最详细没有之一的ELK之elasticsearch部署

安装jdk并部署环境(es节点都要配置)

主机环境

主机名	IP地址
es-master	10.11.66.201
es-node1	10.11.66.202
es-node2-kebana	10.11.66.203

配置主机名、本地解析、关闭防火墙

[root@es-master ~]# hostnamectl set-hostname es-master
[root@es-master ~]# exit
[root@es-master ~]# cat >> /etc/hosts << EOF
10.11.66.201 es-master
10.11.66.202 es-node1
10.11.66.203 es-node2-kebana
EOF
[root@es-master ~]# systemctl stop firewalld && setenforce 0

配置时间同步

[root@es-master ~]# yum install -y chrony
[root@es-master ~]# systemctl restart chronyd
[root@es-master ~]# chronyc sources -v

安装jdk

[root@es-master ~]# tar xf jdk-13.0.2_linux-x64_bin.tar.gz -C /usr/local/
[root@es-master ~]# cd /usr/local/
[root@es-master local]# mv jdk-13.0.2/ java
[root@es-master local]# ln -s /usr/local/jdk-13.0.2/ /usr/local/java
[root@es-master local]# cat >> /etc/profile << EOF
export JAVA_HOME=/usr/local/java
export JRE_HOME=/usr/local/java/jre
export PATH=$JAVA_HOME/bin:$JRE_HOME/bin:$PATH
EOF
[root@es-master local]# source /etc/profile

修改文件限制

[root@es-master ~]# cat >>/etc/security/limits.conf <<-EOF
# 增加以下内容
* soft nofile 65536
* hard nofile 65536
* soft nproc 32000
* hard nproc 32000
elk soft memlock unlimited
elk hard memlock unlimited
EOF
[root@es-master ~]# cat >>/etc/systemd/system.conf<<-EOF
DefaultLimitNOFILE=65536
DefaultLimitNPROC=32000
DefaultLimitMEMLOCK=infinity
EOF

调整虚拟内存和最大并发连接

[root@es-master ~]# cat  >>/etc/sysctl.conf<<-EOF
#增加的内容
vm.max_map_count=655360
fs.file-max=655360
vm.swappiness=0
EOF
[root@es-master ~]# 

给elk添加免密sudo并重启服务器

[root@es-master ~]# useradd elk
[root@es-master ~]# visudo
# 添加以下内容
elk        ALL=(ALL)       NOPASSWD: ALL   #110行添加

重启服务器

[root@es-master ~]# reboot

安装Elasticsearch（es节点都要配置）

创建es需要使用的目录并赋予权限

[root@es-master ~]# su - elk
[elk@es-master]$ sudo mkdir -p /usr/local/elkapp/ && sudo mkdir -p /usr/local/elkdata/es/{data,log} 
[elk@es-master ~]# sudo chown -R elk:elk /usr/local/{elkapp,elkdata}

下载elasticsearch

[elk@es-master ~]$ sudo tar -xf elasticsearch-7.8.0-linux-x86_64.tar.gz -C /usr/local/elkapp
[elk@es-master ~]$ cd /usr/local/elkapp/
[elk@es-master elkapp]$ sudo ln -s /usr/local/elkapp/elasticsearch-7.8.0/ /usr/local/elkapp/elasticsearch

配置elasticsearch配置文件

[elk@es-master ~]$ cd /usr/local/elkapp/elasticsearch/config/
[elk@es-master config]$ sudo cp elasticsearch.yml{,.bak}
[elk@es-master config]$ sudo vim elasticsearch.yml
# master:
cluster.name: my-es
node.name: es-master
node.master: true
node.data: true
bootstrap.memory_lock: true
path.data: /usr/local/elkdata/es/data
path.logs: /usr/local/elkdata/es/logs
network.host: 10.11.66.201
http.port: 9200
transport.tcp.port: 9300
discovery.seed_hosts: ["10.11.66.201", "10.11.66.202","10.11.66.203"]
cluster.initial_master_nodes: ["es-master"]
http.cors.enabled: true
http.cors.allow-origin: "*"
# node1:
cluster.name: my-es
node.name: es-node1
node.data: true
bootstrap.memory_lock: true
path.data: /usr/local/elkdata/es/data
path.logs: /usr/local/elkdata/es/logs
network.host: 10.11.66.202
http.port: 9200
transport.tcp.port: 9300
discovery.seed_hosts: ["10.11.66.201","10.11.66.202","10.11.66.203"]
cluster.initial_master_nodes: ["es-master"]
# node2:
cluster.name: my-es
node.name: es-node2
node.data: true
bootstrap.memory_lock: true
path.data: /usr/local/elkdata/es/data
path.logs: /usr/local/elkdata/es/logs
network.host: 10.11.66.203
http.port: 9200
transport.tcp.port: 9300
discovery.seed_hosts: ["10.11.66.201","10.11.66.202","10.11.66.203"]
cluster.initial_master_nodes: ["es-master"]

配置systemctl管理elasticsearch

[elk@es-master ~]$ sudo vim /etc/systemd/system/elasticsearch.service
# 内容如下
[Unit]
Description=elasticsearch
[Service]
User=elk
Group=elk
LimitMEMLOCK=infinity
LimitNOFILE=100000
LimitNPROC=100000
ExecStart=/usr/local/elkapp/elasticsearch/bin/elasticsearch
[Install]
WantedBy=multi-user.target

注意⚠️看elasticsearch文件权限

[elk@es-master ~]$ sudo systemctl daemon-reload
[elk@es-master ~]$ ll
[elk@es-master ~]$ sudo chown -R elk:elk /usr/local/{elkapp,elkdata}

启动elasticsearch并查看端口

[elk@es-master config]$ sudo systemctl start elasticsearch.service 
[elk@es-master config]$ sudo systemctl status elasticsearch.service
[elk@es-master config]$ ss -anput | grep 9200

测试访问 http://10.11.66.201:9200/