(轉)搭建Elasticsearch和kibana環境

搭建Elasticsearch和kibana環境

做者：IT雲清 
原文：https://blog.csdn.net/weixin_39800144/article/details/81162002

 

1.Elasticsearch和kibana均基於5.5.3版本；
官方建議：在兩者版本選擇時，Elasticsearch應該大於等於kibana版本，不然在使用和升級過程當中會出問題，截至文章出稿，已經更新到6.3.0版本，本文以5.5.3版本爲例，對其餘版本安裝有一樣的參考做用。
2.服務器配置爲：阿里雲ECS，1核,2G內存
3.系統版本爲：CentOS Linux release 7.4.1708 (Core)
4.本教程重點在於「如何搭建Elasticsearch-kibana 環境」，對於兩者是什麼，能幹什麼，使用場景，這裏不作過多說明，讀者可自行查詢資料；Elasticsearch如何使用，做者後期會出Elasticsearch從入門到實戰系列教程。
5.搭建此環境的難點在於：過程當中會出現各類配置問題，須要修改，可是網上資料殘次不齊，或者不全，或者只給出了一行解決命令，可是沒有解釋爲何這麼修改，這個命令是幹什麼的，對於linux基礎很差的讀者而言，盲目執行命令可能會對服務器有負面影響；本文不敢說全面，可是給出解決方案時，會詳細告知這個命令的做用和使用方法；
6.因爲系統環境不一樣，本文確定沒有周全的給出全部的問題解決方案，若是有新問題，樂於一塊兒探討解決，微信：w1186355422。
本文共分爲如下幾個步驟：
1.檢查jdk版本：
2.下載elasticsearch安裝包，解壓
3.啓動elasticsearch
3.1解決 內存分配問題
3.2解決 用戶權限問題
3.3解決 外網沒法訪問問題
3.4解決 ERROR: [2] bootstrap checks failed
3.41解決 max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
3.42解決 max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536]
3.5Elasticsearch 後臺啓動
3.6中止後臺服務
4.下載 kibana安裝包，解壓
5.啓動 kibana
5.1解決 kibana外網沒法訪問
5.2 kibana後臺啓動
6.kibana目錄結構分析
1.檢查jdk版本：
es使用java編寫，安裝es以前，須要先檢查jdk環境，通常要求在1.7以上，若是沒有安裝jdk，建議直接安裝1.8版本。安裝過程參考：https://blog.csdn.net/weixin_39800144/article/details/78836289

[root@izbp163wlhi02tcaxyuxb7z wang]# yum install java-1.8.0-openjdk* -y

java -version
java version "1.8.0_172"
Java(TM) SE Runtime Environment (build 1.8.0_172-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.172-b11, mixed mode)

2.下載elasticsearch安裝包，解壓
官方地址：https://www.elastic.co/downloads/past-releases

我這裏安裝在linux環境，下載tar包，下載完後解壓：

tar -zxvf elasticsearch-5.5.3.tar.gz

3.啓動elasticsearch
在bin/目錄下，直接執行 ./elasticsearch命令便可。

因爲elasticsearch運行的環境需求，默認的系統環境通常都須要再作調整，啓動可能會報以下的一些錯誤：

3.1解決 內存分配問題
[root@izbp163wlhi02tcaxyuxb7z elasticsearch-5.5.3]# ./bin/elasticsearch
Java HotSpot(TM) 64-Bit Server VM warning:

INFO: os::commit_memory(0x0000000085330000, 2060255232, 0) failed; error='Cannot allocate memory' (errno=12)
#
# There is insufficient memory for the Java Runtime Environment to continue.
# Native memory allocation (mmap) failed to map 2060255232 bytes for committing reserved memory.
# An error report file with more information is saved as:
# /usr/local/wang/elasticsearch-5.5.3/hs_err_pid15795.log

緣由：這是因爲elasticsearch這個版本默認分配jvm空間大小爲2g(不一樣版本默認值不同)，而示例所用服務器爲1核2G，因此會報出內存分配錯誤，咱們去配置文件修改jvm空間分配：

// 文件目錄在：/elasticsearch-5.5.3/config
[root@izbp163wlhi02tcaxyuxb7z config]# vim jvm.options

