elasticsearch安装教程
1 java8 环境
elasticsearch需要安装java 8 环境，配置JAVA_HOME
查看是否有旧版本的java
java -verison
如果没有安装，可以进入官方选择适合自己的版本，下载地址：http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html
下载并解压
$ cd /usr/local/src
$ wget --no-cookies --no-check-certificate --header "Cookie: gpw_e24=http%3A%2F%2Fwww.oracle.com%2F; oraclelicense=accept-securebackup-cookie" http://download.oracle.com/otn-pub/java/jdk/8u171-b11/512cd62ec5174c3487ac17c61aaa89e8/jdk-8u171-linux-x64.tar.gz
$ tar zxvf jdk-8u171-linux-x64.tar.gz
配置环境变量
# export PATH USER LOGNAME MAIL HOSTNAME HISTSIZE HISTCONTROL 之后加入下面内容
#jdk
export JAVA_HOME=/usr/local/src/jdk1.8.0_171
export PATH=$JAVA_HOME/bin:$PATH
export CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
使配置生效
source /etc/profile
再次验证是否安装成功
java -version
java version "1.8.0_171"
Java(TM) SE Runtime Environment (build 1.8.0_171-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.171-b11, mixed mode)
查看变量
[root@VM_35_1_centos ~]# echo $JAVA_HOME
/usr/local/src/jdk1.8.0_171
2 安装elasticsearch
安装教程位置：
https://www.elastic.co/guide/en/elasticsearch/reference/5.6/install-elasticsearch.html
这里我们使用tar包
cd /usr/local/src
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.6.9.tar.gz
tar zxvf elasticsearch-5.6.9.tar.gz
cd elasticsearch-5.6.9/
内存配置
默认的内存配置是2g，我学习用的机子内存较小（实际2g）会挂掉，所以我将内存改成1g(机子实际内存的一半)
vim /etc/elasticsearch/jvm.options
内容
-Xms1g
-Xmx1g
启动
./bin/elasticsearch
如果你使用root用户启动，则会出现下面的报错
[2018-05-23T15:00:43,762][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) ~[elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:123) ~[elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:70) ~[elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:134) ~[elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:91) ~[elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:84) ~[elasticsearch-5.6.9.jar:5.6.9]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:106) ~[elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:195) ~[elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:342) ~[elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:132) ~[elasticsearch-5.6.9.jar:5.6.9]
... 6 more
这是出于系统安全考虑设置的条件。由于ElasticSearch可以接收用户输入的脚本并且执行，为了系统安全考虑，
建议创建一个单独的用户用来运行ElasticSearch
创建elsearch用户组及elsearch用户
groupadd elsearch
useradd elsearch -g elsearch -p elasticsearch
cd /usr/local/src
chown -R elsearch:elsearch elasticsearch-5.6.9
切换到elsearch用户再启动
su elsearch
./elasticsearch
这时你可能还会遇到下面的报错，max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
解决方法是：
sudo sysctl -w vm.max_map_count=262144
再次启动
[elsearch@VM_35_1_centos elasticsearch-5.6.9]$ ./bin/elasticsearch
[2018-05-23T15:09:55,323][INFO ][o.e.n.Node ] [] initializing ...
