寫在前面的話：爲什麼我一直沒有選用RPM類的包管理工具來安裝這些服務軟件和中間件？那是因爲使用tar.gz包來安裝你能知道更多的細節，因爲我們是在學習！
第一步：老樣子，先裝一個全新的CentOS8.1虛擬機，選擇裝配基本的Server軟件包，選擇好網絡模式！
第二步：到官網下載好Elasticsearch7.10.0的tar.gz安裝包(elasticsearch-7.10.0-linux-x86_64.tar.gz)，並將安裝包上傳到目標CentOS服務器，並使用 tar 命令解壓到指定目錄(例如我的是解壓到了 /opt/ 目錄下)：
[root@ELKServer elk]# ls elasticsearch-7.10.0-linux-x86_64.tar.gz logstash-7.10.0-linux-x86_64.tar.gz kibana-7.10.0-linux-x86_64.tar.gz [root@ELKServer elk]# tar -zxvf elasticsearch-7.10.0-linux-x86_64.tar.gz -C /opt/
在這裏tar解壓就相關於進行了安裝(即安裝到了解壓目標目錄)：
[root@ELKServer elasticsearch-7.10.0]# ls bin config jdk lib LICENSE.txt logs modules NOTICE.txt plugins README.asciidoc [root@ELKServer elasticsearch-7.10.0]# ls bin/ elasticsearch elasticsearch-saml-metadata elasticsearch-certgen elasticsearch-setup-passwords elasticsearch-certutil elasticsearch-shard elasticsearch-cli elasticsearch-sql-cli elasticsearch-croneval elasticsearch-sql-cli-7.10.0.jar elasticsearch-env elasticsearch-syskeygen elasticsearch-env-from-file elasticsearch-users elasticsearch-keystore x-pack-env elasticsearch-migrate x-pack-security-env elasticsearch-node x-pack-watcher-env elasticsearch-plugin
第三步：解壓安裝後，運行elasticsearch服務前，需要進行基礎配置，vim命令打開解壓目錄下的/elasticsearch-7.10.0/config/elasticsearch.yml配置文件，
[root@ELKServer opt]# vim elasticsearch-7.10.0/config/elasticsearch.yml
elasticsearch.yml中主要要設置的項有：cluster.name、node.name、path.data、path.logs、network.host、http.port 和 cluster.initial_master_nodes，其中path.data、path.logs指定的目錄需要給運行Elasticsearch服務的專用賬號進行授權，見下面文！注意：cluster.initial_master_nodes一定要指明，否則啓動會報錯！
第四步：創建運行Elasticsearch服務的專用賬號，並作相應目錄授權(因爲Elasticsearch服務不允許使用root賬號運行)：
# groupadd elk # useradd elk -d /home/elk -s /bin/sh -g elk # chown -R elk:elk /opt/elasticsearch-7.10.0/ # chmod -R 777 /opt/elasticsearch-7.10.0/
# chown -R elk:elk /var/elasticsearch/data
# chmod -R 777 /var/elasticsearch/data
# chown -R elk:elk /var/elasticsearch/log # chmod -R 777 /var/elasticsearch/log
第五步：加大運行Elasticsearch服務的專用賬號可創建的文件描述符(descriptor)數量到超過65535：
[root@ELKServer opt]# vim /etc/security/limits.conf # - "hard" for enforcing hard limits # #<item> can be one of the following: # - core - limits the core file size (KB) # - data - max data size (KB) # - fsize - maximum filesize (KB) # - memlock - max locked-in-memory address space (KB) # - nofile - max number of open file descriptors # - rss - max resident set size (KB) # - stack - max stack size (KB) # - cpu - max CPU time (MIN) # - nproc - max number of processes # - as - address space limit (KB) # - maxlogins - max number of logins for this user # - maxsyslogins - max number of logins on the system # - priority - the priority to run user process with # - locks - max number of file locks the user can hold # - sigpending - max number of pending signals # - msgqueue - max memory used by POSIX message queues (bytes) # - nice - max nice priority allowed to raise to values: [-20, 19] # - rtprio - max realtime priority # #<domain> <type> <item> <value> # #* soft core 0 #* hard rss 10000 #@student hard nproc 20 #@faculty soft nproc 20 #@faculty hard nproc 50 #ftp hard nproc 0 #@student - maxlogins 4 elk hard nofile 65536 elk soft nofile 65536 # End of file
第六步：加大運行Elasticsearch服務的專用賬號可擁有的最大虛擬內存區到過262144：
[root@ELKServer opt]# sysctl -w vm.max_map_count=262145 vm.max_map_count = 262145 [root@ELKServer opt]# vim /etc/sysctl.conf # sysctl settings are defined through files in # /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/. # # Vendors settings live in /usr/lib/sysctl.d/. # To override a whole file, create a new file with the same in # /etc/sysctl.d/ and put new settings there. To override # only specific settings, add a file with a lexically later # name in /etc/sysctl.d/ and put new settings there. # # For more information, see sysctl.conf(5) and sysctl.d(5). vm.max_map_count=262145
修改/etc/sysctl.conf 文件是爲了服務器重啓後設置依舊有效！
第七步：在防火牆上開放Elasticsearch要用到的端口，本例中使用的默認的兩個端口9200和9300
[root@ELKServer opt]# firewall-cmd --zone=public --add-port=9200/tcp --permanent success [root@ELKServer opt]# firewall-cmd --zone=public --add-port=9300/tcp --permanent success [root@ELKServer opt]# firewall-cmd --reload success
第八步：手工創建Elasticsearch服務，並啓動：
[root@ELKServer multi-user.target.wants]# vim /etc/systemd/system/elasticsearch.service [Unit] Description=elasticsearch service After=network.target After=syslog.target [Service] Type=forking LimitNOFILE=65536 ExecStart=/opt/elasticsearch-7.10.0/bin/elasticsearch ExecStop=/opt/elasticsearch-7.10.0/bin/elasticsearch User=elk Restart=on-abort TimeoutSec=600 [Install] WantedBy=multi-user.target
[root@ELKServer multi-user.target.wants]# systemctl daemon-reload [root@ELKServer multi-user.target.wants]# systemctl enable elasticsearch.service [root@ELKServer multi-user.target.wants]# systemctl start elasticsearch.service
第九步：瀏覽Elasticsearch目標URL查看服務是否正常了：