將

-Xms2g
-Xmx2g

改成

-Xms512m
-Xmx512m

若是仍是報這個錯誤，那繼續減少這個數值，這個得看機器配置。

3.2解決 用戶權限問題
錯誤：

[2018-07-04T10:43:45,590][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:127) ~[elasticsearch-5.5.3.jar:5.5.3]
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:114) ~[elasticsearch-5.5.3.jar:5.5.3]
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:67) ~[elasticsearch-5.5.3.jar:5.5.3]
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122) ~[elasticsearch-5.5.3.jar:5.5.3]
at org.elasticsearch.cli.Command.main(Command.java:88) ~[elasticsearch-5.5.3.jar:5.5.3]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:91) ~[elasticsearch-5.5.3.jar:5.5.3]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:84) ~[elasticsearch-5.5.3.jar:5.5.3]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:106) ~[elasticsearch-5.5.3.jar:5.5.3]
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:194) ~[elasticsearch-5.5.3.jar:5.5.3]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:351) ~[elasticsearch-5.5.3.jar:5.5.3]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:123) ~[elasticsearch-5.5.3.jar:5.5.3]
... 6 more

//查看當前用戶
[root@izbp163wlhi02tcaxyuxb7z elasticsearch-5.5.3]# whoami
root

緣由：因爲Elasticsearch能夠輸入且執行腳本，爲了系統安全，不容許使用root啓動；咱們看看有沒有可用的用戶

[root@izbp163wlhi02tcaxyuxb7z elasticsearch-5.5.3]# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
polkitd:x:999:997:User for polkitd:/:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
chrony:x:998:996::/var/lib/chrony:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
dockerroot:x:997:994:Docker User:/var/lib/docker:/sbin/nologin
//用戶名：密碼：用戶id:用戶所在組id：備註：用戶家目錄：shell命令所在目錄

若是發現用戶都是系統自帶的用戶，那咱們最好仍是本身新建一個用戶，我這裏新建一個用戶wang，分組爲wang，密碼爲wang

//添加分組wang
groupadd wang

//添加用戶wang，分組在wang,密碼wang
useradd wang -g wang -p wang

//受權 /usr/local/wang/elasticsearch-5.5.3目錄下的文件擁有者爲 wang（用戶）：wang（分組）
chown -R wang:wang /usr/local/wang/elasticsearch-5.5.3