[2018-05-23T15:09:55,546][INFO ][o.e.e.NodeEnvironment ] [ndB4c4F] using [1] data paths, mounts [[/ (rootfs)]], net usable_space [44.7gb], net total_space [49gb], spins? [unknown], types [rootfs]
[2018-05-23T15:09:55,546][INFO ][o.e.e.NodeEnvironment ] [ndB4c4F] heap size [1015.6mb], compressed ordinary object pointers [true]
[2018-05-23T15:09:55,547][INFO ][o.e.n.Node ] node name [ndB4c4F] derived from node ID [ndB4c4FLRxWlhH_94CN70Q]; set [node.name] to override
[2018-05-23T15:09:55,548][INFO ][o.e.n.Node ] version[5.6.9], pid[3857], build[877a590/2018-04-12T16:25:14.838Z], OS[Linux/3.10.0-514.21.1.el7.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0_171/25.171-b11]
[2018-05-23T15:09:55,548][INFO ][o.e.n.Node ] JVM arguments [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -Djdk.io.permissionsUseCanonicalPath=true, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Dlog4j.skipJansi=true, -XX:+HeapDumpOnOutOfMemoryError, -Des.path.home=/usr/local/src/elasticsearch-5.6.9]
[2018-05-23T15:09:57,152][INFO ][o.e.p.PluginsService ] [ndB4c4F] loaded module [aggs-matrix-stats]
[2018-05-23T15:09:57,152][INFO ][o.e.p.PluginsService ] [ndB4c4F] loaded module [ingest-common]
[2018-05-23T15:09:57,152][INFO ][o.e.p.PluginsService ] [ndB4c4F] loaded module [lang-expression]
[2018-05-23T15:09:57,152][INFO ][o.e.p.PluginsService ] [ndB4c4F] loaded module [lang-groovy]
[2018-05-23T15:09:57,153][INFO ][o.e.p.PluginsService ] [ndB4c4F] loaded module [lang-mustache]
[2018-05-23T15:09:57,153][INFO ][o.e.p.PluginsService ] [ndB4c4F] loaded module [lang-painless]
[2018-05-23T15:09:57,153][INFO ][o.e.p.PluginsService ] [ndB4c4F] loaded module [parent-join]
[2018-05-23T15:09:57,153][INFO ][o.e.p.PluginsService ] [ndB4c4F] loaded module [percolator]
[2018-05-23T15:09:57,153][INFO ][o.e.p.PluginsService ] [ndB4c4F] loaded module [reindex]
[2018-05-23T15:09:57,153][INFO ][o.e.p.PluginsService ] [ndB4c4F] loaded module [transport-netty3]
[2018-05-23T15:09:57,153][INFO ][o.e.p.PluginsService ] [ndB4c4F] loaded module [transport-netty4]
[2018-05-23T15:09:57,153][INFO ][o.e.p.PluginsService ] [ndB4c4F] no plugins loaded
[2018-05-23T15:10:00,188][INFO ][o.e.d.DiscoveryModule ] [ndB4c4F] using discovery type [zen]
[2018-05-23T15:10:01,225][INFO ][o.e.n.Node ] initialized
[2018-05-23T15:10:01,225][INFO ][o.e.n.Node ] [ndB4c4F] starting ...
[2018-05-23T15:10:01,505][INFO ][o.e.t.TransportService ] [ndB4c4F] publish_address {127.0.0.1:9300}, bound_addresses {127.0.0.1:9300}
[2018-05-23T15:10:04,656][INFO ][o.e.c.s.ClusterService ] [ndB4c4F] new_master {ndB4c4F}{ndB4c4FLRxWlhH_94CN70Q}{HfnS160SQP2XrgYtuEKX0w}{127.0.0.1}{127.0.0.1:9300}, reason: zen-disco-elected-as-master ([0] nodes joined)[, ]
[2018-05-23T15:10:04,728][INFO ][o.e.h.n.Netty4HttpServerTransport] [ndB4c4F] publish_address {127.0.0.1:9200}, bound_addresses {127.0.0.1:9200}
[2018-05-23T15:10:04,728][INFO ][o.e.n.Node ] [ndB4c4F] started
[2018-05-23T15:10:04,809][INFO ][o.e.g.GatewayService ] [ndB4c4F] recovered [0] indices into cluster_state
发现started关键字，并且发现监听127.0.0.1:9200端口，elasticsearch默认监听9200端口
