集群：
10.226.204.6；10.226.204.8；10.226.204.9
三台机器配置好jdk，将es拷贝到每一台机器上的相同目录下（/home/elk/elasticsearch）
三个节点都不配置node.master和node.data，使用默认配置
主要写好配置文件/config/Elasticsearch.yml
以10.226.204.6为例：
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: jmr-elk 配置集群名称，三台的集群名称要相同
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: node-6 节点名称，不能相同
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /home/elk/data 配置ES数据存储路径，默认情况下，ES将数据存在ES根目录下，注意这里一定要手动配置，否则重新部署ES时，数据将被清空
#
# Path to log files:
#
path.logs: /home/elk/log ES log路径
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 10.226.204.6 配置hostip地址
#
# Set a custom port for HTTP:
#
http.port: 9200 配置端口号，查询和插入需要使用该端口号，注意，ES之间通信使用9300端口号，需要修改时，需要使用transport.tcp.port:9300进行配置
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.zen.ping.unicast.hosts: ["10.226.204.8:9300","10.226.204.9:9300"] 这里列出部分集群节点，如果不加端口号，默认使用9300端口号，在10.226.204.6主机上，这里只添加另外两台主机
#
# Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1):
#
discovery.zen.minimum_master_nodes: 2 最少有几个master候选节点时，可选举主节点，数量是(N / 2) + 1, N是有资格成为Master的节点，防止出现脑裂现象
#
# For more information, consult the zen discovery module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
验证集群搭建是否成功：curl -XGET 'http://10.226.204.6.:9200/_cat/nodes?pretty'，可以查看到集群中节点状态
踩得坑：
1、 discovery.zen.ping.multicast.enabled: false，在ES2.X以后版本中，是不能对该属性进行配置的，目前最新的ES默认使用单播模式进行集群搭建，如果使用多播模式搭建，需要新添加插件，也不建议使用多播方式进行搭建；
2、 ES启动过程中出现：max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]，解决方法如下：
a) 切换到root用户
b) 执行命令：
c) sysctl -w vm.max_map_count=262144
d) 查看结果：
e) sysctl -a|grep vm.max_map_count
f) 显示：
g) vm.max_map_count = 262144
3、 centos7.2 es5.4.1启动报错 BindTransportException [Failed to bind to [9300-9400]]，是由于配置文件里本机的ip地址写错了
参考链接：
1、 https://www.elastic.co/guide/cn/elasticsearch/guide/current/important-configuration-changes.html