//切換用戶
//使用su和sudo是有區別的，使用su切換用戶須要輸入所切換到的用戶的密碼，而使用sudo則是當前用戶的密碼。
su wang

再次啓動。

記住：後面修改文件時有時須要切到root用戶，可是啓動時記得切回來，不要在root下啓動！
[wang@izbp163wlhi02tcaxyuxb7z elasticsearch-5.5.3]$ ./bin/elasticsearch
[2018-07-04T11:25:22,745][INFO ][o.e.n.Node ] [] initializing ...
[2018-07-04T11:25:22,891][INFO ][o.e.e.NodeEnvironment ] [VKU0UAW] using [1] data paths, mounts [[/ (rootfs)]], net usable_space [32.9gb], net total_space [39.2gb], spins? [unknown], types [rootfs]
[2018-07-04T11:25:22,892][INFO ][o.e.e.NodeEnvironment ] [VKU0UAW] heap size [503.6mb], compressed ordinary object pointers [true]
[2018-07-04T11:25:22,894][INFO ][o.e.n.Node ] node name [VKU0UAW] derived from node ID [VKU0UAWPT06PPv0aYHIuDw]; set [node.name] to override
[2018-07-04T11:25:22,894][INFO ][o.e.n.Node ] version[5.5.3], pid[16641], build[9305a5e/2017-09-07T15:56:59.599Z], OS[Linux/3.10.0-693.2.2.el7.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0_172/25.172-b11]
[2018-07-04T11:25:22,894][INFO ][o.e.n.Node ] JVM arguments [-Xms512m, -Xmx512m, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -Djdk.io.permissionsUseCanonicalPath=true, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Dlog4j.skipJansi=true, -XX:+HeapDumpOnOutOfMemoryError, -Des.path.home=/usr/local/wang/elasticsearch-5.5.3]
[2018-07-04T11:25:25,352][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [aggs-matrix-stats]
[2018-07-04T11:25:25,353][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [ingest-common]
[2018-07-04T11:25:25,353][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [lang-expression]
[2018-07-04T11:25:25,353][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [lang-groovy]
[2018-07-04T11:25:25,353][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [lang-mustache]
[2018-07-04T11:25:25,353][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [lang-painless]
[2018-07-04T11:25:25,353][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [parent-join]
[2018-07-04T11:25:25,353][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [percolator]
[2018-07-04T11:25:25,353][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [reindex]
[2018-07-04T11:25:25,353][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [transport-netty3]
[2018-07-04T11:25:25,353][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [transport-netty4]
[2018-07-04T11:25:25,354][INFO ][o.e.p.PluginsService ] [VKU0UAW] no plugins loaded
[2018-07-04T11:25:28,878][INFO ][o.e.d.DiscoveryModule ] [VKU0UAW] using discovery type [zen]
[2018-07-04T11:25:29,988][INFO ][o.e.n.Node ] initialized
[2018-07-04T11:25:29,988][INFO ][o.e.n.Node ] [VKU0UAW] starting ...
[2018-07-04T11:25:30,358][INFO ][o.e.t.TransportService ] [VKU0UAW] publish_address {127.0.0.1:9300}, bound_addresses {127.0.0.1:9300}
[2018-07-04T11:25:30,377][WARN ][o.e.b.BootstrapChecks ] [VKU0UAW] max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536]
[2018-07-04T11:25:30,377][WARN ][o.e.b.BootstrapChecks ] [VKU0UAW] max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[2018-07-04T11:25:33,470][INFO ][o.e.c.s.ClusterService ] [VKU0UAW] new_master {VKU0UAW}{VKU0UAWPT06PPv0aYHIuDw}{gqVgexbbSx-6IWNhGSzvRw}{127.0.0.1}{127.0.0.1:9300}, reason: zen-disco-elected-as-master ([0] nodes joined)
[2018-07-04T11:25:33,589][INFO ][o.e.h.n.Netty4HttpServerTransport] [VKU0UAW] publish_address {127.0.0.1:9200}, bound_addresses {127.0.0.1:9200}
[2018-07-04T11:25:33,590][INFO ][o.e.n.Node ] [VKU0UAW] started
[2018-07-04T11:25:33,618][INFO ][o.e.g.GatewayService ] [VKU0UAW] recovered [0] indices into cluster_state

啓動成功後，經過啓動信息，咱們能夠知道默認的端口在9200，可是信息中有兩個warn級別的日誌，咱們先去瀏覽器訪問的試試

http://xx.xx.xx.xx:9200
1
發現仍是沒法訪問

3.3 沒法訪問
緣由：默認訪問地址是localhost，咱們要外網訪問，須要去修改下配置文件，elasticsearch-5.5.3/config下的elasticsearch.yml

vim elasticsearch.yml

將network.host放開，修改成0.0.0.0下，將http.port放開，以下：

# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
#network.host: 192.168.0.1
network.host: 0.0.0.0
#
# Set a custom port for HTTP:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#

再次嘗試啓動

3.4 解決 ERROR: [2] bootstrap checks failed
[2018-07-04T16:00:28,070][INFO ][o.e.n.Node ] initialized
[2018-07-04T16:00:28,070][INFO ][o.e.n.Node ] [VKU0UAW] starting ...
[2018-07-04T16:00:28,377][INFO ][o.e.t.TransportService ] [VKU0UAW] publish_address {172.16.229.31:9300}, bound_addresses {0.0.0.0:9300}
[2018-07-04T16:00:28,401][INFO ][o.e.b.BootstrapChecks ] [VKU0UAW] bound or publishing to a non-loopback or non-link-local address, enforcing bootstrap checks
ERROR: [2] bootstrap checks failed
[1]: max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536]
[2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[2018-07-04T16:00:28,485][INFO ][o.e.n.Node ] [VKU0UAW] stopping ...
[2018-07-04T16:00:28,535][INFO ][o.e.n.Node ] [VKU0UAW] stopped
[2018-07-04T16:00:28,536][INFO ][o.e.n.Node ] [VKU0UAW] closing ...
[2018-07-04T16:00:28,550][INFO ][o.e.n.Node ] [VKU0UAW] closed

