centos7.5安装Elasticsearch，Kibana，Logstash

灰太狼 2023-08-17 15:33 180阅读 0赞

## 环境要求： ##

# jdk 最低版本是8
    java -version
    echo $JAVA_HOME
    
    # 操作系统：centos7
    bash-4.2$ cat /etc/centos-release
    CentOS Linux release 7.5.1804 (Core)

## elasticsearch安装步骤 [官网][Link 1] ##

1.  ### 安装 ###

# 建议本地用迅雷下载好传上去，官方的yum源或者wget太慢了
    wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.3.2-x86_64.rpm
    wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.3.2-x86_64.rpm.sha512
    shasum -a 512 -c elasticsearch-7.3.2-x86_64.rpm.sha512 
    sudo rpm --install elasticsearch-7.3.2-x86_64.rpm

1.  ### 启动 ###

# 安装完成之后，es会自动创建elasticsearch用户和用户组,官方的启动方式是如下：
    # 启动
    systemctl start elasticsearch
    
    # 关闭
    systemctl stop elasticsearch

但是，官方启动我用的时候是有问题的，我还是比较喜欢按照套路来走,用elasticsearch用户去进行相关操作

# 设置密码(elasticsearch用户和组已经创建，但是不能登录)
    passwd elasticsearch
    # 系统添加的默认用户是不能登录的，需要更改/etc/passwd，改成如下
    elasticsearch:x:996:994:elasticsearch user:/home/elasticsearch:/bin/bash
    # 登录elasticsearch用户
    su elasticsearch
    # 切换到安装目录执行
    ./bin/elasticsearch

1.  ### 插件安装 ###

# 查看运行状态
    ps aux|grep elasticsearch
    
    # 添加中文分词插件
    ./elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.3.2/elasticsearch-analysis-ik-7.3.2.zip
    # 重启es使之生效
    systemctl restart elasticsearch

1.  ### 错误处理 ###

*  max file descriptors \[4096\] for elasticsearch process is too low, increase to at least \[65536\]

# 切换到root,在末尾处添加
    1. vim /etc/security/limits.conf
    *    hard    nofile    65536
    *    soft    nofile    65536
    root soft nproc 5000
    root hard nproc 5000
    
    2. 重新登录

*  max virtual memory areas vm.max\_map\_count \[65530\] is too low, increase to at least \[262144\]

# 解决方案
    1、切换到root用户修改配置sysctl.conf
    vim /etc/sysctl.conf 
    添加下面配置：
    vm.max_map_count=655360
    并执行命令：
    sysctl -p

*  the default discovery settings are unsuitable for production use; at least one of \[discovery.seed\_hosts, discovery.seed\_providers, cluster.initial\_master\_nodes\] must be configured

# 解决方案
    编辑yml文件，取消下面一行的注释
    # node.name: node-1 
    更新集群节点
    cluster.initial_master_nodes: ["node-1"]

*  Cannot open file /var/log/elasticsearch/gc.log due to Permission denied

# 给用户添加权限
    chown -R elasticsearch:elasticsearch /var/log/elasticsearch/

1.  ### 外网访问 ###

# 更新elasticsearch.yml
    network.host: 0.0.0.0
    # 开放防火墙
    # 开放端口
    firewall-cmd --zone=public --add-port=9200/tcp --permanent 
    # 更新规则
    firewall-cmd --reload

1.  ### 启动与关闭 ###

# elasticsearch 用户执行
    ./bin/elasticsearch -d
    ps -ef|grep elasticsearch|grep bootstrap |awk '{print $2}' |xargs kill -9

