Linux內存一定要1g以上！
首先要有jdk環境 要求1.8版本以上 elasticsearch是Java寫的
將上傳的 elasticSearch安裝包解壓
cd /home/elasticsearch/elasticsearch-6.4.3/config
1、 修改elasticsearch.yml
network.host: 192.168.91.7
http.port:9200 #這是HTTP協議外部通信的端口號 9300內部通信端口號
如果此時啟動，會報錯 root不能啟動的哦 不能通過root賬號啟動 這是屬於自身的安全策略，解決方案，非root就可以了哈哈
因為安全問題elasticsearch 不讓用root用戶直接運行，所以要創建新用戶
首先創建個分組： groupadd esUsers
useradd esUser01 -g esUsers -p 123
chown -R esUser01:esUsers elasticsearch-6.4.3
su esUser01 #切換登錄用戶
【參考：
第一步：liunx創建新用戶 adduser esUsers 然后給創建的用戶加密碼 passwd XXX 輸入兩次密碼。
第二步：切換剛才創建的用戶 su esUsers 然后執行elasticsearch 會顯示Permission denied 權限不足。
第三步：給新建的XXX賦權限，chmod 777 * 這個不行，因為這個用戶本身就沒有權限，肯定自己不能給自己付權限。所以要用root用戶登錄付權限。
第四步：root給esUser賦權限，chown -R XXX /你的elasticsearch安裝目錄。
然后執行成功。】
這樣啟動仍然是會報錯的
ERROR: [4] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
[2]: max number of threads [1024] for user [esUser01] is too low, increase to at least [4096]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[4]: system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
[2019-01-21T00:53:47,296][INFO ][o.e.n.Node ] [qKdHOzq] stopping ...
[2019-01-21T00:53:47,329][INFO ][o.e.n.Node ] [qKdHOzq] stopped
[2019-01-21T00:53:47,330][INFO ][o.e.n.Node ] [qKdHOzq] closing ...
[2019-01-21T00:53:47,355][INFO ][o.e.n.Node ] [qKdHOzq] closed
[2019-01-21T00:53:47,361][INFO ][o.e.x.m.j.p.NativeController] Native controller process has stopped - no new native processes can be started
解決方案：
用root權限去做！
vi /etc/sysctl.conf
添加： vm.max_map_count=655360 然后保存
然后 cd /etc
輸入: sysctl -p
繼續啟動，繼續報錯：
ERROR: [3] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
[2]: max number of threads [1024] for user [esUser01] is too low, increase to at least [4096]
[3]: system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
[2019-01-21T01:03:48,953][INFO ][o.e.n.Node ] [qKdHOzq] stopping ...
[2019-01-21T01:03:48,988][INFO ][o.e.n.Node ] [qKdHOzq] stopped
[2019-01-21T01:03:48,988][INFO ][o.e.n.Node ] [qKdHOzq] closing ...
[2019-01-21T01:03:49,010][INFO ][o.e.n.Node ] [qKdHOzq] closed
[2019-01-21T01:03:49,017][INFO ][o.e.x.m.j.p.NativeController] Native controller process has stopped - no new native processes can be started
解決方案：繼續用root去修改
vi /etc/security/limits.conf
加入：
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096
必須重啟！ 重啟才可以生效
繼續報錯！
[1]: max number of threads [1024] for user [esUser01] is too low, increase to at least [4096]
解決：root下
vi /etc/security/limits.d/90-nproc.conf
在操作時候竟然出現了錯誤：
Exception in thread "main" 2019-01-21 00:46:41,393 main ERROR No Log4j 2 configuration file found. Using default configuration (logging only errors to the console), or user programmatically provided configurations. Set system property 'log4j2.debug' to show Log4j 2 internal initialization logging. See https://logging.apache.org/log4j/2.x/manual/configuration.html for instructions on how to configure Log4j 2
ElasticsearchParseException[malformed, expected end of settings but encountered additional content starting at line number: [59], column number: [1]]; nested: MarkedYAMLException[expected '<document start>', but found BlockMappingStart
in 'reader', line 59, column 1:
http.port: 9200
^
at [Source: sun.nio.ch.ChannelInputStream@5fbe4146; line: 59, column: 1]]; nested: ParserException[expected '<document start>', but found BlockMappingStart
in 'reader', line 59, column 1:
http.port: 9200
^
];
at org.elasticsearch.common.settings.Settings.fromXContent(Settings.java:685)
at org.elasticsearch.common.settings.Settings.access$500(Settings.java:84)
at org.elasticsearch.common.settings.Settings$Builder.loadFromStream(Settings.java:1188)
at org.elasticsearch.common.settings.Settings$Builder.loadFromPath(Settings.java:1165)
at org.elasticsearch.node.InternalSettingsPreparer.prepareEnvironment(InternalSettingsPreparer.java:100)
at org.elasticsearch.cli.EnvironmentAwareCommand.createEnv(EnvironmentAwareCommand.java:95)
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)
at org.elasticsearch.cli.Command.main(Command.java:90)
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93)
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86)
Caused by: com.fasterxml.jackson.dataformat.yaml.snakeyaml.error.MarkedYAMLException: expected '<document start>', but found BlockMappingStart
in 'reader', line 59, column 1:
http.port: 9200
^
這個錯誤竟然是空格造成的！ 醉了 這種格式 很讓人不開心啊
解決方案：
啟動，繼續報錯！！
system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
分析和解決：
出現錯誤的原因：是因為centos6.x操作系統不支持SecComp，而elasticsearch 5.5.2默認bootstrap.system_call_filter為true進行檢測，所以導致檢測失敗，失敗后直接導致ES不能啟動。
在elasticsearch.yml中添加配置項：bootstrap.system_call_filter為false：
bootstrap.system_call_filter: false
此時可以完美解決了！
啟動成功！
關閉防火牆后訪問：
http://192.168.91.7:9200/
9200端口可以提供Restful api接口 進行增刪改查操作
下面安裝可視化界面： Kibana
Kibana是一個開源的分析和可視化平台，設計用於和Elasticsearch一起工作。
你用Kibana來搜索，查看，並和存儲在Elasticsearch索引中的數據進行交互。
你可以輕松地執行高級數據分析，並且以各種圖標、表格和地圖的形式可視化數據。
Kibana使得理解大量數據變得很容易。它簡單的、基於瀏覽器的界面使你能夠快速創建和共享動態儀表板，實時顯示Elasticsearch查詢的變化。
解壓安裝包后修改配置文件：
vim config/kibana.yml
# 將默認配置改成如下：
server.port: 5601
server.host: "192.168.91.7"
elasticsearch.url: "http:// 192.168.91.7:9200" # 如果是集群 寫集群地址
（自己的ip端口號 和 讀取的 es的ip端口號）
啟動Kibana
./bin/kibana
http://192.168.91.7:5601/app/kibana
1.查找ES進程
ps -ef | grep elastic
2.殺掉ES進程
kill -9 2382（進程號）
3.重啟ES
sh elasticsearch -d