centos7.5安装Elasticsearch，Kibana，Logstash

环境要求：

# jdk 最低版本是8
java -version
echo $JAVA_HOME

# 操作系统：centos7
bash-4.2$ cat /etc/centos-release
CentOS Linux release 7.5.1804 (Core) 

elasticsearch安装步骤 官网

1. 安装

# 建议本地用迅雷下载好传上去，官方的yum源或者wget太慢了
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.3.2-x86_64.rpm
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.3.2-x86_64.rpm.sha512
shasum -a 512 -c elasticsearch-7.3.2-x86_64.rpm.sha512 
sudo rpm --install elasticsearch-7.3.2-x86_64.rpm

2. 启动

# 安装完成之后，es会自动创建elasticsearch用户和用户组,官方的启动方式是如下：
# 启动
systemctl start elasticsearch

# 关闭
systemctl stop elasticsearch

但是，官方启动我用的时候是有问题的，我还是比较喜欢按照套路来走,用elasticsearch用户去进行相关操作

# 设置密码(elasticsearch用户和组已经创建，但是不能登录)
passwd elasticsearch
# 系统添加的默认用户是不能登录的，需要更改/etc/passwd，改成如下
elasticsearch:x:996:994:elasticsearch user:/home/elasticsearch:/bin/bash
# 登录elasticsearch用户
su elasticsearch
# 切换到安装目录执行
./bin/elasticsearch

3. 插件安装

# 查看运行状态
ps aux|grep elasticsearch

# 添加中文分词插件
./elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.3.2/elasticsearch-analysis-ik-7.3.2.zip
# 重启es使之生效
systemctl restart elasticsearch

4. 错误处理

• max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

# 切换到root,在末尾处添加
1. vim /etc/security/limits.conf
*    hard    nofile    65536
*    soft    nofile    65536
root soft nproc 5000
root hard nproc 5000

2. 重新登录

• max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

# 解决方案
1、切换到root用户修改配置sysctl.conf
vim /etc/sysctl.conf 
添加下面配置：
vm.max_map_count=655360
并执行命令：
sysctl -p

• the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured

# 解决方案
编辑yml文件，取消下面一行的注释
# node.name: node-1 
更新集群节点
cluster.initial_master_nodes: ["node-1"] 

• Cannot open file /var/log/elasticsearch/gc.log due to Permission denied

# 给用户添加权限
chown -R elasticsearch:elasticsearch /var/log/elasticsearch/

5. 外网访问

# 更新elasticsearch.yml
network.host: 0.0.0.0
# 开放防火墙
# 开放端口
firewall-cmd --zone=public --add-port=9200/tcp --permanent 
# 更新规则
firewall-cmd --reload

6. 启动与关闭

# elasticsearch 用户执行
./bin/elasticsearch -d
ps -ef|grep elasticsearch|grep bootstrap |awk '{print $2}' |xargs kill -9

7. 开机启动

• 脚本

#!/bin/sh
#chkconfig: 2345 80 05
#description: elasticsearch

export JAVA_HOME=/usr/java/jdk1.8.0_221-amd64
export JAVA_BIN=/usr/java/jdk1.8.0_221-amd64
export PATH=$PATH:$JAVA_HOME/bin
export CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
export JAVA_HOME JAVA_BIN PATH CLASSPATH

case "$1" in
start)
    su elasticsearch<<!
    cd /usr/share/elasticsearch
    ./bin/elasticsearch -d
!
    echo "elasticsearch startup"
    ;;
stop)
    es_pid=`ps aux|grep elasticsearch | grep -v 'grep elasticsearch' | awk '{print $2}'`
    kill -9 $es_pid
    echo "elasticsearch stopped"
    ;;
restart)
    es_pid=`ps aux|grep elasticsearch | grep -v 'grep elasticsearch' | awk '{print $2}'`
    kill -9 $es_pid
    echo "elasticsearch stopped"
    su lyt<<!
    cd /usr/share/elasticsearch
    ./bin/elasticsearch -d
!
    echo "elasticsearch startup"
    ;;
*)
    echo "start|stop|restart"
    ;;
esac

exit $?

• 设置开机启动

cd /etc/init.d/
# 替换原有的elasticsearch文件为上文的启动脚本
# 添加到开机启动
systemctl enable elasticsearch

• 集群环境配置
  服务器有三台192.168.43.110，192.168.43.120，192.168.43.130

# 开放防火墙
firewall-cmd --zone=public --add-port=9300/tcp --permanent
firewall-cmd --reload

调整elasticsearch.yml配置文件

# 集群mingcheng
cluster.name: es_cluster
# 节点名称,这儿我直接取名为 master
node.name: node-1
# 网络绑定,这里我绑定 0.0.0.0,支持外网访问
network.host: 0.0.0.0
# 设置对外服务的http端口，默认为9200
http.port: 9200
# 支持跨域访问
http.cors.enabled: true
http.cors.allow-origin: "*"
# 设置节点间交互的tcp端口,默认是9300
transport.tcp.port: 9300
# 手动指定可以成为 mater 的所有节点的 name 或者 ip，这些配置将会在第一次选举中进行计算
cluster.initial_master_nodes:
                        - node-1
                        - node-2
                        - node-3
discovery.seed_hosts:
                - 192.168.43.110:9300
                - 192.168.43.120:9300
                - 192.168.43.130:9300
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch

kibana安装步骤

1. 安装

# 通过wget方式获取，如果网络不好，可以自己手动下载上传
wget https://artifacts.elastic.co/downloads/kibana/kibana-7.3.2-x86_64.rpm
shasum -a 512 kibana-7.3.2-x86_64.rpm 
sudo rpm --install kibana-7.3.2-x86_64.rpm

cd kibana-7.3.2-linux-x86_64/bin

# 设置开机启动
systemctl enable kibana.service
# 启动服务 
systemctl start kibana.service
# 查看启动状态
systemctl status kibana.service


# 如果通过安装包，需要进行如下设置：添加到系统服务，设置开机启动
cd /etc/systemd/system
vim kibana.service
#添加如下内容
[Service]
ExecStart=/opt/kibana-7.3.2-linux-x86_64/bin/kibana

[Install]
WantedBy=multi-user.target
# 刷新 
systemctl daemon-reload

2. kibana 配置

# 更改 /etc/kibana/kibana.yml
server.host: "0.0.0.0"
# 这里面是http/https请求地址，不是域名和ip
elasticsearch.hosts: ["http://192.168.43.110:9200"]
# 配置el账号密码
elasticsearch.username: "elasticsearch"
elasticsearch.password: "elasticsearch"

3. 开放防火墙

# 开放端口
firewall-cmd --zone=public --add-port=5601/tcp --permanent 
# 更新规则
firewall-cmd --reload