ELK日志分析系統之elasticsearch7.x最新版安裝與配置

1、Elasticsearch

1.1、elasticsearch的簡介

ElasticSearch是一個基於Lucene的搜索服務器。它提供了一個分布式多用戶能力的全文搜索引擎，基於RESTful web接口。Elasticsearch是用Java開發的，並作為Apache許可條款下的開放源碼發布，是第二流行的企業搜索引擎。設計用於雲計算中，能夠達到實時搜索，穩定，可靠，快速，安裝使用方便。

1.2、下載地址：https://www.elastic.co/cn/downloads/elasticsearch，到此網頁上下開elasticsearch安裝包。

1.3、將下載的.tar包解壓到目錄/application下。創建軟鏈接es文件。詳情如下圖所示：

 

 1.4、關於JDK，此安裝包里包含有JDK，不用再系統上重新安裝其他的版本的JDK。

 

 1.5、將此JDK放到系統變量文件/etc/profile中，在文件最后插入如下配置，詳情如下：

#set java environment

export JAVA_HOME=/application/es/jdk

export JRE_HOME=${JAVA_HOME}/jre

export CLASSPATH=.:${JAVA_HOME}/lib/dt.JAVA_HOME/lib/tools.jar:${JRE_HOME}/lib

export PATH=${JAVA_HOME}/bin:${PATH}

1.6、使用source命令，使配置生效

source /etc/profile

1.7、配置elasticsearch的配置文件

[root@harlan_ansible ~]# vim /application/es/config/elasticsearch.yml 

# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: my-harlan   #配置集群的名稱
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: harlan_ansible     #本節點的名稱，此主機的名稱
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /application/es/to/data      #日志存放地址
#
# Path to log files:
#
path.logs: /application/es/to/logs      #elasticsearch的本地日志
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 0.0.0.0               #任意IP都可以訪問elasticsearch
#
# Set a custom port for HTTP:
#
http.port: 9200                  #elasticsearch的訪問端口
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["harlan_ansible"]      #開啟集群的節點
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
http.cors.enabled: true                  #下面這兩個，是為了通過外網的瀏覽器訪問
http.cors.allow-origin: "*"

1.8、通過上述配置后，還需要配置啟動elasticsearch服務的用戶和權限。因為elasticsearch的服務不能使用root用戶進行啟動。所以需要創建es帳號，並且更改/application/es的所屬用戶和組。

1.8.1 創建用戶es

useradd es

1.8.2 更改/application/es的所屬用戶和組

chown -R es.es /application/es
chown -R es.es /application/elasticsearch-7.3.2

1.9、切換到es帳戶，啟動elasticsearch服務

[es@harlan_ansible]$ su es

[es@harlan_ansible root]$ /application/es/bin/elasticsearch -d

1.10、查看服務是否已啟動

 

 1.11、由上圖可知，elasticsearch服務已經啟動。

測試：通過瀏覽器進行訪問

 

 1.12、由圖可知，elasticsearch已經安裝成功。