什麼是ElasticSearch?
ElasticSearch是一個基於Lucene的搜索服務器
（Lucene是apache軟件基金會4 jakarta項目組的一個子項目，是一個開放源代碼的全文檢索引擎工具包）
它提供了一個分佈式多用戶能力的全文搜索引擎，基於RESTful web接口。
Elasticsearch是用Java語言開發的，並作爲Apache許可條款下的開放源碼發佈，是一種流行的企業級搜索引擎。ElasticSearch用於雲計算中，能夠達到實時搜索，穩定，可靠，快速，安裝使用方便。官方客戶端在Java、.NET（C#）、PHP、Python、Apache Groovy、Ruby和許多其他語言中都是可用的。
根據DB-Engines的排名顯示，Elasticsearch是最受歡迎的企業搜索引擎，其次是Apache Solr，也是基於Lucene。
官網：https://www.elastic.co/cn/
概念
索引，類型，文檔
索引：
存放數據的地方，可以理解爲Mysql中的一個數據庫。
類型：
類型用來定義數據結構，可以理解爲Mysql中的一張表。
文檔：
文檔就是最終的數據，可以理解Mysql表中的數據。
筆記
反向索引又叫倒排索引，是根據文章內容中的關鍵字建立索引。
搜索引擎原理就是建立反向索引。
Elasticsearch 在 Lucene 的基礎上進行封裝，實現了分佈式搜索引擎。
Elasticsearch 中的索引、類型和文檔的概念比較重要，類似於 MySQL 中的數據庫、表和行。
Elasticsearch 也是 Master-slave 架構，也實現了數據的分片和備份。
Elasticsearch 一個典型應用就是 ELK 日誌分析系統。
http://developer.51cto.com/art/201904/594615.htm
ElasticSearch安裝（Linux單節點）
1，下載
https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.6.2.tar.gz
2，上傳解壓
我這裏的目錄是這個
/opt/moudle/elasticsearch-5.6.2
3，在/opt/moudle/elasticsearch-5.6.2路徑下創建data和logs文件夾
mkdir data
mkdir logs
4，修改配置文件/opt/moudle/elasticsearch-5.6.2/config/elasticsearch.yml
源文件
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
#path.data: /path/to/data
#
# Path to log files:
#
#path.logs: /path/to/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
#network.host: 192.168.0.1
#
# Set a custom port for HTTP:
#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.zen.ping.unicast.hosts: ["host1", "host2"]
#
# Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1):
#
#discovery.zen.minimum_master_nodes: 3
#
# For more information, consult the zen discovery module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
修改後
# ---------------------------------- Cluster -------------------------------------
cluster.name: my-application
# ------------------------------------ Node --------------------------------------
node.name: node-121
# ----------------------------------- Paths ---------------------------------------
#path.data: /opt/module/elasticsearch-5.6.2/data
#path.logs: /opt/module/elasticsearch-5.6.2/logs
# ----------------------------------- Memory -----------------------------------
bootstrap.memory_lock: false
bootstrap.system_call_filter: false
# ---------------------------------- Network ------------------------------------
network.host: 10.1.255.121
# --------------------------------- Discovery ------------------------------------
#discovery.zen.ping.unicast.hosts: ["bigdata121"]
說明
cluster.name：集羣名，配置集羣這個需要相同，不改默認是cluster.name=my-application。
nodename：節點名稱，同一集羣名字不能相同。
path.data：數據存儲目錄。
path.logs：日誌存儲目錄。
bootstrap.memory_lock: 鎖定物理內存地址，防止elasticsearch內存被交換出去,也就是避免es使用swap交換分區。
network.host：爲es設置ip綁定，默認是127.0.0.1，也就是默認只能通過127.0.0.1 或者localhost才能訪問。
注意：修改後的每行前面不能有空格，修改後的“：”後面必須有一個空格。
4，啓動
./elasticsearch
# 後臺啓動
./elasticsearch -d
5，測試
http://10.1.255.121:9200
安裝過程出現的問題
1，ERROR No log4j2 configuration file found. Using default configuration: logging only errors to the console. Set system property ‘log4j2.debug’ to show Log4j2 internal initialization logging.
檢查elasticsearch.yml配置格式
修改後的每行前面不能有空格，修改後的“：”後面必須有一個空格。
2，can not run elasticsearch as root
由於ElasticSearch可以接收用戶輸入的腳本並且執行，爲了系統安全考慮，
建議創建一個單獨的用戶用來運行ElasticSearch
創建一個elasticsearch組和賬戶
# 添加用戶 -p 密碼
# 刪除用戶 userdel -r elasticsearch
groupadd es
useradd es -g es -p 123456
# 給用戶賦值
chown -R es:es /opt/moudle/elasticsearch-5.6.2/
su es
cd /opt/moudle/elasticsearch-5.6.2/bin
./elasticsearch
3，啓動報錯ERROR: [2] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
[2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
每個進程最大同時打開文件數太小，可通過下面2個命令查看當前數量
ulimit -Hn
ulimit -Sn
vi /etc/security/limits.conf
添加
* soft nofile 65536
* hard nofile 65536
[2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
問題同上，最大線程個數太低。修改配置文件/etc/security/limits.conf（和問題1是一個文件），增加配置
* soft nproc 4096
* hard nproc 4096
查看命令
ulimit -Hu
ulimit -Su
[1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
修改/etc/sysctl.conf文件，
增加配置vm.max_map_count=262144
執行命令sysctl -p生效
修改後重新登錄生效
參考：https://www.cnblogs.com/zhi-leaf/p/8484337.html