這裏實際上是兩個錯誤，就是前面的兩個warn信息

3.41 解決 max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
緣由：max_map_count這個參數就是容許一個進程在VMAs(虛擬內存區域)擁有最大數量，VMA是一個連續的虛擬地址空間，當進程建立一個內存映像文件時VMA的地址空間就會增長，當達到max_map_count了就是返回out of memory errors。
出現這個問題，咱們須要切換到root用戶下

// 修改下面的文件 裏面是一些內核參數
vi /etc/sysctl.conf

//添加如下配置
vm.max_map_count=655360

添加完後保存，而後執行

sysctl -p
//-p 從指定的文件加載系統參數，如不指定即從/etc/sysctl.conf中加載
1
2
3.42 解決 max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536]
緣由：最大文件打開數量過小，出現此錯誤，切換到root用戶下，修改limits.conf

// 編輯此文件
[root@izbp163wlhi02tcaxyuxb7z /]# vim etc/security/limits.conf

在文件後加上

* soft nofile 65536
* hard nofile 65536

5.5.3版本，此文件有這幾個值，咱們只須要把這幾個值從65535改成65536便可。

# End of file
root soft nofile 65536
root hard nofile 65536
* soft nofile 65536
* hard nofile 65536

切回原來用戶，再次重啓es，檢查ES是否啓動成功
啓動成功後提示以下：

[wang@izbp163wlhi02tcaxyuxb7z elasticsearch-5.5.3]$ ./bin/elasticsearch
[2018-07-04T16:28:45,250][INFO ][o.e.n.Node ] [] initializing ...
[2018-07-04T16:28:45,359][INFO ][o.e.e.NodeEnvironment ] [VKU0UAW] using [1] data paths, mounts [[/ (rootfs)]], net usable_space [32.9gb], net total_space [39.2gb], spins? [unknown], types [rootfs]
[2018-07-04T16:28:45,361][INFO ][o.e.e.NodeEnvironment ] [VKU0UAW] heap size [503.6mb], compressed ordinary object pointers [true]
[2018-07-04T16:28:45,362][INFO ][o.e.n.Node ] node name [VKU0UAW] derived from node ID [VKU0UAWPT06PPv0aYHIuDw]; set [node.name] to override
[2018-07-04T16:28:45,362][INFO ][o.e.n.Node ] version[5.5.3], pid[21467], build[9305a5e/2017-09-07T15:56:59.599Z], OS[Linux/3.10.0-693.2.2.el7.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0_172/25.172-b11]
[2018-07-04T16:28:45,363][INFO ][o.e.n.Node ] JVM arguments [-Xms512m, -Xmx512m, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -Djdk.io.permissionsUseCanonicalPath=true, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Dlog4j.skipJansi=true, -XX:+HeapDumpOnOutOfMemoryError, -Des.path.home=/usr/local/wang/elasticsearch-5.5.3]
[2018-07-04T16:28:46,941][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [aggs-matrix-stats]
[2018-07-04T16:28:46,941][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [ingest-common]
[2018-07-04T16:28:46,941][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [lang-expression]
[2018-07-04T16:28:46,941][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [lang-groovy]
[2018-07-04T16:28:46,941][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [lang-mustache]
[2018-07-04T16:28:46,941][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [lang-painless]
[2018-07-04T16:28:46,941][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [parent-join]
[2018-07-04T16:28:46,950][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [percolator]
[2018-07-04T16:28:46,950][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [reindex]
[2018-07-04T16:28:46,950][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [transport-netty3]
[2018-07-04T16:28:46,950][INFO ][o.e.p.PluginsService ] [VKU0UAW] loaded module [transport-netty4]
[2018-07-04T16:28:46,950][INFO ][o.e.p.PluginsService ] [VKU0UAW] no plugins loaded
[2018-07-04T16:28:50,067][INFO ][o.e.d.DiscoveryModule ] [VKU0UAW] using discovery type [zen]
[2018-07-04T16:28:51,171][INFO ][o.e.n.Node ] initialized
[2018-07-04T16:28:51,172][INFO ][o.e.n.Node ] [VKU0UAW] starting ...
[2018-07-04T16:28:51,484][INFO ][o.e.t.TransportService ] [VKU0UAW] publish_address {172.16.229.31:9300}, bound_addresses {0.0.0.0:9300}
[2018-07-04T16:28:51,513][INFO ][o.e.b.BootstrapChecks ] [VKU0UAW] bound or publishing to a non-loopback or non-link-local address, enforcing bootstrap checks
[2018-07-04T16:28:54,650][INFO ][o.e.c.s.ClusterService ] [VKU0UAW] new_master {VKU0UAW}{VKU0UAWPT06PPv0aYHIuDw}{1HxIYnvrQ9KkyLOzhVwe3Q}{172.16.229.31}{172.16.229.31:9300}, reason: zen-disco-elected-as-master ([0] nodes joined)
[2018-07-04T16:28:54,708][INFO ][o.e.h.n.Netty4HttpServerTransport] [VKU0UAW] publish_address {172.16.229.31:9200}, bound_addresses {0.0.0.0:9200}
[2018-07-04T16:28:54,708][INFO ][o.e.n.Node ] [VKU0UAW] started
[2018-07-04T16:28:54,738][INFO ][o.e.g.GatewayService ] [VKU0UAW] recovered [0] indices into cluster_state
[2018-07-04T16:38:43,328][INFO ][o.e.c.m.MetaDataCreateIndexService] [VKU0UAW] [.kibana] creating index, cause [api], templates [], shards [1]/[1], mappings [_default_, index-pattern, server, visualization, search, timelion-sheet, config, dashboard, url]

