ELK节点安装

这个文章已经过时，请查看以下链接

https://www.cnblogs.com/woshimrf/p/docker-es7.html

ELK 安装参考链接

https://www.cnblogs.com/xialiaoliao0911/p/9599898.html

setenforce 0
sed -i s/enforcing/disabled/g /etc/selinux/config

yum install java-1.8.0* -y

cd /usr/local/src
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.0.1-linux-x86_64.tar.gz
tar zxf elasticsearch-7.0.1-linux-x86_64.tar.gz
mv elasticsearch-7.0.1 /usr/local/

Elasticsearch配置/usr/local/elasticsearch-7.0.1/config/elasticsearch.yml

path.data: /usr/local/elasticsearch-7.0.1/data
path.logs: /usr/local/elasticsearch-7.0.1/logs
network.host: 127.0.0.1
http.port: 9200

JVM的内存限制更改 /usr/local/elasticsearch-7.0.1/config/jvm.options
-Xms128M
-Xms128M

Elasticsearch的启动，得用普通用户启动

1. useradd -s /sbin/nologin elk
2. chown -R elk:elk /usr/local/elasticsearch-7.0.1/
3. su - elk -s /bin/bash
4. /usr/local/elasticsearch-7.0.1/bin/elasticsearch -d

验证启动是否成功
1. 观察日志
tail -30f /usr/local/elasticsearch-7.0.1/logs/elasticsearch.log
2. 查看端口 netstat -lpnt
3. 打开kibana网页看看

1）最大文件打开数调整 /etc/security/limits.conf
* - nofile 65536

2) 最大打开进程数调整 /etc/security/limits.d/XX-nproc.conf (不同机器XX不一样，可先到 cd /etc/security/limits.d/ 查看下）

* soft nproc unlimited
root soft nproc unlimited

3) 内核参数调整
/etc/sysctl.conf

vm.max_map_count = 262144

4) elasticsearch.yml文件node.name: node-1 前面的#打开

Elsticsearch 监听网卡建议

1. 如果学习，建议监听在 127.0.0.1
2. 如果是云服务器的话，一定要把9200和9300公网入口在安全组限制一下
3. 线上环境建议监听在内网网卡，监听在公网容易入侵