elasticsearch 环境搭建

1.首先在linux虚拟机配置java环境

1> 首先在虚拟机中 java -version，可以看到

[root@centos local]# java -version
java version "1.7.0_45"
OpenJDK Runtime Environment (rhel-2.4.3.3.el6-x86_64 u45-b15)
OpenJDK 64-Bit Server VM (build 24.45-b08, mixed mode)

2> 卸载openjdk ，运行rpm -qa|grep java 命令，可以看到有两个版本 openjdk

[root@centos local]# rpm -qa|grep java
java-1.7.0-openjdk-1.7.0.45-2.4.3.3.el6.x86_64
tzdata-java-2013g-1.el6.noarch
java-1.6.0-openjdk-1.6.0.0-1.66.1.13.0.el6.x86_64

3> 用rpm -e --nodeps 命令进行删除卸载

rpm -e --nodeps java-1.7.0-openjdk-1.7.0.45-2.4.3.3.el6.x86_64

rpm -e --nodeps java-1.6.0-openjdk-1.6.0.0-1.66.1.13.0.el6.x86_64

4> 去oracle 官网去下载jdk ，然后上传到虚拟机上，解压， 将解压后的文件重名为java

 mv jdk1.8.0_251 java

5> 配置环境变量
vim /etc/profile ，在最后面加上

JAVA_HOME=/usr/local/java/ 
JRE_HOME=/usr/local/java/jre     
CLASS_PATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar:$JRE_HOME/lib
PATH=$PATH:$JAVA_HOME/bin:$JRE_HOME/bin
export JAVA_HOME JRE_HOME CLASS_PATH PATH

6> 执行 source /etc/profile ，使设置的变量生效，再次执行java -version

 java -version
java version "1.8.0_251"
Java(TM) SE Runtime Environment (build 1.8.0_251-b08)
Java HotSpot(TM) 64-Bit Server VM (build 25.251-b08, mixed mode)

2. 安装elasticsearch

1 > 去 网站 下载安装包，上传到虚拟机,然后解压 ，进入到es安装目录下的config文件夹中，修改elasticsearch.yml 文件

#配置es的集群名称，默认是elasticsearch，es会自动发现在同一网段下的es，如果在同一网段下有多个集群，就可以用这个属性来区分不同的集群。
cluster.name: my-es
#节点名称
node.name: node-1
#设置索引数据的存储路径
path.data: /usr/local/elasticsearch/data
#设置日志的存储路径
path.logs: /usr/local/elasticsearch/logs
#设置当前的ip地址,通过指定相同网段的其他节点会加入该集群中
network.host: 0.0.0.0
#设置对外服务的http端口
http.port: 9200
#设置集群中master节点的初始列表，可以通过这些节点来自动发现新加入集群的节点
discovery.zen.ping.unicast.hosts: ["127.0.0.1","10.10.10.34:9200"]

注：

1、补齐必要的目录

mkdir -p /usr/local/elasticsearch/data
mkdir -p /usr/local/elasticsearch/logs     (目录可能已经存在，需先确定清楚)

2> 进入安装目录的bin 下面 ，执行 ./elasticsearch ，会出现报错

./elasticsearch
[2020-08-19T11:52:25,385][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [centos] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:163) ~[elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) ~[elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-7.1.1.jar:7.1.1]
        at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115) ~[elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-7.1.1.jar:7.1.1]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
        at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:102) ~[elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:169) ~[elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:325) ~[elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.1.1.jar:7.1.1]
        ... 6 more

这是因为安全问题elasticsearch 不让用root用户直接运行，所以要创建新用户。

具体操作如下:

useradd esuser
passwd esuser

#再输入两次密码(自定义)　为用户赋权限

chown -R esuser:esuser /usr/local/elasticsearch

#然后使用es用户启动  ：su esuser

cd  /usr/local/elasticsearch

#启动es命令：bin/elasticsearch

然后启动出现报错：

[WARN ][o.e.b.JNANatives         ] [centos] unable to install syscall filter: 
java.lang.UnsupportedOperationException: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in
        at org.elasticsearch.bootstrap.SystemCallFilter.linuxImpl(SystemCallFilter.java:329) ~[elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.SystemCallFilter.init(SystemCallFilter.java:617) ~[elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.JNANatives.tryInstallSystemCallFilter(JNANatives.java:260) [elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Natives.tryInstallSystemCallFilter(Natives.java:113) [elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:107) [elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:169) [elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:325) [elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) [elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) [elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) [elasticsearch-cli-7.1.1.jar:7.1.1]
        at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115) [elasticsearch-7.1.1.jar:7.1.1]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) [elasticsearch-7.1.1.jar:7.1.1]
[2020-08-19T12:20:34,350][INFO ][o.e.e.NodeEnvironment    ] [centos] using [1] data paths, mounts [[/ (rootfs)]], net usable_space [30.8gb], net total_space [38.2gb], types [rootfs]

原因：报了一大串错误，大家不必惊慌，其实只是一个警告，主要是因为你Linux版本过低造成的。

解决方案：
1、重新安装新版本的Linux系统
2、警告不影响使用，可以忽略

然后下面的error 报错：

ERROR: [5] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
[2]: max number of threads [1024] for user [esuser] is too low, increase to at least [4096]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[4]: system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
[5]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured

max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
报错 解决 ：编辑 /etc/security/limits.conf，追加以下内容；

* soft nproc 65536
* hard nproc 65536
* soft nofile 65536
* hard nofile 65536

#修改90-nproc.conf 
vim /etc/security/limits.d/90-nproc.conf 

soft nproc 2048

此文件修改后需要重新登录用户，才会生效

登录后使用ulimit -S -n/ulimit -H -n查看

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
解决方法：

在   /etc/sysctl.conf文件最后添加一行
vm.max_map_count=262144

system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
解决：

 在elasticsearch.yml中配置bootstrap.system_call_filter为false，注意要在Memory下面:
bootstrap.memory_lock: false
bootstrap.system_call_filter: false

注意： 所有配置文件改完了，重启一下虚拟机！！！

9200作为Http协议，主要用于外部通讯

9300作为Tcp协议，jar之间就是通过tcp协议通讯

ES集群之间是通过9300进行通讯

# 关闭防火墙 
service iptables stop

访问 ip:9200 成功

kibana 安装

从网站 下载kibana 传到虚拟机上 ，解压缩，然后修改config文件下配置 vim kibana.yml

server.port: 5601
server.host: "192.168.56.105"
elasticsearch.hosts: ["http://192.168.56.105:9200"]

去bin文件下启动 kibana ，然后出现如下情况：

./kibana
Kibana should not be run as root.  Use --allow-root to continue.

执行以下语句，用esuser 启动kibana

 chown -R esuser:esuser /usr/local/kibana-7.9.0-linux-x86_64

结果出现如下页面表示成功！