1.  ### 开机启动 ###

*  脚本

#!/bin/sh
    #chkconfig: 2345 80 05
    #description: elasticsearch
    
    export JAVA_HOME=/usr/java/jdk1.8.0_221-amd64
    export JAVA_BIN=/usr/java/jdk1.8.0_221-amd64
    export PATH=$PATH:$JAVA_HOME/bin
    export CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
    export JAVA_HOME JAVA_BIN PATH CLASSPATH
    
    case "$1" in
    start)
        su elasticsearch<<!
        cd /usr/share/elasticsearch
        ./bin/elasticsearch -d
    !
        echo "elasticsearch startup"
        ;;
    stop)
        es_pid=`ps aux|grep elasticsearch | grep -v 'grep elasticsearch' | awk '{print $2}'`
        kill -9 $es_pid
        echo "elasticsearch stopped"
        ;;
    restart)
        es_pid=`ps aux|grep elasticsearch | grep -v 'grep elasticsearch' | awk '{print $2}'`
        kill -9 $es_pid
        echo "elasticsearch stopped"
        su lyt<<!
        cd /usr/share/elasticsearch
        ./bin/elasticsearch -d
    !
        echo "elasticsearch startup"
        ;;
    *)
        echo "start|stop|restart"
        ;;
    esac
    
    exit $?

*  设置开机启动

cd /etc/init.d/
    # 替换原有的elasticsearch文件为上文的启动脚本
    # 添加到开机启动
    systemctl enable elasticsearch

*  集群环境配置  
    服务器有三台192.168.43.110，192.168.43.120，192.168.43.130

# 开放防火墙
    firewall-cmd --zone=public --add-port=9300/tcp --permanent
    firewall-cmd --reload

调整elasticsearch.yml配置文件

# 集群mingcheng
    cluster.name: es_cluster
    # 节点名称,这儿我直接取名为 master
    node.name: node-1
    # 网络绑定,这里我绑定 0.0.0.0,支持外网访问
    network.host: 0.0.0.0
    # 设置对外服务的http端口，默认为9200
    http.port: 9200
    # 支持跨域访问
    http.cors.enabled: true
    http.cors.allow-origin: "*"
    # 设置节点间交互的tcp端口,默认是9300
    transport.tcp.port: 9300
    # 手动指定可以成为 mater 的所有节点的 name 或者 ip，这些配置将会在第一次选举中进行计算
    cluster.initial_master_nodes:
                            - node-1
                            - node-2
                            - node-3
    discovery.seed_hosts:
                    - 192.168.43.110:9300
                    - 192.168.43.120:9300
                    - 192.168.43.130:9300
    path.data: /var/lib/elasticsearch
    path.logs: /var/log/elasticsearch

## kibana安装步骤 ##

1.  ### 安装 ###

# 通过wget方式获取，如果网络不好，可以自己手动下载上传
    wget https://artifacts.elastic.co/downloads/kibana/kibana-7.3.2-x86_64.rpm
    shasum -a 512 kibana-7.3.2-x86_64.rpm 
    sudo rpm --install kibana-7.3.2-x86_64.rpm
    
    cd kibana-7.3.2-linux-x86_64/bin
    
    # 设置开机启动
    systemctl enable kibana.service
    # 启动服务 
    systemctl start kibana.service
    # 查看启动状态
    systemctl status kibana.service
    
    
    # 如果通过安装包，需要进行如下设置：添加到系统服务，设置开机启动
    cd /etc/systemd/system
    vim kibana.service
    #添加如下内容
    [Service]
    ExecStart=/opt/kibana-7.3.2-linux-x86_64/bin/kibana
    
    [Install]
    WantedBy=multi-user.target
    # 刷新 
    systemctl daemon-reload

1.  ### kibana 配置 ###

# 更改 /etc/kibana/kibana.yml
    server.host: "0.0.0.0"
    # 这里面是http/https请求地址，不是域名和ip
    elasticsearch.hosts: ["http://192.168.43.110:9200"]
    # 配置el账号密码
    elasticsearch.username: "elasticsearch"
    elasticsearch.password: "elasticsearch"

1.  ### 开放防火墙 ###

# 开放端口
    firewall-cmd --zone=public --add-port=5601/tcp --permanent 
    # 更新规则
    firewall-cmd --reload

[Link 1]: https://www.elastic.co/guide/en/elasticsearch/reference/7.3/rpm.html