【centos】安装ELK之ElasticSearch

部署环境：

centos 6.X
jdk 1.7
elasticsearch 2.3.1 https://www.elastic.co/downloads/elasticsearch
logstash 2.3.1 https://www.elastic.co/downloads/logstash
Kibana 4.5.0 https://www.elastic.co/downloads/kibana

下载资源：

　　Elasticsearch：https://www.elastic.co/downloads 比如下载的是tar.gz包；根据自己习惯，可以下载rpm，或者zip 都可以。

需要提前注意的是，对端口的火墙策略；

# vim /etc/sysconfig/iptables  
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT  
-A INPUT -m state --state NEW -m tcp -p tcp --dport 9200 -j ACCEPT  
-A INPUT -m state --state NEW -m tcp -p tcp --dport 9292 -j ACCEPT  
# service iptables restart

还就是安装JDK

　　略

将其解压到/usr/local 下的elasticsearch文件夹下，然后Run bin/elasticsearch on Unix orbinelasticsearch.bat on Windows

但是，如果是用root权限运行，会提示“java.lang.RuntimeException: don't run elasticsearch as root.” 原因是这是出于系统安全考虑设置的条件。由于ElasticSearch可以接收用户输入的脚本并且执行，为了系统安全考虑，建议创建一个单独的用户用来运行ElasticSearch

[root@candaotool bin]# ./elasticsearch
Exception in thread "main" java.lang.RuntimeException: don't run elasticsearch as root.
    at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:93)
    at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:144)
    at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:270)
    at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35)
Refer to the log for complete error details.

创建elsearch用户组及elsearch用户

groupadd elsearch
useradd elsearch -g elsearch -p elasticsearch

更改elasticsearch文件夹及内部文件的所属用户及组为elsearch:elsearch
```
cd /opt
chown -R elsearch:elsearch  elasticsearch
```
切换到elsearch用户再启动

su elsearch cd elasticsearch/bin
./elasticsearch

运行输出：

[elasticsearch@candaotool bin]$ ./elasticsearch
[2016-04-14 16:22:19,887][WARN ][bootstrap                ] unable to install syscall filter: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, 
CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed
[2016-04-14 16:22:20,200][INFO ][node                     ] [Jack O'Lantern] version[2.3.1], pid[2805], build[bd98092/2016-04-04T12:25:05Z]
[2016-04-14 16:22:20,201][INFO ][node                     ] [Jack O'Lantern] initializing ...
[2016-04-14 16:22:20,806][INFO ][plugins                  ] [Jack O'Lantern] modules [lang-groovy, reindex, lang-expression], plugins [], sites []

ElasticSearch后端启动命令　　
```
./elasticsearch -d
```
检验服务是否正常，如果想通过IP地址访问，那么需要修改config/elasticsearch.yml文件中的network.host: 192.168.87.8，这样就可以通过http://192.168.87.8:9200访问了。后续kibana中也可以顺利配置这个IP和端口了。

curl -X GET http://localhost:9200

[elasticsearch@candaotool bin]$ curl -X GET http://localhost:9200
{
  "name" : "Spectral",
  "cluster_name" : "elasticsearch",
  "version" : {
    "number" : "2.3.1",
    "build_hash" : "bd980929010aef404e7cb0843e61d0665269fc39",
    "build_timestamp" : "2016-04-04T12:25:05Z",
    "build_snapshot" : false,
    "lucene_version" : "5.5.0"
  },
  "tagline" : "You Know, for Search"
}

到此，表示服务正常运行！

如果搭建ES（2.X版本以后）集群的话，需要手动修改一下elasticsearch.yml文件：

# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
# discovery.zen.ping.unicast.hosts: ["host1", "host2"]
#
# Prevent the "split brain" by configuring the majority of nodes (total number of nodes / 2 + 1):
#
# discovery.zen.minimum_master_nodes: 3
#
# For more information, see the documentation at:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-discovery.html>

资源参考：
- https://www.elastic.co/download
  https://www.elastic.co/downloads/elasticsearch
  http://my.oschina.net/topeagle/blog/591451
  http://stackoverflow.com/questions/34920801/how-to-run-elasticsearch-2-1-1-as-root-user-in-linux-machine
- http://kibana.logstash.es/content/kibana/v4/setup.html
- https://www.elastic.co/guide/en/kibana/current/setup.html 提到了安装为服务的方法

点滴积累，每天进步一点点！O(∩_∩)O~

【centos】安装ELK之ElasticSearch

ElasticSearch后端启动命令

ElasticSearch后端启动命令　　