1 准备工作

服务器信息：

192.168.91.221  （elasticsearch-node1)

192.168.91.222  （elasticsearch-node2)

192.168.91.223  （elasticsearch-node3)

1.1 安装 Java 环境（3个节点）

91221.elk.node1.com<2016-12-13 17:23:38> ~

root># yum install vim openssh-clients lrzsz -y

root># yum install java-1.8.0-openjdk java-1.8.0-openjdk-devel -y

这里 java-1.8.0-openjdk-devel 非必须安装，但以后安装插件时可能会需要 Java 的编译器（javac），因此建议提前安装好。

验证版本：

91221.elk.node1.com<2016-12-13 17:33:52=""> ~

root># java -version

openjdk version "1.8.0_111"

OpenJDK Runtime Environment (build 1.8.0_111-b15)

OpenJDK 64-Bit Server VM (build 25.111-b15, mixed mode)

1.2 安装 elasticsearch 环境（3个节点）

Elasticsearch 集群：防止因Elasticsearch 服务挂掉，丢失数据

Elasticsearch 集群原理:会自动寻找同一网段cluster.name: es-cluster 名称相同的节点。

软件下载:https://www.elastic.co/downloads

node1 配置

91221.elk.node1.com<2016-12-13 17:49:33=""> ~/elk

root># tar -zxvf elasticsearch-2.4.1.tar.gz -C /opt/

root># mv elasticsearch-2.4.1/ elasticsearch-node1

root># vim /opt/elasticsearch-node1/config/elasticsearch.yml

elasticsearch>$ cat config/elasticsearch.yml|grep -Ev "^#|^$"

http.cors.enabled: true

http.cors.allow-origin: "*"

cluster.name: es-cluster    #集群名称，默认为elasticsearch

node.name: es-node1        #节点名称

node.master: true          #是否作为主节点，每个节点都可以被配置成为主节点，默认值为true

node.data: true            #是否存储数据，即存储索引片段，默认值为true

bootstrap.mlockall: true    #JVM开始交换时，ElasticSearch表现并不好：你需要保障JVM不进行交换，可以将bootstrap.mlockall设置为true禁止交换：

network.host: 192.168.91.221

http.port: 9200

discovery.zen.ping.timeout: 3s  #设置ping其他节点时的超时时间，网络比较慢时可将该值设大

discovery.zen.ping.unicast.hosts: ["192.168.91.221", "192.168.91.222", "192.168.91.223"] #设置新节点被启动时能够发现的主节点列表（主要用于不同网段机器连接）

node2 配置

root># scp -rp /opt/elasticsearch-node1/ root@192.168.91.222:/opt/elasticsearch-node2

修改 elasticsearch.yml  配置文件

只需要修改以下配置，其它不用修改

http.port: 9202

node.name: "es-node2"

node3 配置

root># scp -rp /opt/elasticsearch-node1/ root@192.168.91.223:/opt/elasticsearch-node23

修改 elasticsearch.yml  配置文件

只需要修改以下配置，其它不用修改

http.port: 9200

node.name: "es-node3"

启动(3台)

root># useradd elasticsearch

root># chown -R elasticsearch:elasticsearch /opt/elasticsearch-node1/

root># chown -R elasticsearch:elasticsearch /opt/elasticsearch-node2/

root># chown -R elasticsearch:elasticsearch /opt/elasticsearch-node3/

切换到elasticsearch启动

91221.elk.node1.com<2016-12-13 18:09:46=""> /opt/elasticsearch-node1/bin

elasticsearch>$ ./bin/elasticsearch

[2016-12-13 19:38:24,479][WARN ][bootstrap                ] unable to install syscall filter: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in

[2016-12-13 19:38:24,486][WARN ][bootstrap                ] Unable to lock JVM Memory: error=12,reason=Cannot allocate memory

[2016-12-13 19:38:24,487][WARN ][bootstrap                ] This can result in part of the JVM being swapped out.

