笔者Q:972581034 交流群:605799367。有任何疑问可与笔者或加群交流

安装

yum localinstall elasticsearch-6.1.1.rpm -y
mkdir -p /elk/{data,logs} && chown -R elasticsearch.elasticsearch /elk

配置

grep '^[a-Z]' /etc/elasticsearch/elasticsearch.yml
cluster.name: yoho8elk		#ELK的集群名称,名称相同即属于是同一个集群
node.name: manager-node-1	#本机在集群内的节点名称ode-1
path.data: /elk/data		#数据保存目录
path.logs: /elk/logs		#日志保存目录
bootstrap.memory_lock: true 	#服务启动的时候锁定足够的内存,防止数据写入swap,可能会导致云主机报错.可以不填写.
network.host: 0.0.0.0		#监听 10.0.1.0网段的
http.port: 9200			
discovery.zen.ping.unicast.hosts: ["10.0.1.100", "10.0.1.24"]

修改内存限制,并同步配置文件:

https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html

vim jvm.options
-Xms1g
-Xmx1g
#官方配置文档最大建议30G以内。

修改节点2的配置文件。

[root@test-manager elasticsearch]# scp elasticsearch.yml test-web04:/etc/elasticsearch/
[root@test-web04 elasticsearch]# grep '^[a-Z]' /etc/elasticsearch/elasticsearch.yml
cluster.name: yoho8elk
node.name: test-web04-node-2
path.data: /elk/data
path.logs: /elk/logs
bootstrap.memory_lock: true		#在云主机上加上这个参数可能会报错。
network.host: 0.0.0.0			#监听 0.0.0.0网段的
http.port: 9200
discovery.zen.ping.unicast.hosts: ["10.0.1.100", "10.0.1.24"]

设置java路径

which: no java in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin)
ln -sv /application/jdk/bin/java* /usr/local/sbin/

启动elasticsearch

systemctl start elasticsearch
systemctl enable elasticsearch
systemctl status elasticsearch

访问测试

curl 10.0.1.100:9200

集群管理head 插件

git clone git://github.com/mobz/elasticsearch-head.git
yum install -y npm
yum update openssl -y 
npm install grunt -save
npm install  或 npm install -g cnpm --registry=https://registry.npm.taobao.org && cnpm install 

启动插件

npm run start  &
netstat -lntp |grep 9100

修改elasticsearch支持跨域访问并重启

vim /etc/elasticsearch/elasticsearch.yml
http.cors.enabled: true #最下方添加
http.cors.allow-origin: "*"


systemctl restart elasticsearch

ik分词器

/usr/share/elasticsearch/bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v6.1.2/elasticsearch-analysis-ik-6.1.2.zip