參考手冊：https://cloud.tencent.com/developer/article/1011050 es版本： 1. 3臺6.1.2的版本的作ES叢集用於日誌和報表,安裝外掛如下: a. elasticsearch-analysis-ik 6.1.2 b. Elasticsearch-head 6.1.2 視覺化管理平臺

系統環境：centos7.5 es版本：elasticsearch-6.1.2 jdk：1.8 主機ip 192.168.2.126 192.168.2.127 192.168.2.128

1、軟體下載 wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.1.2.tar.gz

2、jdk安裝 wget ftp://10.249.100.249/pub/jdk/jdk8/*

3、安裝es

tar -xzvf elasticsearch-6.1.2.tar.gz -C /usr/local/ cd /usr/local/ mv elasticsearch-6.1.2/ elasticsearch

4、建立data目錄和log目錄 mkdir -p /data/elasticsearch/data mkdir -p /data/elasticsearch/logs

5、建立使用者(es不能用root執行) useradd es chown -R es:es /usr/local/elasticsearch chown -R es:es /data

6、系統引數優化 vim /usr/local/elasticsearch/config/jvm.options -Xms4g -Xmx4g

vi /etc/sysctl.conf    vm.max_map_count=262144    fs.file-max=655360

vi /etc/security/limits.conf     es         soft   memlock      unlimited     es        hard   memlock      unlimited

7、編輯配置檔案 [[email protected] ~]# grep '^[a-z]' /usr/local/elasticsearch/config/elasticsearch.yml cluster.name: es6.1.2 node.name: node-126 node.master: true path.data: /data/elasticsearch/data path.logs: /data/elasticsearch/logs bootstrap.memory_lock: true network.host: 0.0.0.0 http.port: 9200 transport.tcp.port: 9300 discovery.zen.ping.unicast.hosts: ["192.168.2.126", "192.168.2.127", "192.168.2.128"] gateway.recover_after_nodes: 3

[[email protected] bin]# grep '^[a-z]' /usr/local/elasticsearch/config/elasticsearch.yml cluster.name: es6.1.2 node.name: node-127 node.master: true path.data: /data/elasticsearch/data path.logs: /data/elasticsearch/logs bootstrap.memory_lock: true network.host: 0.0.0.0 http.port: 9200 transport.tcp.port: 9300 discovery.zen.ping.unicast.hosts: ["192.168.2.126", "192.168.2.127", "192.168.2.128"] gateway.recover_after_nodes: 3

[[email protected] ~]# grep '^[a-z]' /usr/local/elasticsearch/config/elasticsearch.yml cluster.name: es6.1.2 node.name: node-128 node.master: true path.data: /data/elasticsearch/data path.logs: /data/elasticsearch/logs bootstrap.memory_lock: true network.host: 0.0.0.0 http.port: 9200 transport.tcp.port: 9300 discovery.zen.ping.unicast.hosts: ["192.168.2.126", "192.168.2.127", "192.168.2.128"] discovery.zen.minimum_master_nodes: 2 gateway.recover_after_nodes: 3

8、啟動 su - es /usr/local/elasticsearch/bin/elasticsearch -d

查詢ES程序 ps -ef | grep elastic 殺掉ES程序 kill -9 2382（程序號） 重啟ES sh elasticsearch -d

9、檢查 [[email protected] ~]$ curl localhost:9200 {   "name" : "node-126",   "cluster_name" : "es6.1.2",   "cluster_uuid" : "-k1nGSoAQri3ToEqSoQHYg",   "version" : {     "number" : "6.1.2",     "build_hash" : "5b1fea5",     "build_date" : "2018-01-10T02:35:59.208Z",     "build_snapshot" : false,     "lucene_version" : "7.1.0",     "minimum_wire_compatibility_version" : "5.6.0",     "minimum_index_compatibility_version" : "5.0.0"   },   "tagline" : "You Know, for Search" } [[email protected] ~]$ jps 14817 Elasticsearch 15928 Jps [[email protected] ~]$ curl localhost:9200 {   "name" : "node-127",   "cluster_name" : "es6.1.2",   "cluster_uuid" : "-k1nGSoAQri3ToEqSoQHYg",   "version" : {     "number" : "6.1.2",     "build_hash" : "5b1fea5",     "build_date" : "2018-01-10T02:35:59.208Z",     "build_snapshot" : false,     "lucene_version" : "7.1.0",     "minimum_wire_compatibility_version" : "5.6.0",     "minimum_index_compatibility_version" : "5.0.0"   },   "tagline" : "You Know, for Search" } [[email protected] ~]$ jps 15026 Elasticsearch 16091 Jps

