ELK集群搭建過程記錄—7.6.2版本

搭建過程

1、Elasticsearch集群搭建

2、Cerebro插件安裝

    tar -zxvf cerebro-0.9.1.tgz                             解壓cerebro壓縮包

    配置cerebro文件夾下 application.conf          配置集群的地址

   ./cerebro -Dhttp.port=8080                            啟動cerebro插件，配置端口

    nohup ./cerebro -Dhttp.port=8080 &             解決ctrl+c退出的問題

    http://127.0.0.1:8080/#/connect                    插件瀏覽器訪問地址

    http://127.0.0.1:9200                                    連接集群的地址

3、Kibana安裝

4、Kibana管理Elasticsearch

 

搭建過程中遇到的問題匯總（更新中）

1、Cerebro無法訪問

2、ES集群腦裂問題

     ES集群搭建了3個節點，node-1、node-2、node-3，搭建完以后，在cerebro中進行查看，生成了2個集群，node-1自己成了一個集群，node-2、node-3這2個節點成了一個集群

org.elasticsearch.transport.RemoteTransportException: [node-2][127.0.0.1:9300][internal:cluster/coordination/join/validate]
Caused by: org.elasticsearch.cluster.coordination.CoordinationStateRejectedException: join validation on cluster state with a different cluster uuid E4a-eGNOSCG7_VDmzQPs8w than local cluster uuid RluWhBm3RA-nOJzKIP-NSw, rejecting

org.elasticsearch.transport.RemoteTransportException: [node-2][127.0.0.1:9300][internal:cluster/coordination/join]
Caused by: org.elasticsearch.cluster.coordination.CoordinationStateRejectedException: incoming term 44 does not match current term 45

嘗試解決：重啟，修改elasticsearch.yml配置參數，都沒解決

最后解決方法：刪除data文件夾
原因：因為該節點之前啟動過ES，已經創建了data文件夾，與要加入的集群沖突。

3、kibana啟動報錯問題

  log   [09:21:17.452] [warning][savedobjects-service] Unable to connect to Elasticsearch. Error: [resource_already_exists_exception] index [.kibana_1/-eb6AR3SQ3usPaLJN76t5w] already exists, with { index_uuid="-eb6AR3SQ3usPaLJN76t5w" & index=".kibana_1" }
  log   [09:21:17.453] [warning][savedobjects-service] Another Kibana instance appears to be migrating the index. Waiting for that migration to complete. If no other Kibana instance is attempting migrations, you can get past this message by deleting index .kibana_1 and restarting Kibana.
  log   [09:21:17.493] [info][savedobjects-service] Creating index .kibana_task_manager_1.
  log   [09:21:17.496] [warning][savedobjects-service] Unable to connect to Elasticsearch. Error: [resource_already_exists_exception] index [.kibana_task_manager_1/whkoKPqJSYGAzgXMGxQXbQ] already exists, with { index_uuid="whkoKPqJSYGAzgXMGxQXbQ" & index=".kibana_task_manager_1" }
  log   [09:21:17.497] [warning][savedobjects-service] Another Kibana instance appears to be migrating the index. Waiting for that migration to complete. If no other Kibana instance is attempting migrations, you can get past this message by deleting index .kibana_task_manager_1 and restarting Kibana.
 Generating a random key for xpack.encryptedSavedObjects.encryptionKey. To be able to decrypt encrypted saved objects attributes after restart, please set xpack.encryptedSavedObjects.encryptionKey in kibana.yml

解決方法：在elastic中刪除kibana的索引

cd /u02/tomcat/elasticsearch-7.6.2
curl -XDELETE http://127.0.0.1:9200/.kibana*

原因：索引已經存在

4、kibana鏈接無法訪問

kibana啟動后，http://127.0.0.1:5601訪問不了

解決方法：把端口號修改為8088

訪問鏈接：http://127.0.0.1:8088

5、kibana中如何管理ES的索引，並進行對應關聯

6、elasticsearch指定JDK版本

/elasticsearch-7.6.2/bin/elasticsearch

#配置自己的jdk
export JAVA_HOME=/home/elasticsearch-7.6.2/jdk
export PATH=$JAVA_HOME/bin:$PATH
#添加jdk判斷
if [ -x "$JAVA_HOME/bin" ]; then
        JAVA="/home/elasticsearch-7.6.2/jdk/bin/java"
else
        JAVA=`which java`

 7、[1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

在/etc/sysctl.conf文件中添加下面這行：

vm.max_map_count=262144