elasticsearch安装及配置
操作系统：CentOS6.8
主机IP：192.168.137.60
elasticsearch版本：elasticsearch-6.2.4
1、安装elasticsearch 注：elasticsearch运行需要java环境，安装参考logstash，安装java1.8.0或以上版本
官网下载elasticsearch-6.2.4.tar.gz
mkdir /opt/elasticsearch
tar -xzvf elasticsearch-6.2.4.tar.gz
cp -rp elasticsearch-6.2.4/* /opt/elasticsearch/
useradd java #创建java用户，elasticsearch默认禁止使用root用户运行
passwd java
chown -R java.java /opt/elasticsearch
2、配置elasticsearch
ls /opt/elasticsearch/conf
elasticsearch.yml #elasticsearch配置文件
jvm.options #启动elasticsearch时java配置文件，可设置使用内存大小
vi elasticsearch.yml #本次不涉及集群，故作简单配置，注意创建相应目录
path.data: /opt/elasticsearch/data
path.logs: /opt/elasticsearch/logs
bootstrap.memory_lock: false
bootstrap.system_call_filter: false
network.host: 192.168.137.60
http.port: 9200
3、运行elasticsearch
su - java #切换到java用户
/opt/elasticsearch/bin/elasticsearch #运行elasticsearch程序，若遇到报错可参考下文解决方法
curl http://192.168.137.60:9200/_search?pretty #在logstash中将数据传入elasticsearch，用此命令查看数据传入情况
常见报错及处理方法：
报错：can not run elasticsearch as root
处理方法：默认不能以root用户登录，需新建其他用户，并将elasticsearch目录权限修改为新用户
报错：max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
无法创建本地文件问题,用户最大可创建文件数太小
处理方法：
vim /etc/security/limits.conf
* hard nofile 65536
* soft nofile 65536
报错：memory locking requested for elasticsearch process but memory is not locked 锁定内存失败
处理方法：
vim /etc/security/limits.conf
* soft memlock unlimited
* hard memlock unlimited
报错：max number of threads [1024] for user [java] is too low, increase to at least [4096]
无法创建本地线程问题,用户最大可创建线程数太小
处理方法：
vi /etc/security/limits.d/90-nproc.conf
* soft nproc 1024 改为 * soft nproc 4096
报错：max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144] 最大虚拟内存太小
处理方法：
vim /etc/sysctl.conf
vm.max_map_count=655360
sysctl -p
报错：system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk 因为Centos6不支持SecComp
解决方法：修改elasticsearch.yml（elasticsearch配置文件）
Memory下
bootstrap.memory_lock: false
bootstrap.system_call_filter: false
