筆者Q:972581034 交流群：605799367。有任何疑問可與筆者或加群交流
安裝
yum localinstall elasticsearch-6.1.1.rpm -y
mkdir -p /elk/{data,logs} && chown -R elasticsearch.elasticsearch /elk
配置
grep '^[a-Z]' /etc/elasticsearch/elasticsearch.yml
cluster.name: yoho8elk #ELK的集群名稱，名稱相同即屬於是同一個集群
node.name: manager-node-1 #本機在集群內的節點名稱ode-1
path.data: /elk/data #數據保存目錄
path.logs: /elk/logs #日志保存目錄
bootstrap.memory_lock: true #服務啟動的時候鎖定足夠的內存，防止數據寫入swap,可能會導致雲主機報錯.可以不填寫.
network.host: 0.0.0.0 #監聽 10.0.1.0網段的
http.port: 9200
discovery.zen.ping.unicast.hosts: ["10.0.1.100", "10.0.1.24"]
修改內存限制，並同步配置文件：
https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html
vim jvm.options
-Xms1g
-Xmx1g
#官方配置文檔最大建議30G以內。
修改節點2的配置文件。
[root@test-manager elasticsearch]# scp elasticsearch.yml test-web04:/etc/elasticsearch/
[root@test-web04 elasticsearch]# grep '^[a-Z]' /etc/elasticsearch/elasticsearch.yml
cluster.name: yoho8elk
node.name: test-web04-node-2
path.data: /elk/data
path.logs: /elk/logs
bootstrap.memory_lock: true #在雲主機上加上這個參數可能會報錯。
network.host: 0.0.0.0 #監聽 0.0.0.0網段的
http.port: 9200
discovery.zen.ping.unicast.hosts: ["10.0.1.100", "10.0.1.24"]
設置java路徑
which: no java in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin)
ln -sv /application/jdk/bin/java* /usr/local/sbin/
啟動elasticsearch
systemctl start elasticsearch
systemctl enable elasticsearch
systemctl status elasticsearch
訪問測試
curl 10.0.1.100:9200
集群管理head 插件
git clone git://github.com/mobz/elasticsearch-head.git
yum install -y npm
yum update openssl -y
npm install grunt -save
npm install 或 npm install -g cnpm --registry=https://registry.npm.taobao.org && cnpm install
啟動插件
npm run start &
netstat -lntp |grep 9100
修改elasticsearch支持跨域訪問並重啟
vim /etc/elasticsearch/elasticsearch.yml
http.cors.enabled: true #最下方添加
http.cors.allow-origin: "*"
systemctl restart elasticsearch
ik分詞器
/usr/share/elasticsearch/bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v6.1.2/elasticsearch-analysis-ik-6.1.2.zip