elk搭建之-es搭建(包含集群搭建及踩坑记录)

下载所需资源

jdk1.8 https://www.oracle.com/technetwork/java/javase/downloads/index.html
Elasticsearch 7.4.2 https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.4.2-linux-x86_64.tar.gz
elasticsearch-head https://github.com/mobz/elasticsearch-head/archive/master.zip

修改主机host()

vim /etc/hosts
192.168.119.132  master


192.168.119.133  node-1

安装nodejs

curl --silent --location https://rpm.nodesource.com/setup_10.x | bash -

yum install -y nodejs

创建用户es不能以root权限启动

• 创建一个用户组 esk

groupadd esk

• 二、创建一个用户 es，并将其添加到 esk用户组

useradd es -g esk

• 三、为es 用户赋予 /usr/local 目录权限

chown -R es:esk /usr/local

注意,两个机器节点之间不能使用客户端进行复制,会使文件的权限改变,

关闭防火墙

//查看防火墙状态
//停止firewall
//禁止firewall开机启动
firewall-cmd --state 
systemctl stop firewalld.service 
systemctl disable firewalld.service 

切换到es用户

su es

安装过程

(单机版) 安装elasticsearch

修改配置文件

node.name: node-1

path.data: /usr/local/elk/data

path.logs: /usr/local/elk/logs

network.host: 0.0.0.0
http.port: 9200

http.cors.enabled: true

http.cors.allow-origin: "*"
http.cors.allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
http.cors.allow-headers: "X-Requested-With, Content-Type, Content-Length, X-User"
cluster.routing.allocation.disk.threshold_enabled: false

启动es

# 前台启动
./elasticsearch

# 后台启动
nohup ./elasticsearch &

问题解决方案

• 处理vm

# 首先切换到 root 用户
su root
# 输入密码，然后编辑下面文件
vim /etc/sysctl.conf
# 在文件末尾添加以下内容
vm.max_map_count=262144

查看是否生效

sysctl -p

• 处理limit

vim /etc/security/limits.conf

 #<domain>      <type>  <item>         <value>
 #

 #*               soft    core            0
 #*               hard    rss             10000
 #@student        hard    nproc           20
 #@faculty        soft    nproc           20
 #@faculty        hard    nproc           50
 #ftp             hard    nproc           0
 #@student        -       maxlogins       4

 *               soft    nproc           4096
 *               hard    nproc           4096
 *               soft    nofile          65536
 *               hard    nofile          65536

检查配置是否生效

ulimit -Hu
ulimit -Su
ulimit -Hn	
ulimit -Sn

如果不生效,则重启ssh客户端

检查es是否成功启动

curl http://192.168.119.132:9200

安装 es-head

• 先安装 grunt

npm install -g grunt-cli

• 安装 bzip2 并安装全部依赖

yum install -y bzip2
npm install

• 配置 Gruntfile.js
• 配置 /_site/app.js

# 搜索 "/app-base_uri"
this.base_uri = this.config.base_uri || this.prefs.get("app-base_uri") || "http://192.168.119.132:9200";

启动(后台)

nohup npm run start &

集群版es部署完整配置文件

master

# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: guahao-es
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: master
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /usr/local/elk/data
#
# Path to log files:
#
path.logs: /usr/local/elk/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 192.168.119.132
#
# Set a custom port for HTTP:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.seed_hosts: ["192.168.119.132", "192.168.119.133"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["master"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
#
http.cors.enabled: true

http.cors.allow-origin: "*"
http.cors.allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
http.cors.allow-headers: "X-Requested-With, Content-Type, Content-Length, X-User"
cluster.routing.allocation.disk.threshold_enabled: false

node

# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: guahao-es
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /usr/local/elk/data
#
# Path to log files:
#
path.logs: /usr/local/elk/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 192.168.119.133
#
# Set a custom port for HTTP:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.seed_hosts: ["192.168.119.132", "192.168.119.133"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
i#
cluster.initial_master_nodes: ["master"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
#
http.cors.enabled: true

http.cors.allow-origin: "*"
http.cors.allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
http.cors.allow-headers: "X-Requested-With, Content-Type, Content-Length, X-User"
cluster.routing.allocation.disk.threshold_enabled: false

集群的方式有些不同，需要注意的是master的host会被publish出来，所以不能再使用0.0.0.0，需要使用本机的IP地址以期望被其他节点找到
node节点的initial_master_nodes 需要指定 master

中文分析器安装

下载中文分词器

wget https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.4.2/elasticsearch-analysis-ik-7.4.2.zip