ELK-Elasticsearch安裝

一、安裝JDK
必須安裝JDK而且要求版本至少是1.8以上包含1.8的版本。

二、建立 es 用戶
這裏須要注意的是，es 規定 root 用戶不能啓動 es，因此須要建立一個用戶來啓動 es

# 建立用戶名爲 es 的用戶
useradd es
# 設置 es 用戶的密碼
passwd es

# 切換到 es 用戶下
su es

三、安裝Elasticsearch

3.一、下載壓縮包
# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.2.2.tar.gz
3.二、執行解壓縮
# tar -zxvf elasticsearch-6.2.2.tar.gz
3.三、啓動elasticsearch
# cd elasticsearch-6.2.2/bin
# ./elasticsearch

如下日誌是成功啓動

[2019-03-20T16:20:46,911][INFO ][o.e.c.s.ClusterApplierService] [MoeCA8i] new_master {MoeCA8i}{MoeCA8iYR96bKyfVnwxvjw}{9ihQwgpMRfyd3Df2swYyWg}{127.0.0.1}{127.0.0.1:9300}, reason: apply cluster state (from master [master {MoeCA8i}{MoeCA8iYR96bKyfVnwxvjw}{9ihQwgpMRfyd3Df2swYyWg}{127.0.0.1}{127.0.0.1:9300} committed version [1] source [zen-disco-elected-as-master ([0] nodes joined)]])
[2019-03-20T16:20:46,962][INFO ][o.e.h.n.Netty4HttpServerTransport] [MoeCA8i] publish_address {127.0.0.1:9200}, bound_addresses {127.0.0.1:9200}
[2019-03-20T16:20:46,963][INFO ][o.e.n.Node               ] [MoeCA8i] started
[2019-03-20T16:20:47,011][INFO ][o.e.g.GatewayService     ] [MoeCA8i] recovered [0] indices into cluster_state

3.四、測試訪問
# curl localhost:9200

{
  "name" : "TpKF8Pj",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "ff51GJFuTKyXRm4r-8y_Aw",
  "version" : {
    "number" : "6.2.2",
    "build_hash" : "10b1edd",
    "build_date" : "2018-02-16T19:01:30.685723Z",
    "build_snapshot" : false,
    "lucene_version" : "7.2.1",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}

注意：啓動es後按ctrl + c會時es中止運行，最好啓動時加入後臺運行模式：./elasticsearch &

3.五、關閉elasticSearch
# 找到elasticsearch的進程號
# jps | grep Elasticsearch
3673 Elasticsearch

# kill -9 3673

可能遇到的錯誤：
問題一：
max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

解決方法：
#切換到root用戶修改
vim /etc/security/limits.conf

# 在最後面追加下面內容
es hard nofile 65536
es soft nofile 65536

問題二：
max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解決方法 提升vm.max_map_count 的大小
# 切換到root用戶
vim /etc/sysctl.conf
# 在最後面追加下面內容
vm.max_map_count=262144
# 使用 sysctl -p 查看修改後的結果
sysctl -p

問題三：
Java HotSpot(TM) 64-Bit Server VM warning: INFO: os::commit_memory(0x0000000085330000, 2060255232, 0) failed; error='Cannot allocate memory' (errno=12)

解決方法：
# 因爲elasticsearch5.0默認分配jvm空間大小爲2g，修改jvm空間分配
# 若是使用虛擬機安裝，內存最好不小於2G
# vim config/jvm.options
-Xms512m
-Xmx512m

在阿里雲上可能出現的問題：
system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

解決方法：在es配置中加入下面命令便可
bootstrap.system_call_filter: false