1 準(zhǔn)備工作
服務(wù)器信息：
192.168.91.221? （elasticsearch-node1)
192.168.91.222? （elasticsearch-node2)
192.168.91.223? （elasticsearch-node3)
1.1 安裝 Java 環(huán)境（3個節(jié)點）
91221.elk.node1.com<2016-12-13 17:23:38> ~
root># yum install vim openssh-clients lrzsz -y
root># yum install java-1.8.0-openjdk java-1.8.0-openjdk-devel -y
這里 java-1.8.0-openjdk-devel 非必須安裝，但以后安裝插件時可能會需要 Java 的編譯器（javac），因此建議提前安裝好。
驗證版本：
91221.elk.node1.com<2016-12-13 17:33:52=""> ~
root># java -version
openjdk version "1.8.0_111"
OpenJDK Runtime Environment (build 1.8.0_111-b15)
OpenJDK 64-Bit Server VM (build 25.111-b15, mixed mode)
1.2 安裝 elasticsearch 環(huán)境（3個節(jié)點）
Elasticsearch 集群：防止因Elasticsearch 服務(wù)掛掉，丟失數(shù)據(jù)
Elasticsearch 集群原理:會自動尋找同一網(wǎng)段cluster.name: es-cluster 名稱相同的節(jié)點。
軟件下載:https://www.elastic.co/downloads
node1 配置
91221.elk.node1.com<2016-12-13 17:49:33=""> ~/elk
root># tar -zxvf elasticsearch-2.4.1.tar.gz -C /opt/
root># mv elasticsearch-2.4.1/ elasticsearch-node1
root># vim /opt/elasticsearch-node1/config/elasticsearch.yml
elasticsearch>$ cat config/elasticsearch.yml|grep -Ev "^#|^$"
http.cors.enabled: true
http.cors.allow-origin: "*"
cluster.name: es-cluster? ? #集群名稱，默認(rèn)為elasticsearch
node.name: es-node1? ? ? ? #節(jié)點名稱
node.master: true? ? ? ? ? #是否作為主節(jié)點，每個節(jié)點都可以被配置成為主節(jié)點，默認(rèn)值為true
node.data: true? ? ? ? ? ? #是否存儲數(shù)據(jù)，即存儲索引片段，默認(rèn)值為true
bootstrap.mlockall: true? ? #JVM開始交換時，ElasticSearch表現(xiàn)并不好：你需要保障JVM不進行交換，可以將bootstrap.mlockall設(shè)置為true禁止交換：
network.host: 192.168.91.221
http.port: 9200
discovery.zen.ping.timeout: 3s? #設(shè)置ping其他節(jié)點時的超時時間，網(wǎng)絡(luò)比較慢時可將該值設(shè)大
discovery.zen.ping.unicast.hosts: ["192.168.91.221", "192.168.91.222", "192.168.91.223"] #設(shè)置新節(jié)點被啟動時能夠發(fā)現(xiàn)的主節(jié)點列表（主要用于不同網(wǎng)段機器連接）
node2 配置
root># scp -rp /opt/elasticsearch-node1/ root@192.168.91.222:/opt/elasticsearch-node2
修改 elasticsearch.yml? 配置文件
只需要修改以下配置，其它不用修改
http.port: 9202
node.name: "es-node2"
node3 配置
root># scp -rp /opt/elasticsearch-node1/ root@192.168.91.223:/opt/elasticsearch-node23
修改 elasticsearch.yml? 配置文件
只需要修改以下配置，其它不用修改
http.port: 9200
node.name: "es-node3"
啟動(3臺)
root># useradd elasticsearch
root># chown -R elasticsearch:elasticsearch /opt/elasticsearch-node1/
root># chown -R elasticsearch:elasticsearch /opt/elasticsearch-node2/
root># chown -R elasticsearch:elasticsearch /opt/elasticsearch-node3/
切換到elasticsearch啟動
91221.elk.node1.com<2016-12-13 18:09:46=""> /opt/elasticsearch-node1/bin
elasticsearch>$ ./bin/elasticsearch
[2016-12-13 19:38:24,479][WARN ][bootstrap? ? ? ? ? ? ? ? ] unable to install syscall filter: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in
[2016-12-13 19:38:24,486][WARN ][bootstrap? ? ? ? ? ? ? ? ] Unable to lock JVM Memory: error=12,reason=Cannot allocate memory
[2016-12-13 19:38:24,487][WARN ][bootstrap? ? ? ? ? ? ? ? ] This can result in part of the JVM being swapped out.
