ElasticSearch及其插件安装配置

elasticsearch安装使用

elasticsearch是支持Linux和window系统的，elasticsearch官网上最新的稳定版本是6,2,4，该版本不支持jdk8以下的，所以需要在你的系统下安装好jdk8。
安装步骤：

1、下载elasticsearch的rpm包：

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.4.2-x86_64.rpm

2. 安装elasticsearch

rpm install -y elasticsearch-7.4.2-x86_64.rpm

3. 启动

systemctl start elasticsearch
或者
 /etc/init.d/elasticsearch start

4. 验证是否启动

运行
curl http://localhost:9200/ 
在PowerShell运行
Invoke-RestMethod http://localhost:9200

5.配置elasticsearch

[root@linux-node1 elasticsearch]# grep '^[a-Z]' /etc/elasticsearch/elasticsearch.yml 
cluster.name: elk-cluster1 #集群名称
path.data: /elk/data/     # 配置路径
path.logs: /elk/logs/
node.name: elk-node1      #节点名称
network.host: 192.168.1.1 #配置本地IP地址获域名
http.port: 9200  
discovery.zen.ping.unicast.hosts: ["192.168.1.1", "192.168.1.2"] #配置广播范围

6. 配置路径问题解决

mkdir /elk
chown elasticsearch.elasticsearch /elk 给elk目录授权给elasticsearch
重启 systemctl restart elasticsearch

elasticsearch-head 配置使用

git clone git://github.com/mobz/elasticsearch-head.git
cd elasticsearch-head
npm install
npm run start &  or grunt server &
open http://localhost:9100/

配置elasticsearch 允许elasticsearch-head连接elasticsearch

http.cors.enabled: true   # 开启http访问
http.cors.allow-origin: “*”   # 可访问的IP地址

elasticsearch内存优化

查看elasticsearch状态

[root@linux-node1 ~]# ps -ef |grep elasticsearch
elastic+   3964      1  2 10:58 ?        00:00:53 /bin/java -Xms2g -Xmx2g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+Us
eCMSInitiatingOccupancyOnly -XX:+AlwaysPreTouch -server -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -Djdk.io.permissi
onsUseCanonicalPath=true -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdo
wnHookEnabled=false -Dlog4j2.disable.jmx=true -Dlog4j.skipJansi=true -XX:+HeapDumpOnOutOfMemoryError -Des.path.home=/usr/share/elasticsearch -cp 
/usr/share/elasticsearch/lib/* org.elasticsearch.bootstrap.Elasticsearch -p /var/run/elasticsearch/elasticsearch.pid --quiet -Edefault.path.logs=
/var/log/elasticsearch -Edefault.path.data=/var/lib/elasticsearch -Edefault.path.conf=/etc/elasticsearch
root       4083   1539  0 11:40 pts/0    00:00:00 grep --color=auto elasticsearch

可以看到elasticsearch可使用的最小和最大内存都是2G

官方文档

https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html

修改启动脚本

vim /usr/lib/systemd/system/elasticsearch.service
# 最下面添加
LimitMEMLOCK=infinity

systemctl daemon-reload
systemctl restart elasticsearch

修改elastic配置文件锁定内存，这样在后期数据量比较大的时候，运行速度会比较快

vim /etc/elasticsearch/elasticsearch.yml

bootstrap.memory_lock: true

更改jvm.options 根据自己电脑的配置增加运行内存最大32G

vim /etc/elasticsearch/jvm.options

# add code

-Xms3g
-Xmx3g

获取节点状态值

curl -sXGET http://192.168.56.12:9200/_cluster/health?pretty=true

使用脚本获取节点状态值然后可以和zabbix结合报警

import json
import subprocess
false = "false"
obj = subprocess.Popen(("curl -sXGET http://192.168.56.12:9200/_cluster/health?pretty=true"),shell=True,st
dout=subprocess.PIPE)
data = obj.stdout.read()
data1 = json.loads(data)
status=data1.get("status")
if status == "green":
    print("50")
else:
    print("100")