[2016-12-13 19:38:24,487][WARN ][bootstrap                ] Increase RLIMIT_MEMLOCK, soft limit: 65536, hard limit: 65536

[2016-12-13 19:38:24,487][WARN ][bootstrap                ] These can be adjusted by modifying /etc/security/limits.conf, for example:

# allow user 'elasticsearch' mlockall

elasticsearch soft memlock unlimited

elasticsearch hard memlock unlimited

[2016-12-13 19:38:24,487][WARN ][bootstrap                ] If you are logged in interactively, you will have to re-login for the new limits to take effect.

[2016-12-13 19:38:24,732][INFO ][node                    ] [es-node1] version[2.4.1], pid[2205], build[c67dc32/2016-09-27T18:57:55Z]

[2016-12-13 19:38:24,732][INFO ][node                    ] [es-node1] initializing ...

[2016-12-13 19:38:25,547][INFO ][plugins                  ] [es-node1] modules [reindex, lang-expression, lang-groovy], plugins [head, kopf], sites [head, kopf]

[2016-12-13 19:38:25,576][INFO ][env                      ] [es-node1] using [1] data paths, mounts [[/ (/dev/mapper/VolGroup-lv_root)]], net usable_space [41.3gb], net total_space [44.8gb], spins? [possibly], types [ext4]

[2016-12-13 19:38:25,577][INFO ][env                      ] [es-node1] heap size [990.7mb], compressed ordinary object pointers [true]

[2016-12-13 19:38:25,577][WARN ][env                      ] [es-node1] max file descriptors [4096] for elasticsearch process likely too low, consider increasing to at least [65536]

[2016-12-13 19:38:27,698][INFO ][node                    ] [es-node1] initialized

[2016-12-13 19:38:27,699][INFO ][node                    ] [es-node1] starting ...

[2016-12-13 19:38:27,802][INFO ][transport                ] [es-node1] publish_address {192.168.91.221:9300}, bound_addresses {192.168.91.221:9300}

[2016-12-13 19:38:27,810][INFO ][discovery                ] [es-node1] es-cluster/eSp8hMm5Q5Cp2Txk-cWdmg

[2016-12-13 19:38:30,888][INFO ][cluster.service          ] [es-node1] new_master {es-node1}{eSp8hMm5Q5Cp2Txk-cWdmg}{192.168.91.221}{192.168.91.221:9300}{master=true}, added {{es-node2}{a-Jjk2FDQJeVRd3v7l6txg}{192.168.91.222}{192.168.91.222:9300}{master=false},{node-3}{r4P8l0P5QNWztxI4ILuwhw}{192.168.91.223}{192.168.91.223:9300}{master=false},}, reason: zen-disco-join(elected_as_master, [0] joins received)

[2016-12-13 19:38:31,039][INFO ][http                    ] [es-node1] publish_address {192.168.91.221:9200}, bound_addresses {192.168.91.221:9200}

[2016-12-13 19:38:31,039][INFO ][node                    ] [es-node1] started

[2016-12-13 19:38:31,272][INFO ][gateway                  ] [es-node1] recovered [0] indices into cluster_state

后台启动

91221.elk.node1.com<2016-12-13 18:12:15=""> /opt/elasticsearch-node1/bin

elasticsearch>$ ./elasticsearch -d

1.3检查是否启动成功(OK)

elasticsearch>$ curl http://192.168.91.221:9200

{

"name" : "es-node1",

"cluster_name" : "es-cluster",

"cluster_uuid" : "igGG2L-HR-2xXTWC6FgLbQ",

"version" : {

"number" : "2.4.1",

"build_hash" : "c67dc32e24162035d18d6fe1e952c4cbcbe79d16",

"build_timestamp" : "2016-09-27T18:57:55Z",

"build_snapshot" : false,

"lucene_version" : "5.5.2"

},

"tagline" : "You Know, for Search"

}

或打开网页

2  集群管理插件

Elasticsearch-head

安装

# /opt/elasticsearch-node1/bin/plugin install mobz/elasticsearch-head

-> Installing mobz/elasticsearch-head...

Trying https://github.com/mobz/elasticsearch-head/archive/master.zip ...