使用curl测试是否安装成功
[root@VM_35_1_centos log]# curl localhost:9200
{
"name" : "ndB4c4F",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "X0k8EhwGThCjnf-cTkSpTg",
"version" : {
"number" : "5.6.9",
"build_hash" : "877a590",
"build_date" : "2018-04-12T16:25:14.838Z",
"build_snapshot" : false,
"lucene_version" : "6.6.1"
},
"tagline" : "You Know, for Search"
}
3 安装kibana
Kibana是一个为 ElasticSearch 提供的数据分析的 Web 接口。可使用它对日志进行高效的搜索、可视化、分析等各种操作。
https://www.elastic.co/guide/en/kibana/5.6/install.html
cd /usr/local/src
wget https://artifacts.elastic.co/downloads/kibana/kibana-5.6.9-linux-x86_64.tar.gz
tar zxvf kibana-5.6.9-linux-x86_64.tar.gz
cd kibana-5.6.9-linux-x86_64/
修改kibana配置，可以外网访问
vim ./config/kibana.yml
内容
server.port: 5601
server.host: "0.0.0.0"
可以浏览器访问xxx.xxx.xxx.xxx:5601
注意其中的Monitoring 默认是没有的，是由X-Pack集成提供的。该X-pack监控组件使您可以通过Kibana轻松地监控ElasticSearch。您可以实时查看集群的健康和性能，以及分析过去的集群、索引和节点度量。此外，可以监视Kibana本身性能。
Elasticsearch下载X-Pack
在Es的根目录（每个节点），运行 bin/elasticsearch-plugin进行安装。
bin/elasticsearch-plugin install x-pack
如果你在Elasticsearch已禁用自动索引的创建，在elasticsearch.yml配置action.auto_create_index允许X-pack创造以下指标：
action.auto_create_index: ".security*,.monitoring*,.watches,.triggered_watches,.watcher-history*"
Kibana下载X-Pack
在Kibana根目录运行 bin/kibana-plugin 进行安装。
bin/kibana-plugin install x-pack
4. 单服务器部署多个节点
实际上一个服务器只会部署一个节点，但是为了学习elasticsearch的分布特性，这里探索启动多个节点。
使用elasticsearch-5.6.9再复制一份，然后更改用户组
cd /usr/local/src
cp -r elasticsearch-5.6.9 elastic-slave1
chown -R elsearch:elsearch elastic-slave1
由于内存太小，所以再次调整了master和slave的配置
/usr/local/src/elasticsearch-5.6.9/config/jvm.options
/usr/local/src/elastic-slave1/config/jvm.options
-Xms256m
-Xmx256m
/usr/local/src/elasticsearch-5.6.9/config/elasticsearch.yml
cluster.name: test
node.name: master
node.master: true
network.host: 127.0.0.1
action.auto_create_index: ".security*,.monitoring*,.watches,.triggered_watches,.watcher-history*"
/usr/local/src/elastic-slave1/config/elasticsearch.yml
cluster.name: test
node.name: slave1
network.host: 127.0.0.1
http.port: 8200
discovery.zen.ping.unicast.hosts: ["127.0.0.1"]
action.auto_create_index: ".security*,.monitoring*,.watches,.triggered_watches,.watcher-history*"
分别运行master和slave的程序
./bin/elasticsearch
运行kibana
./bin/kibana
在浏览器上输入： http://xxx.xxx.xxx.xxx:5601/ ，打开Kibana，要输入用户名和密码登录，默认分别是 elastic 和 changeme，可以很方便的看到节点的情况
注意：复制的elastic-salve1文件夹下包含了data文件中源文件节点数据，需要把elastic-salve1文件夹下data文件下的文件清空，否则会出现下面类似错误。
[2018-05-23T17:52:48,839][INFO ][o.e.d.z.ZenDiscovery ] [slave-2] failed to send join request to master [{master}{iErWGFrwSuCTjXaOD9jE5g}{JHJNb1U_TVaqdNVoJmEBZw}{127.0.0.1}{127.0.0.1:9300}{ml.max_open_jobs=10, ml.enabled=true}], reason [RemoteTransportException[[master][127.0.0.1:9300][internal:discovery/zen/join]]; nested: IllegalArgumentException[can't add node {slave-2}{iErWGFrwSuCTjXaOD9jE5g}{uo1SvmJyTESE_Z6bcQrOeg}{127.0.0.1}{127.0.0.1:9301}{ml.max_open_jobs=10, ml.enabled=true}, found existing node {master}{iErWGFrwSuCTjXaOD9jE5g}{JHJNb1U_TVaqdNVoJmEBZw}{127.0.0.1}{127.0.0.1:9300}{ml.max_open_jobs=10, ml.enabled=true} with the same id but is a different node instance]; ]
