elasticsearch 安装及踩坑

1 . 下载   https://www.elastic.co/downloads/elasticsearch

这里jdk 8u111

  cd /usr/local/      mkdir elk

 cd /usr/local/elk    上传   elasticsearch-5.1.1.tar.gz

2 tar -zxvf    elasticsearch-5.1.1.tar.gz

cd   elasticsearch-5.1.1/bin

3 .  启动  ./elasticsearch   或者后台启动    ./elasticsearch -d

发现不能用root 用户启动

adduser elk 新增用户elk

passwd  elk   为elk用户创建密码

赋予 文件夹chown elk:elk /usr/local/elk/ -R

chown lingyun:lingyun /usr/local/src/elk/ -R

4.启动  ./elasticsearch  

[o.e.b.JNANatives ] unable to install syscall filter: 

Java.lang.UnsupportedOperationException: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in
at org.elasticsearch.bootstrap.Seccomp.linuxImpl(Seccomp.Java:349) ~[elasticsearch-5.0.0.jar:5.0.0]
at org.elasticsearch.bootstrap.Seccomp.init(Seccomp.java:630) ~[elasticsearch-5.0.0.jar:5.0.0]

5 发现是 elasticsearch  内核版本问题

这里可以不升级 ，考虑后期还是升级了

6  

    

导入 Public Key

             

rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org

安装 ELRepo
rpm -Uvh http://www.elrepo.org/elrepo-release-6-6.el6.elrepo.noarch.rpm 
kernel-lt
yum --enablerepo=elrepo-kernel install kernel-lt -y 
kernel-ml
yum --enablerepo=elrepo-kernel install kernel-ml -y
更改 Grub
vi /etc/grub.conf
设置 default=0   如果修改为default =1 版本还是原来的

重启主机以后

内核升级成功

然后发现其他问题

问题二：ERROR: bootstrap checks failed

max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]
max number of threads [1024] for user [lishang] likely too low, increase to at least [2048]

解决：切换到root用户，编辑limits.conf 添加类似如下内容

vi /etc/security/limits.conf 

添加如下内容:

* soft nofile 65536

* hard nofile 131072

* soft nproc 2048

* hard nproc 4096

 

问题三：max number of threads [1024] for user [lish] likely too low, increase to at least [2048]

解决：切换到root用户，进入limits.d目录下修改配置文件。

vi /etc/security/limits.d/90-nproc.conf 

修改如下内容：

* soft nproc 1024

#修改为

* soft nproc 2048

 

问题四：max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]

解决：切换到root用户修改配置sysctl.conf

vi /etc/sysctl.conf 

添加下面配置：

vm.max_map_count=655360

并执行命令：

sysctl -p

然后，重新启动elasticsearch，即可启动成功。

6   这里用户必须重新登陆，否则不生效  

7  测试 curl 192.168.0.128:9200
{
  "name" : "aOjyMug",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "r_8ptjc1SZSIq_b4onIXSA",
  "version" : {
    "number" : "5.1.1",
    "build_hash" : "5395e21",
    "build_date" : "2016-12-06T12:36:15.409Z",
    "build_snapshot" : false,
    "lucene_version" : "6.3.0"
  },
  "tagline" : "You Know, for Search"
}

说明启动成功