[2016-12-13 19:38:24,487][WARN ][bootstrap? ? ? ? ? ? ? ? ] Increase RLIMIT_MEMLOCK, soft limit: 65536, hard limit: 65536
[2016-12-13 19:38:24,487][WARN ][bootstrap? ? ? ? ? ? ? ? ] These can be adjusted by modifying /etc/security/limits.conf, for example:
# allow user 'elasticsearch' mlockall
elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited
[2016-12-13 19:38:24,487][WARN ][bootstrap? ? ? ? ? ? ? ? ] If you are logged in interactively, you will have to re-login for the new limits to take effect.
[2016-12-13 19:38:24,732][INFO ][node? ? ? ? ? ? ? ? ? ? ] [es-node1] version[2.4.1], pid[2205], build[c67dc32/2016-09-27T18:57:55Z]
[2016-12-13 19:38:24,732][INFO ][node? ? ? ? ? ? ? ? ? ? ] [es-node1] initializing ...
[2016-12-13 19:38:25,547][INFO ][plugins? ? ? ? ? ? ? ? ? ] [es-node1] modules [reindex, lang-expression, lang-groovy], plugins [head, kopf], sites [head, kopf]
[2016-12-13 19:38:25,576][INFO ][env? ? ? ? ? ? ? ? ? ? ? ] [es-node1] using [1] data paths, mounts [[/ (/dev/mapper/VolGroup-lv_root)]], net usable_space [41.3gb], net total_space [44.8gb], spins? [possibly], types [ext4]
[2016-12-13 19:38:25,577][INFO ][env? ? ? ? ? ? ? ? ? ? ? ] [es-node1] heap size [990.7mb], compressed ordinary object pointers [true]
[2016-12-13 19:38:25,577][WARN ][env? ? ? ? ? ? ? ? ? ? ? ] [es-node1] max file descriptors [4096] for elasticsearch process likely too low, consider increasing to at least [65536]
[2016-12-13 19:38:27,698][INFO ][node? ? ? ? ? ? ? ? ? ? ] [es-node1] initialized
[2016-12-13 19:38:27,699][INFO ][node? ? ? ? ? ? ? ? ? ? ] [es-node1] starting ...
[2016-12-13 19:38:27,802][INFO ][transport? ? ? ? ? ? ? ? ] [es-node1] publish_address {192.168.91.221:9300}, bound_addresses {192.168.91.221:9300}
[2016-12-13 19:38:27,810][INFO ][discovery? ? ? ? ? ? ? ? ] [es-node1] es-cluster/eSp8hMm5Q5Cp2Txk-cWdmg
[2016-12-13 19:38:30,888][INFO ][cluster.service? ? ? ? ? ] [es-node1] new_master {es-node1}{eSp8hMm5Q5Cp2Txk-cWdmg}{192.168.91.221}{192.168.91.221:9300}{master=true}, added {{es-node2}{a-Jjk2FDQJeVRd3v7l6txg}{192.168.91.222}{192.168.91.222:9300}{master=false},{node-3}{r4P8l0P5QNWztxI4ILuwhw}{192.168.91.223}{192.168.91.223:9300}{master=false},}, reason: zen-disco-join(elected_as_master, [0] joins received)
[2016-12-13 19:38:31,039][INFO ][http? ? ? ? ? ? ? ? ? ? ] [es-node1] publish_address {192.168.91.221:9200}, bound_addresses {192.168.91.221:9200}
[2016-12-13 19:38:31,039][INFO ][node? ? ? ? ? ? ? ? ? ? ] [es-node1] started
[2016-12-13 19:38:31,272][INFO ][gateway? ? ? ? ? ? ? ? ? ] [es-node1] recovered [0] indices into cluster_state
后臺啟動
91221.elk.node1.com<2016-12-13 18:12:15=""> /opt/elasticsearch-node1/bin
elasticsearch>$ ./elasticsearch -d
1.3檢查是否啟動成功(OK)
elasticsearch>$ curl http://192.168.91.221:9200
{
"name" : "es-node1",
"cluster_name" : "es-cluster",
"cluster_uuid" : "igGG2L-HR-2xXTWC6FgLbQ",
"version" : {
"number" : "2.4.1",
"build_hash" : "c67dc32e24162035d18d6fe1e952c4cbcbe79d16",
"build_timestamp" : "2016-09-27T18:57:55Z",
"build_snapshot" : false,
"lucene_version" : "5.5.2"
},
"tagline" : "You Know, for Search"
}
或打開網(wǎng)頁
2? 集群管理插件
Elasticsearch-head
安裝
# /opt/elasticsearch-node1/bin/plugin install mobz/elasticsearch-head
-> Installing mobz/elasticsearch-head...
