1.准备
1.1.组件
JDK：1.8版本及以上；
ElasticSearch：6.2.4版本；
1.2.服务器
3台服务器
2.安装
2.1.下载解压
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.2.4-linux-x86_64.tar.gz
mkdir /opt/elk/elasticsearch-6.2.4 tar zxvf elasticsearch-6.2.4.tar.gz -C /opt/elk/elasticsearch-6.2.4
2.2.配置
cd /opt/elk/elasticsearch-6.2.4/config vi elasticsearch.yml
标红的需要我们重点关注的，也是平常修改最多的参数：
# ======================== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with reasonable defaults for most settings. # Before you set out to tweak and tune the configuration, make sure you # understand what are you trying to accomplish and the consequences. # # The primary way of configuring a node is via this file. This template lists # the most important settings you may want to configure for a production cluster. # # Please consult the documentation for further information on configuration options: # https://www.elastic.co/guide/en/elasticsearch/reference/index.html # # ---------------------------------- Cluster ----------------------------------- # # Use a descriptive name for your cluster: # cluster.name: log-es-cluster #集群名称 # # ------------------------------------ Node ------------------------------------ # # Use a descriptive name for the node: # node.name: node-100 #节点名称 node.master: true #是否master node.data: true #是否数据节点 # # Add custom attributes to the node: # #node.attr.rack: r1 # # ----------------------------------- Paths ------------------------------------ # # Path to directory where to store the data (separate multiple locations by comma): # #path.data: /path/to/data # # Path to log files: # #path.logs: /path/to/logs # # ----------------------------------- Memory ----------------------------------- # # Lock the memory on startup: # bootstrap.memory_lock: false #默认为true，值改为false # # Make sure that the heap size is set to about half the memory available # on the system and that the owner of the process is allowed to use this # limit. # # Elasticsearch performs poorly when the system is swapping the memory. # # ---------------------------------- Network ----------------------------------- # # Set the bind address to a specific IP (IPv4 or IPv6): # network.host: 10.0.101.100 #本机服务器IP # # Set a custom port for HTTP: # http.port: 9200 #端口 # # For more information, consult the network module documentation. # # --------------------------------- Discovery ---------------------------------- # # Pass an initial list of hosts to perform discovery when new node is started: # The default list of hosts is ["127.0.0.1", "[::1]"] # discovery.zen.ping.unicast.hosts: ["10.0.101.100", "10.0.101.101", "10.0.101.102"] #集群服务器IP # # Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1): # discovery.zen.minimum_master_nodes: 3 #集群节点数 # # For more information, consult the zen discovery module documentation. # # ---------------------------------- Gateway ----------------------------------- # # Block initial recovery after a full cluster restart until N nodes are started: # #gateway.recover_after_nodes: 3 # # For more information, consult the gateway module documentation. # # ---------------------------------- Various ----------------------------------- # # Require explicit names when deleting indices: # #action.destructive_requires_name: true #增加以下属性，3台服务器一样 bootstrap.system_call_filter: false transport.tcp.port: 9300 transport.tcp.compress: true http.cors.enabled: true http.cors.allow-origin: "*"
2.3.同步
将安装配置好的组件包，用以下命令同步到另外2台服务器：
scp -r /opt/elk/elasticsearch-6.2.4/ root@172.16.10.92:/opt/elk/elasticsearch-6.2.4/
scp -r /opt/elk/elasticsearch-6.2.4/ root@172.16.10.93:/opt/elk/elasticsearch-6.2.4/
在另外2台服务器上修改elasticsearch.yml文件的以下2个属性值，其它的3台服务器一样：
node.name: node-101 network.host: 10.0.101.101
2.4.创建用户
由于elasticsearch不能使用root账户启动，用以下命令需要新建一个用户：
#创建用户
useradd elk
#设置密码
passwd elk
#用户授权 chown -R elk:elk /opt/elk/elasticsearch-6.2.4
chmod 777 /opt/elk/elasticsearch-6.2.4
#切换用户
su elk
2.5.修改Linux配置（root用户下）
- limits.conf
vim /etc/security/limits.conf
增加以下属性：
* soft nofile 65536 * hard nofile 65536 * soft nproc 2048 * hard nproc 4096 #锁住swapping因此需要在这个配置文件下再增加两行代码 elasticsearch soft memlock unlimited elasticsearch hard memlock unlimited
- 90-nproc.conf
vim /etc/security/limits.d/90-nproc.conf
- sysctl.conf
vim /etc/sysctl.conf
增加以下属性：
vm.max_map_count=655360 fs.file-max=655360
注意：修改之后需要执行一句命令sysctl -p使系统配置生效(使用root用户)
2.6.启动
切换为elk用户，输入以下命令启动：
su elk
cd /opt/elk/elasticsearch-6.2.4/bin ./elasticsearch
- 第1台启动成功，没有报错，提示以下信息属于正常现像，因为另外2台服务器还没有启动：
- 第2台启动成功，情况跟第1台一样：
- 第3台启动成功
3.验证
- 在其中一台服务器上，输入以下命令，IP要改成相应环境的：
curl '10.0.101.100:9200/_cluster/health?pretty'
- 输入以下命令，检查master节点是否成功创建：
curl '10.0.101.100:9200/_cat/master?v'
