Elasticsearch是基于Lucene分布式、实时查询的搜索分析引擎。我目前应用在日志集中化处理上。。。

https://www.elastic.co/downloads/elasticsearch

 

详情 参考：http://www.mvpbang.com/post/18.html

 

vi /etc/security/limits.conf    #限制调整

* soft nofile 65536

* hard nofile 131072

* soft nproc 2048

* hard nproc 4096

 

vi /etc/security/limits.d/90-nproc.conf

* soft nproc 2048

 

vi /etc/sysctl.conf             #内核参数调整

vm.max_map_count=655350

 

sysctl -p  #刷新参数，立即生效

 

tar zxf elasticsearch-5.4.0.tar.gz

useradd elk

chown -R elk.elk elasticsearch-5.4.0

 

vim elasticsearch.yml

[root@25 config]# cat elasticsearch.yml

# ======================== Elasticsearch Configuration =========================

#

# NOTE: Elasticsearch comes with reasonable defaults for most settings.

#       Before you set out to tweak and tune the configuration, make sure you

#       understand what are you trying to accomplish and the consequences.

#

# The primary way of configuring a node is via this file. This template lists

# the most important settings you may want to configure for a production cluster.

#

# Please consult the documentation for further information on configuration options:

# https://www.elastic.co/guide/en/elasticsearch/reference/index.html

#

# ---------------------------------- Cluster -----------------------------------

#

# Use a descriptive name for your cluster:

#

#cluster.name: my-application

#

# ------------------------------------ Node ------------------------------------

#

# Use a descriptive name for the node:

#

#node.name: node-1

#默认下满的没写，默认true

#node.master: true

#node.data: true

# Add custom attributes to the node:

#

#node.attr.rack: r1

#

# ----------------------------------- Paths ------------------------------------

#

# Path to directory where to store the data (separate multiple locations by comma):

#

#path.data: /path/to/data

#

# Path to log files:

#

#path.logs: /path/to/logs

#

# ----------------------------------- Memory -----------------------------------

#

# Lock the memory on startup:

#

# Make sure that the heap size is set to about half the memory available

# on the system and that the owner of the process is allowed to use this

# limit.

#

# Elasticsearch performs poorly when the system is swapping the memory.

#

# ---------------------------------- Network -----------------------------------

#

# Set the bind address to a specific IP (IPv4 or IPv6):

#

#

# Set a custom port for HTTP:

#

#http.port: 9200

#

# For more information, consult the network module documentation.

#

# --------------------------------- Discovery ----------------------------------

#

# Pass an initial list of hosts to perform discovery when new node is started:

# The default list of hosts is ["127.0.0.1", "[::1]"]

#

# Prevent the "split brain" by configuring the majority of nodes (total number of master-eligibl

e nodes / 2 + 1):#

#discovery.zen.minimum_master_nodes: 3

#

# For more information, consult the zen discovery module documentation.

#

# ---------------------------------- Gateway -----------------------------------

#

# Block initial recovery after a full cluster restart until N nodes are started:

#

#gateway.recover_after_nodes: 3

#

# For more information, consult the gateway module documentation.

#

# ---------------------------------- Various -----------------------------------

#

# Require explicit names when deleting indices:

#

#action.destructive_requires_name: true

 

配置虚拟内存

[root@25 config]# cat jvm.options 

## JVM configuration

 

################################################################

## IMPORTANT: JVM heap size

################################################################

##

## You should always set the min and max JVM heap

## size to the same value. For example, to set

## the heap to 4 GB, set:

##

## -Xms4g

## -Xmx4g

##

## See https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html

## for more information

##

################################################################

 

# Xms represents the initial size of total heap space

# Xmx represents the maximum size of total heap space

 

su - elk 

./bin/elasticsearch

[elk@25 elasticsearch-5.4.0]$ ./bin/elasticsearch

[2017-05-14T15:09:33,260][INFO ][o.e.n.Node               ] [] initializing ...