Trying https://github.com/mobz/elasticsearch-head/archive/master.zip ...
Downloading ............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................DONE
Verifying https://github.com/mobz/elasticsearch-head/archive/master.zip checksums if available ...
NOTE: Unable to verify checksum for downloaded plugin (unable to find .sha1 or .md5 file to verify)
Installed head into /opt/elasticsearch-node1/plugins/head
訪問 hhttp://192.168.91.221:9200/_plugin/head/
可方便查詢索引數(shù)據(jù)及索引大小，如下圖所示:
node2安裝
91222.elk.node2.com<2016-12-13 18:15:29=""> /opt/elasticsearch-node2/bin
elasticsearch>$ /opt/elasticsearch-node2/bin/plugin install mobz/elasticsearch-head
node3安裝
91223.elk.node3.com<2016-12-13 18:15:33=""> /opt/elasticsearch-node3/bin
elasticsearch>$ /opt/elasticsearch-node3/bin/plugin install mobz/elasticsearch-head
Elasticsearch-kofp
功能: 集群管理，監(jiān)控查看cpu、內(nèi)存使用情況、在線查詢/提交elsticsearch數(shù)據(jù)
安裝
91221.elk.node1.com<2016-12-13 19:49:40=""> /opt/elasticsearch-node1
elasticsearch>$ /opt/elasticsearch-node1/bin/plugin install lmenezes/elasticsearch-kopf
訪問 http://192.168.91.221:9200/_plugin/kopf
ES插件BigDesk安裝
bigdesk支持的最新版本的ES是1.3.0 ... 1.3.x
然而想要在新版本ES上安裝（2.x.x），項目中遇到過一些BUG，在ES在最新版本中有修復(fù)
https://github.com/lukas-vlcek/bigdesk/archive/master.zip
1.下載bigdesk的master的zip包
2.解壓到安裝路徑下 elasticsearch-2.4.1/plugins/目錄下，會有一個bigdesk或者bigdesk-master（可以改成bigdesk）目錄,然后再新建一個目錄_site,壓縮包里的文件放到_site目錄中。
3.提示沒有找到'plugin-descriptor.properties'文件，那就創(chuàng)建這個文件，并寫入以下內(nèi)容
91221.elk.node1.com<2016-12-13 20:15:42=""> /opt/elasticsearch-node1/plugins/bigdesk
elasticsearch>$ cat /opt/elasticsearch-node1/plugins/bigdesk/plugin-descriptor.properties
description=bigdesk
version=bigdesk
name=bigdesk
site=true
保存OK，大功告成。
注：_plugin后面的bigdesk就是plugins地下目錄名字，若是bigdesk-master，則需要寫這個名字
本以為會正常運行，然而出現(xiàn)了一個js彈框，有這樣的內(nèi)容
**************************
Bigdesk may not work correctly!
Found ES node version:2.3.0
Require ES node version:>= 1.0.0.RC1
**************************
解決辦法：
定位到plugins/bigdesk/_site/js/store目錄，打開BigdeskStore.js，定位到142行
return (major == 1 && minor >= 0 && maintenance >= 0 && (build != 'Beta1' || build != 'Beta2'));
看到這么一行，把 major ==1 改成 major >=1，然后保存。
瀏覽器重新打開 http://192.168.91.221:9200/_plugin/bigdesk/
OK.可以看到正常運行了。
Marvel
Marvel是Elastic公司推出的商業(yè)監(jiān)控方案，是用來監(jiān)控Elasticsearch集群，歷史狀態(tài)的有力工具，便于性能優(yōu)化以及故障診斷。監(jiān)控主要分為六個層面，分別是集群層、節(jié)點層、索引層、分片層、事件層、Sense。
安裝步驟：
1) 在Elasticsearch中安裝Marvel插件。
bin/plugin install license
bin/plugin install marvel-agent
2) 在Kibana中安裝Marvel插件
bin/kibana plugin --install elasticsearch/marvel/latest
3) 啟動Elasticsearch和Kibana
bin/elasticsearch
bin/kibana
安裝好后在瀏覽器中輸入：http://127.0.0.1:5601/即可看到界面如圖9.1所示。
http://static.oschina.net/uploads/space/2016/0819/081823_imMw_247205.png
參考文檔：
https://my.oschina.net/topeagle/blog/405149? elasticsearch配置文件詳解
http://www.iyunv.com/thread-271492-1-1.html? Elasticsearch 2.x.x版本如何安裝bigdesk
