Linux安装Elasticsearch

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.x.x-linux-x86_64.tar.gz
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.x.x-linux-x86_64.tar.gz.sha512
shasum -a 512 -c elasticsearch-7.x.x-linux-x86_64.tar.gz.sha512 
tar -xzf elasticsearch-7.x.x-linux-x86_64.tar.gz
cd elasticsearch-7.x.x/ 

注意：

如果下载网速慢，找国内的镜像代替

从5.x开始，ElasticSearch 安全级别提高了，不允许采用root帐号启动，所以我们要添加一个用户,创建好后切换该用户

1 创建 elasticsearch 用户组（可省略）

root@localhost ~]# groupadd elasticsearch

2 创建用户 es 并设置密码为es

[root@localhost ~]# useradd es
[root@localhost ~]# passwd es

3 用户es 添加到 elasticsearch 用户组（可省略）

[root@localhost ~]# usermod -G elasticsearch es

4 设置sudo权限（可省略）

[root@localhost ~]# visudo

在root ALL=(ALL) ALL 一行下面
添加es用户 如下:

es ALL=(ALL) ALL

5 添加成功保存后切换到es用户操作

[root@localhost ~]# su es
[es@localhost root]# cd /xx/xx/es/bin #对于的es目录下
[es@localhost bin]# ./elasticsearch -d #启动

- elasticsearch启动过程中报错[1]

ERROR: [1] bootstrap checks failed
[1]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured
[2019-06-03T07:05:44,761][INFO ][o.e.n.Node               ] [hz] stopping ...
[2019-06-03T07:05:44,788][INFO ][o.e.n.Node               ] [hz] stopped
[2019-06-03T07:05:44,788][INFO ][o.e.n.Node               ] [hz] closing ...
[2019-06-03T07:05:44,801][INFO ][o.e.n.Node               ] [hz] closed
[2019-06-03T07:05:44,804][INFO ][o.e.x.m.p.NativeController] [hz] Native controller process has stopped - no new native processes can be started

解决办法

修改config/elasticsearch.yml下，放开node.name注释，可更改名称
node.name: node-1

- elasticsearch启动过程中报错[2]

ERROR: [1] bootstrap checks failed
[1]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured

解决办法

#ip替换host1等，多节点请添加多个ip地址，单节点可写按默认来
#配置以下三者，最少其一
#[discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes]
cluster.initial_master_nodes: ["node-1"] #这里的node-1为node-name配置的值

无法通过外部ip访问elasticsearch

解决办法

#修改config/elasticsearch.yml,修改为当前es地址或0.0.0.0
network.host: 0.0.0.0

Failed to clear cache for realms [[]]

暂无解决办法，官方github上已经有人提issue了

[status][plugin:spaces@7.1.1] Status changed from yellow to green - Ready

这个问题只会出现在单体ELK中，无需理会

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解决办法：

临时解决办法：切换root用户执行如下命令

sysctl -w vm.max_map_count=262144

永久解决办法：在 /etc/sysctl.conf文件最后添加一行

vm.max_map_count=262144
sysctl -p  #使修改立即生效

查看修改结果：

sysctl -a|grep vm.max_map_count

显示：

vm.max_map_count = 262144

ERROR: bootstrap checks failed
memory locking requested for elasticsearch process but memory is not locked

这是因为设置了锁定内存参数bootstrap.memory_lock=true

报内存溢出处理

在/config/jvm.options 文件内 堆大小设置的默认

 -Xms1g
 -Xmx1g

调小即可(内存够大，就调大。建议是服务器内存的一半)

 -Xms108m
 -Xmx108m