Downloading ............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................DONE

Verifying https://github.com/mobz/elasticsearch-head/archive/master.zip checksums if available ...

NOTE: Unable to verify checksum for downloaded plugin (unable to find .sha1 or .md5 file to verify)

Installed head into /opt/elasticsearch-node1/plugins/head

访问 hhttp://192.168.91.221:9200/_plugin/head/

可方便查询索引数据及索引大小，如下图所示:

node2安装

91222.elk.node2.com<2016-12-13 18:15:29=""> /opt/elasticsearch-node2/bin

elasticsearch>$ /opt/elasticsearch-node2/bin/plugin install mobz/elasticsearch-head

node3安装

91223.elk.node3.com<2016-12-13 18:15:33=""> /opt/elasticsearch-node3/bin

elasticsearch>$ /opt/elasticsearch-node3/bin/plugin install mobz/elasticsearch-head

Elasticsearch-kofp

功能: 集群管理，监控查看cpu、内存使用情况、在线查询/提交elsticsearch数据

安装

91221.elk.node1.com<2016-12-13 19:49:40=""> /opt/elasticsearch-node1

elasticsearch>$ /opt/elasticsearch-node1/bin/plugin install lmenezes/elasticsearch-kopf

访问 http://192.168.91.221:9200/_plugin/kopf

ES插件BigDesk安装

bigdesk支持的最新版本的ES是1.3.0 ... 1.3.x

然而想要在新版本ES上安装（2.x.x），项目中遇到过一些BUG，在ES在最新版本中有修复

https://github.com/lukas-vlcek/bigdesk/archive/master.zip

1.下载bigdesk的master的zip包

2.解压到安装路径下 elasticsearch-2.4.1/plugins/目录下，会有一个bigdesk或者bigdesk-master（可以改成bigdesk）目录,然后再新建一个目录_site,压缩包里的文件放到_site目录中。

3.提示没有找到'plugin-descriptor.properties'文件，那就创建这个文件，并写入以下内容

91221.elk.node1.com<2016-12-13 20:15:42=""> /opt/elasticsearch-node1/plugins/bigdesk

elasticsearch>$ cat /opt/elasticsearch-node1/plugins/bigdesk/plugin-descriptor.properties

description=bigdesk

version=bigdesk

name=bigdesk

site=true

保存OK，大功告成。

注：_plugin后面的bigdesk就是plugins地下目录名字，若是bigdesk-master，则需要写这个名字

本以为会正常运行，然而出现了一个js弹框，有这样的内容

**************************

Bigdesk may not work correctly!

Found ES node version:2.3.0

Require ES node version:>= 1.0.0.RC1

**************************

解决办法：

定位到plugins/bigdesk/_site/js/store目录，打开BigdeskStore.js，定位到142行

return (major == 1 && minor >= 0 && maintenance >= 0 && (build != 'Beta1' || build != 'Beta2'));

看到这么一行，把 major ==1 改成 major >=1，然后保存。

浏览器重新打开 http://192.168.91.221:9200/_plugin/bigdesk/

OK.可以看到正常运行了。

Marvel

Marvel是Elastic公司推出的商业监控方案，是用来监控Elasticsearch集群，历史状态的有力工具，便于性能优化以及故障诊断。监控主要分为六个层面，分别是集群层、节点层、索引层、分片层、事件层、Sense。

安装步骤：

1) 在Elasticsearch中安装Marvel插件。

bin/plugin install license

bin/plugin install marvel-agent

2) 在Kibana中安装Marvel插件

bin/kibana plugin --install elasticsearch/marvel/latest

3) 启动Elasticsearch和Kibana

bin/elasticsearch

bin/kibana

安装好后在浏览器中输入：http://127.0.0.1:5601/即可看到界面如图9.1所示。

http://static.oschina.net/uploads/space/2016/0819/081823_imMw_247205.png

参考文档：

https://my.oschina.net/topeagle/blog/405149  elasticsearch配置文件详解

http://www.iyunv.com/thread-271492-1-1.html  Elasticsearch 2.x.x版本如何安装bigdesk