仔細檢查，日誌都是info級別，沒有問題，去頁面訪問xx.xx.xx.xx:9200
頁面會出現以下信息：

{
"name": "VKU0UAW",
"cluster_name": "elasticsearch",
"cluster_uuid": "TTJuSo16Tny1lUoFmnF-dA",
"version": {
"number": "5.5.3",
"build_hash": "9305a5e",
"build_date": "2017-09-07T15:56:59.599Z",
"build_snapshot": false,
"lucene_version": "6.6.0"
},
"tagline": "You Know, for Search"
}

至此，Elasticsearch安裝完畢。

3.5 後臺啓動Elasticsearch
下面這種方式是在前臺啓動，咱們關閉命令行或者退出，應用就會關閉

[wang@izbp163wlhi02tcaxyuxb7z elasticsearch-5.5.3]$ ./bin/elasticsearch
1
因此，咱們須要在後臺啓動，這樣當咱們退出時，應用仍在後臺運行

[wang@izbp163wlhi02tcaxyuxb7z elasticsearch-5.5.3]$ ./bin/elasticsearch -d
3.6 中止後臺服務
前臺啓動，直接ctrl+c退出便可，後臺啓動，中止時能夠直接殺掉進程

[wang@izbp163wlhi02tcaxyuxb7z bin]$ ./elasticsearch -d
[wang@izbp163wlhi02tcaxyuxb7z bin]$ jps
3697 Elasticsearch
3771 Jps
[wang@izbp163wlhi02tcaxyuxb7z bin]$ kill -9 3697

4.下載 kibana安裝包，解壓
每個版本的es都有一個對應的Kibana版本，咱們能夠去下面的地址查找最新的版本，建議和es相同版本；

下載地址：https://www.elastic.co/downloads/past-releases

//解壓：
tar -zxvf kibana-5.5.3-linux-x86_64.tar.gz

5.啓動 kibana
[wang@izbp163wlhi02tcaxyuxb7z kibana-5.5.3-linux-x86_64]$ ./bin/kibana
kibana默認是在前臺啓動，能夠經過ctrl+c命令中止。

