【ELK】elasticsearch安装和配置

1、centos7

查看centos版本： cat /etc/redhat-release

查看操作系统位数：uname -m

查看是否关闭SELinux工作模式：getenforce

查看防火墙是否关闭：systemctl status firewalld

• 关闭防火墙：systemctl stop firewalld

• 禁用防火墙：systemctl disable firewalld

2、安装elasticsearch

进入安装目录 cd /usr/local

解压 elasticsearch-7.8.0-linux-x86_64.tar.gz

tar zxvf elasticsearch-7.8.0-linux-x86_64.tar.gz

创建软链接elk：ln -s elasticsearch-7.8.0 elk

设置jdk环境变量

vi /etc/profile
export JAVA_HOME=/usr/local/elk/jdk
source /etc/profile
#设置账户的环境变量
vi ~
vi .bash_profile
export PATH=$JAVA_HOME/bin:$PATH
source .bash_profile
查看java版本:
java -version

查看$JAVA_HOME：echo $JAVA_HOME

3.修改es配置文件

vi config\elasticsearch.yml
cluster.name: fxcluster
node.name: node-1
path.data: /es/data
path.logs: /es/logs
network.host: 0.0.0.0
http.port: 9200
cluster.initial_master_nodes: ["node-1"]

# 修改jvm堆内存
vi config\jvm.options
-Xms2g
-Xmx2g

查看内存 free -g

4.启动elasticsearch

bin/elasticsearch
报错:
java.lang.RuntimeException: can not run
elasticsearch as root

创建elk用户用来启动elasticsearch:
useradd elk 
chown -R elk:elk elk
chown -R elk:elk elasticsearch-7.8.0
chown -R elk:elk /es
su - elk
bin/elasticsearch

后台启动:
bin/elasticsearch -d -p fx.pid

继续报错:
ERROR: [2] bootstrap checks failed
[1]: max file descriptors [4096] for
elasticsearch process is too low, increase to at
least [65535]
[2]: max virtual memory areas vm.max_map_count
[65530] is too low, increase to at least [262144]

vi /etc/security/limits.conf
*       soft   nofile          65536
*       hard   nofile          65536

vi /etc/sysctl.conf
vm.max_map_count=262144

sysctl --system

重新登录
ulimit -Hn
ulimit -Sn

查看时间：date （CST中国标准时间)

同步时间：ntpdate ntp.aliyun.com

将时间设置写入到硬件时钟：hwclock -w

查看用户：id 用户名

修改用户和组的访问文件权限：chown -R 用户:组 文件名

设置elk用户密码：passwd elk

修改文件描述符：vi /etc/security/limits.conf

修改系统配置：vi /etc/sysctl.conf

应用系统设置：sysctl --system

查找命令文件位置：which 命令

查看java相关进程：ps -ef|grep java ps -aux|grep java

5.访问elasticsearch

http://192.168.122.150:9200
curl -X GET http://localhost:9200
{
  "name" : "node-1",
  "cluster_name" : "fxcluster",
  "cluster_uuid" : "yRsrATcTSU6RuxC-H1xL1Q",
  "version" : {
   "number" : "7.8.0",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" :
"757314695644ea9a1dc2fecd26d1a43856725e65",
    "build_date" : "2020-06-14T19:35:50.234439Z",
    "build_snapshot" : false,
    "lucene_version" : "8.5.1",
    "minimum_wire_compatibility_version" :
"6.8.0",
    "minimum_index_compatibility_version" :
"6.0.0-beta1"
 },
  "tagline" : "You Know, for Search"
}

6.关闭elasticsearch

jps
kill -9 进程号