ELK -- ElasticSearch集羣安裝、配置及錯誤處理

ElasticSearch

現有三臺服務器[192.168.1.30, 192.168.1.31, 192.168.1.32],使用這三臺服務器搭建ElasticSearch集羣

CentOS 使用 yum 安裝

編輯 repo

vim /etc/yum.repos.d/elasticsearch.repo

# 內容以下

[elasticsearch-6.x]
name=Elasticsearch repository for 6.x packages
baseurl=https://artifacts.elastic.co/packages/6.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

使用yum安裝

yum install elasticsearch

建立用戶

useradd elastic

修改權限

# 數據
chown -R elastic:elastic /var/lib/elasticsearch

# 日誌
chown -R elastic:elastic /var/log/elasticsearch

# 配置
chown -R elastic:elastic /etc/elasticsearch
chown -R elastic:elastic /etc/sysconfig/elasticsearch

# 指令
chown -R elastic:elastic /usr/share/elasticsearch

配置

# 主節點 192.168.1.30

vim /etc/elasticsearch/elasticsearch.yml

# 修改如下幾項

cluster.name: etl_es

node.name: node-30
node.master: true
node.data: false

bootstrap.memory_lock: false
bootstrap.system_call_filter: false

network.host: 0.0.0.0
http.port: 9200
http.cors.enabled: true
http.cors.allow-origin: "*"

discovery.zen.ping.unicast.hosts: ["192.168.1.30"]

# 從節點 192.168.1.31

vim /etc/elasticsearch/elasticsearch.yml

# 修改如下幾項

cluster.name: etl_es

node.name: node-31
node.master: false
node.data: true

bootstrap.memory_lock: false
bootstrap.system_call_filter: false

network.host: 0.0.0.0
http.port: 9200
http.cors.enabled: true
http.cors.allow-origin: "*"

discovery.zen.ping.unicast.hosts: ["192.168.1.30"]

# 從節點 192.168.1.32

vim /etc/elasticsearch/elasticsearch.yml

# 修改如下幾項
# 其餘項配置與1.31配置相同

node.name: node-32

啓動 參數-d爲後臺運行(測試經過後 可加上此參數)

su elastic
/usr/share/elasticsearch/bin/elasticsearch -d

可能遇到的錯誤

ERROR: [4] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
[2]: max number of threads [1024] for user [elastic] is too low, increase to at least [4096]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[4]: system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk



# 解決
1. 首先切換到root身份
2. 針對 問題[1]

    vim /etc/security/limits.conf
    # 添加如下內容:
        * soft nofile 65536
        * hard nofile 131072
        * soft nproc 2048
        * hard nproc 4096
        
3. 針對 問題[2]
    vim /etc/security/limits.d/90-nproc.conf
    修改"* soft nproc 1024"爲"* soft nproc 4096"
  
4. 針對 問題[3]
    # 編輯
    vim /etc/sysctl.conf 
    #添加以下內容:
    vm.max_map_count=655360
    # 執行
    sysctl -p
    
5. 針對 問題[4]
    編輯 /etc/elasticsearch/elasticsearch.yml, Memory下修改:
        bootstrap.memory_lock: false
        bootstrap.system_call_filter: false