[2017-05-14T15:09:33,411][INFO ][o.e.e.NodeEnvironment    ] [db0Zha8] using [1] data paths, moun

ts [[/ (/dev/sda2)]], net usable_space [25.3gb], net total_space [38.3gb], spins? [possibly], types [ext4][2017-05-14T15:09:33,411][INFO ][o.e.e.NodeEnvironment    ] [db0Zha8] heap size [1015.6mb], comp

ressed ordinary object pointers [true][2017-05-14T15:09:33,414][INFO ][o.e.n.Node               ] node name [db0Zha8] derived from nod

e ID [db0Zha8iQzSDCMcBL8bqiA]; set [node.name] to override[2017-05-14T15:09:33,415][INFO ][o.e.n.Node               ] version[5.4.0], pid[5685], build[780

f8c4/2017-04-28T17:43:27.229Z], OS[Linux/2.6.32-431.el6.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0_131/25.131-b11][2017-05-14T15:09:35,090][INFO ][o.e.p.PluginsService     ] [db0Zha8] loaded module [aggs-matrix

-stats][2017-05-14T15:09:35,091][INFO ][o.e.p.PluginsService     ] [db0Zha8] loaded module [ingest-comm

on][2017-05-14T15:09:35,091][INFO ][o.e.p.PluginsService     ] [db0Zha8] loaded module [lang-expres

sion][2017-05-14T15:09:35,091][INFO ][o.e.p.PluginsService     ] [db0Zha8] loaded module [lang-groovy

][2017-05-14T15:09:35,091][INFO ][o.e.p.PluginsService     ] [db0Zha8] loaded module [lang-mustac

he][2017-05-14T15:09:35,092][INFO ][o.e.p.PluginsService     ] [db0Zha8] loaded module [lang-painle

ss][2017-05-14T15:09:35,092][INFO ][o.e.p.PluginsService     ] [db0Zha8] loaded module [percolator]

[2017-05-14T15:09:35,096][INFO ][o.e.p.PluginsService     ] [db0Zha8] loaded module [reindex]

[2017-05-14T15:09:35,096][INFO ][o.e.p.PluginsService     ] [db0Zha8] loaded module [transport-n

etty3][2017-05-14T15:09:35,096][INFO ][o.e.p.PluginsService     ] [db0Zha8] loaded module [transport-n

etty4][2017-05-14T15:09:35,098][INFO ][o.e.p.PluginsService     ] [db0Zha8] no plugins loaded

[2017-05-14T15:09:38,305][INFO ][o.e.d.DiscoveryModule    ] [db0Zha8] using discovery type [zen]

[2017-05-14T15:09:39,494][INFO ][o.e.n.Node               ] initialized

[2017-05-14T15:09:39,495][INFO ][o.e.n.Node               ] [db0Zha8] starting ...

[2017-05-14T15:09:39,773][INFO ][o.e.t.TransportService   ] [db0Zha8] publish_address {172.24.0.

25:9300}, bound_addresses {172.24.0.25:9300}[2017-05-14T15:09:39,794][INFO ][o.e.b.BootstrapChecks    ] [db0Zha8] bound or publishing to a n

on-loopback or non-link-local address, enforcing bootstrap checks

测试

http://ip:9200

_cat命令

https://www.elastic.co/guide/en/elasticsearch/reference/current/cat.html

 

07、脚本

#!/bin/bash

 

#判断用户

if [ `id -u` -eq 0 ]; then

echo "Not permit root"

exit 1

fi

 

#启动

start(){

cd  /xxx/elasticsearch-5.3.0    #es家目录

./bin/elasticsearch  -d         #后台运行

}

 

#关闭

stop(){

ps -ef | grep elasticsearch | grep -v grep |awk ‘{print $2}‘ |xargs kill -9

}

 

case "$1" in

  start)

     start

     ;;

  stop)

     stop

    ;;

     *)

     echo "Use $0 start | stop"

esac

 

#官方指导说明

https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html