Elasticsearch [8.7] 安装与配置

使用 uname -a 查看 Linux 系统内核与版本，选择对应的安装包，
下文以Linux x86_64 / Elasticsearch 8.7为例，演示通过 RPM 和 压缩包 两种方式的安装步骤。

1 下载与安装

Download Elasticsearch

1.1 RPM

Install Elasticsearch with RPM

# 创建并切换目录
mkdir /data/elastic
cd /data/elastic

# 下载
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.7.0-x86_64.rpm
# 安装
rpm -ivh elasticsearch-8.7.0-x86_64.rpm

# 查看配置文件位置
rpm -qc kibana

安装完毕后展示以下信息，记得保存安装完毕后的 elastic 账号密码

--------------------------- Security autoconfiguration information ------------------------------

Authentication and authorization are enabled.
TLS for the transport and HTTP layers is enabled and configured.

The generated password for the elastic built-in superuser is : bLDOCJP2l5TmLegNt6BN

If this node should join an existing cluster, you can reconfigure this with
'/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <token-here>'
after creating an enrollment token on your existing cluster.

You can complete the following actions at any time:

Reset the password of the elastic built-in superuser with 
'/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'.

Generate an enrollment token for Kibana instances with 
 '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'.

Generate an enrollment token for Elasticsearch nodes with 
'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'.

-------------------------------------------------------------------------------------------------

1.2 压缩包

Install Elasticsearch from archive on Linux or MacOS

# 创建用户 elastic，其中 -d 和 -m 选项用来为登录名 elastic 产生一个主目录 /home/elastic
useradd -d /home/elastic -m elastic
# 指定用户 elastic 的口令
passwd elastic

# 创建安装目录
mkdir -p /app/elastic
# 更改目录权限
chown -R elastic:elastic /app/elastic
# 切换用户
sudo su - elastic
# 切换目录
cd /app/elastic

# 下载安装包
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.7.0-linux-x86_64.tar.gz
# 解压安装包
tar -zxvf elasticsearch-8.7.0-linux-x86_64.tar.gz
# 切换解压后的目录
cd /app/elastic/elasticsearch-8.7.0

2 配置

2.1 Linux 系统配置

Configure important system settings

2.1.1 打开文件句柄数

# 临时会话生效
sudo ulimit -n 65535
# 永久生效
vim /etc/security/limits.conf
# 在上面配置文件中增加以下内容
elasticsearch  -  nofile  65535

2.1.2 禁用交换

# 临时会话生效，无需重启
sudo swapoff -a
# 永久生效
vim /etc/fstab
# 在上面配置文件中注释包含 swap 的所有行

2.1.3 虚拟内存

# 临时会话生效，无需重启
sysctl -w vm.max_map_count=262144
# 永久生效
vim /etc/sysctl.conf
# 在上面配置文件中注释以下内容
vm.max_map_count = 262144

2.1.4 线程数

# 临时会话生效，无需重启
ulimit -u 4096
# 永久生效
vim /etc/security/limits.conf
# 在上面配置文件中注释以下内容
elasticsearch  -  nproc   4096

2.2 Elasticsearch 应用配置

Configure important Elasticsearch settings

• RPM 安装的配置文件路径 vim /etc/elasticsearch/elasticsearch.yml
• 压缩包 安装的配置文件路径 vim /../elasticsearch-8.7.0/config/elasticsearch.yml

# Use a descriptive name for your cluster:
cluster.name: elasticsearch-dev
# Use a descriptive name for the node:
node.name: dev-data-1

# Path to directory where to store the data (separate multiple locations by comma):
path.data: /var/lib/elasticsearch
# Path to log files:
path.logs: /var/log/elasticsearch

# By default Elasticsearch is only accessible on localhost. Set a different
# address here to expose this node on the network:
network.host: 172.16.32.2
# By default Elasticsearch listens for HTTP traffic on the first free port it
# finds starting at 9200. Set a specific HTTP port here:
http.port: 9200

# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
discovery.seed_hosts: ["172.16.32.2"]

# Enable security features
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12
# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12

# Create a new cluster with the current node only
# Additional nodes can still join the cluster later
cluster.initial_master_nodes: ["dev-data-1"]

# Allow HTTP API connections from anywhere
# Connections are encrypted and require user authentication
http.host: 0.0.0.0

# Allow other nodes to join the cluster from anywhere
# Connections are encrypted and mutually authenticated
transport.host: 0.0.0.0

3 启动与停止

3.1 RPM

# 配置系统启动时自动启动
sudo /bin/systemctl daemon-reload
sudo /bin/systemctl enable elasticsearch.service

# 启动
service elasticsearch start
# 停止
service elasticsearch stop
# 检查服务状态
service elasticsearch status

# 查看日志
journalctl -u elasticsearch.service

3.2 压缩包

命令行方式

# 启动
/app/elastic/elasticsearch-8.7.0/bin/elasticsearch
# 停止
Ctrl-C

守护进程方式

# 启动
/app/elastic/elasticsearch-8.7.0/bin/elasticsearch -d -p pid
# 停止
pkill -F pid

3.3 检查是否启动成功

# 此处需要输入安装时生成的 elastic 账号密码
[root@*** /etc/kibana]# curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200
Enter host password for user 'elastic':
{
  "name" : "dev-data-1",
  "cluster_name" : "elasticsearch-dev",
  "cluster_uuid" : "Dumv3kP4TxGpNxBZaCuwYw",
  "version" : {
    "number" : "8.7.0",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "09520b59b6bc1057340b55750186466ea715e30e",
    "build_date" : "2023-03-27T16:31:09.816451435Z",
    "build_snapshot" : false,
    "lucene_version" : "9.5.0",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

4 常用命令

# 重置账号密码
/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic
# 创建 kibana 注册令牌
/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
# 创建 Elasticsearch Node 注册令牌
/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node
# 如果此节点应加入现有群集，则可以使用重新配置
/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <token-here>