  • copy jar到/usr/share/elasticsearch/lib/: sudo cp target/*.jar /usr/share/elasticsearch/lib
  • 配置elasticsearch.yml
index:
  analysis:
    analyzer:
      ik:
        alias: [ik_analyzer]
        type: org.elasticsearch.index.analysis.IkAnalyzerProvider
      ik_max_word:
        type: ik
        use_smart: false
      ik_smart:
        type: ik
        use_smart: true

index.analysis.analyzer.default.type : "ik"
  • 创建index:  
curl -XPUT http://localhost:9200/index
  • 创建mapping
curl -XPOST http://localhost:9200/index/fulltext/_mapping -d'
{
    "fulltext": {
             "_all": {
            "analyzer": "ik_max_word",
            "search_analyzer": "ik_max_word",
            "term_vector": "no",
            "store": "false"
        },
        "properties": {
            "content": {
                "type": "string",
                "store": "no",
                "term_vector": "with_positions_offsets",
                "analyzer": "ik_max_word",
                "search_analyzer": "ik_max_word",
                "include_in_all": "true",
                "boost": 8
            }
        }
    }
}'

  mapping:

 

curl -XPUT localhost:9200/feiliwu -d '{

"mappings":{

     "product":{

            "_timestamp":{

                    "enables": true

             }

      }

}

 

}'


  • 录入数据
curl -XPOST http://localhost:9200/index/fulltext/1 -d'
{"content":"美国留给伊拉克的是个烂摊子吗"}
'
curl -XPOST http://localhost:9200/index/fulltext/2 -d'
{"content":"公安部:各地校车将享最高路权"}
'
curl -XPOST http://localhost:9200/index/fulltext/3 -d'
{"content":"中韩渔警冲突调查:韩警平均每天扣1艘中国渔船"}
'
curl -XPOST http://localhost:9200/index/fulltext/4 -d'
{"content":"中国驻洛杉矶领事馆遭亚裔男子枪击 嫌犯已自首"}
'
  • 查询
curl -XPOST http://localhost:9200/index/fulltext/_search  -d'
{
    "query" : { "term" : { "content" : "中国" }},
    "highlight" : {
        "pre_tags" : ["<tag1>", "<tag2>"],
        "post_tags" : ["</tag1>", "</tag2>"],
        "fields" : {
            "content" : {}
        }
    }
}
'

 


安装Marvel


参考资料


      Logstash

下载安装


配置jdk

  • sudo nano  /etc/profile

 

export JAVA_HOME=/usr/lib/jvm/java-7-openjdk-amd64

export CLASSPATH=.:$JAVA_HOME/jre/lib/rt.jar

export PATH=$PATH:$JAVA_HOME/bin

export LOGSTASH_HOME=/opt/logstash

export LOGSTASH=$LOGSTASH_HOME/bin

export PATH=$LOGSTASH:$PATH

 

  • source /etc/profile

  配置logstash

  • sudo nano /etc/logstash/conf.d/logstash-simple.conf

 

 

 

input {

 

  tcp {

    port => 5000

    type => syslog

  }

  udp {

    port => 5000

    type => syslog

  }

}

filter {

  if [type] == "syslog" {

    grok {

      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }

      add_field => [ "received_at", "%{@timestamp}" ]

      add_field => [ "received_from", "%{host}" ]

    }

    syslog_pri { }

    date {

      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]

    }

  }

}

output {

    elasticsearch {

        protocol => "http"

        host => "localhost:9200"

    }

    stdout { }

}

 

 

 

 


启动logstash

  • sudo service logstash status
  • sudo service logstash start

查看log

  • tail -f /var/log/logstash/logstash.log

参考资料


Kibana

建立使用kibana的分组

  • sudo groupadd -g 999 kibana 
  • sudo useradd -u 999 -g 999 kibana
  • If those commands fail because the999GID or UID already exist, replace the number with IDs that are free

下载安装


配置

  • sudo nano ~/kibana-4*/config/kibana.yml(server.host: "localhost"
  • sudo mkdir -p /opt/kibana
  • sudo cp -R ~/kibana-4*/* /opt/kibana/
  • sudo chown -R kibana: /opt/kibana

run as a service


Install Nginx

  • sudo apt-get install nginx apache2-utils(sudo yum install nginx httpd)
  • sudo htpasswd -c /etc/nginx/htpasswd.users kibanaadmin 
  • sudo vi /etc/nginx/sites-available/default

 

 

 

server {

listen 80;

server_name localhost;

auth_basic "Restricted Access";

auth_basic_user_file /etc/nginx/htpasswd.users;

location / {

proxy_pass http://localhost:5601;

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection 'upgrade';

proxy_set_header Host $host;

proxy_cache_bypass $http_upgrade;

}

}

  • sudo service nginx restart

Configure An Index Pattern

  • Go to Settings → Advanced.
  • Edit the metaFields and add "_timestamp". Hit save.
  • Now go back to Settings → Indices 

Clipboard Image.png

  • create 

Clipboard Image.png


参考资料

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值