解壓時的文件夾下裝着全部kibana相關的文件，咱們不用新建其餘文件，當咱們須要刪除時，直接刪除此文件夾便可。

啓動後消息以下：

[wang@izbp163wlhi02tcaxyuxb7z kibana-5.5.3-linux-x86_64]$ ./bin/kibana
log [03:49:45.116] [info][status][plugin:kibana@5.5.3] Status changed from uninitialized to green - Ready
log [03:49:45.188] [info][status][plugin:elasticsearch@5.5.3] Status changed from uninitialized to yellow - Waiting for Elasticsearch
log [03:49:45.215] [error][admin][elasticsearch] Request error, retrying
HEAD http://localhost:9200/ => connect ECONNREFUSED 127.0.0.1:9200
log [03:49:45.219] [info][status][plugin:console@5.5.3] Status changed from uninitialized to green - Ready
log [03:49:45.224] [warning][admin][elasticsearch] Unable to revive connection: http://localhost:9200/
log [03:49:45.225] [warning][admin][elasticsearch] No living connections
log [03:49:45.228] [error][status][plugin:elasticsearch@5.5.3] Status changed from yellow to red - Unable to connect to Elasticsearch at http://localhost:9200.
log [03:49:45.251] [info][status][plugin:metrics@5.5.3] Status changed from uninitialized to green - Ready
log [03:49:45.454] [info][status][plugin:timelion@5.5.3] Status changed from uninitialized to green - Ready
log [03:49:45.459] [info][listening] Server running at http://localhost:5601
log [03:49:45.461] [error][status][ui settings] Status changed from uninitialized to red - Elasticsearch plugin is red
log [03:49:47.735] [warning][admin][elasticsearch] Unable to revive connection: http://localhost:9200/
log [03:49:47.735] [warning][admin][elasticsearch] No living connections
log [03:49:50.244] [warning][admin][elasticsearch] Unable to revive connection: http://localhost:9200/
log [03:49:50.245] [warning][admin][elasticsearch] No living connections
log [03:49:52.751] [warning][admin][elasticsearch] Unable to revive connection: http://localhost:9200/
log [03:49:52.751] [warning][admin][elasticsearch] No living connections
......

咱們能夠看到，他會默認去連接同一臺服務器上的9200端口提供的服務，若是沒有啓動elasticSearch服務，他會一直嘗試去鏈接,咱們啓動下elasticSearch；

訪問：
http://xx.xx.xx.xx:5601
而後發現訪問不了，咱們注意上面的日誌，有這麼一句：

log [03:49:45.459] [info][listening] Server running at http://localhost:5601
1
5.1 kibana外網沒法訪問
在config/kibana.yml中，有以下配置，意思是默認是localhost，外網是沒法訪問的，若是外網想訪問，那須要修改一下server.host

# Kibana is served by a back end server. This setting specifies the port to use.
#server.port: 5601

# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
#server.host: "localhost"

咱們放開端口，放開server.host，並修改以下：

server.port: 5601
server.host: 0.0.0.0

意思是任何人均可以訪問，而後再次啓動，訪問http://xx.xx.xx.xx:5601
出現以下頁面，說明大功告成。

 

5.2kibana後臺啓動
當使用前臺啓動時，若是咱們退出終端，服務就會中止，咱們可使用nohup命令來啓動；

[root@izbp163wlhi02tcaxyuxb7z kibana-5.5.3-linux-x86_64]# nohup ./bin/kibana &

nohup命令：若是你在運行一個進程，你但願在退出帳戶或者關閉終端時繼續運行相應的進程，就可使用nohup(no hang up);該命令格式爲：nohup command &

6. kibana目錄結構分析
咱們查看下kibana的目錄

[wang@izbp163wlhi02tcaxyuxb7z kibana-5.5.3-linux-x86_64]$ ls
bin config data LICENSE.txt node node_modules NOTICE.txt optimize package.json plugins README.txt src ui_framework webpackShims

bin： 二進制腳本，包括 kibana 啓動 Kibana 服務和 kibana-plugin 安裝插件。config： 配置文件，包括 kibana.yml 。data： Kibana 和其插件寫入磁盤的數據文件位置。optimize： 編譯過的源碼。某些管理操做(如，插件安裝)致使運行時從新編譯源碼。plugins： 插件文件位置。每個插件都有一個單獨的二級目錄。