[email protected] ~]$ curl localhost:9200 {   "name" : "node-128",   "cluster_name" : "es6.1.2",   "cluster_uuid" : "-k1nGSoAQri3ToEqSoQHYg",   "version" : {     "number" : "6.1.2",     "build_hash" : "5b1fea5",     "build_date" : "2018-01-10T02:35:59.208Z",     "build_snapshot" : false,     "lucene_version" : "7.1.0",     "minimum_wire_compatibility_version" : "5.6.0",     "minimum_index_compatibility_version" : "5.0.0"   },   "tagline" : "You Know, for Search" } [[email protected] ~]$ jps

16033 Jps 14968 Elasticsearch

或者登陸檢查 http://192.168.2.126:9200/ http://192.168.2.127:9200/ http://192.168.2.128:9200/

Elasticsearch的健康檢查

https://www.elastic.co/guide/en/elasticsearch/guide/current/_cluster_health.html 

Elasticsearch提供了自身用於健康檢查的API，會返回一組JSON的資料： curl -XGET http://192.168.2.126:9200/_cluster/health  curl -XGET http://192.168.2.126:9200/_cluster/health?pretty=true

同時，官方還提供了多樣監控資訊，可以通過cat API的方式來返回需要的資料： https://www.elastic.co/guide/en/elasticsearch/guide/current/_cat_api.html  curl -XGET http://192.168.2.128:9200/_cat/health

對叢集中的任意一個節點去查詢，此節點都會從蒐集到整個叢集的資訊進行返回：  curl -XGET http://192.168.2.128:9200/_cat/nodes?v   Elasticsearch有green/yellow/red  三種不同的狀態級別， green 表示所有節點分片正常，yellow 表示主節點分片正常，副本節點分片存在故障或丟失，red 表示主節點分片丟失，在搜尋時只能返回部分結果。   [[email protected] ~]$ curl -XGET http://192.168.2.126:9200/_cluster/health?pretty=true {   "cluster_name" : "es6.1.2",   "status" : "green",   "timed_out" : false,   "number_of_nodes" : 3,   "number_of_data_nodes" : 3,   "active_primary_shards" : 0,   "active_shards" : 0,   "relocating_shards" : 0,   "initializing_shards" : 0,   "unassigned_shards" : 0,   "delayed_unassigned_shards" : 0,   "number_of_pending_tasks" : 0,   "number_of_in_flight_fetch" : 0,   "task_max_waiting_in_queue_millis" : 0,   "active_shards_percent_as_number" : 100.0 } [[email protected] ~]$ curl -XGET http://192.168.2.128:9200/_cat/health 1534565131 12:05:31 es6.1.2 green 3 3 0 0 0 0 0 0 - 100.0% [[email protected] ~]$ curl -XGET http://192.168.2.128:9200/_cat/nodes?v ip              heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name 192.168.2.126            7          63   0    0.02    0.16     0.15 mdi       -      node-126 192.168.2.127            7          62   0    0.00    0.07     0.08 mdi       *      node-127 192.168.2.128            4          63   1    0.00    0.06     0.08 mdi       -      node-128 [[email protected] ~]$ curl -XGET http://192.168.2.127:9200/_cat/nodes?v ip              heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name 192.168.2.126            7          63   0    0.01    0.15     0.15 mdi       -      node-126 192.168.2.127            4          62   0    0.00    0.06     0.08 mdi       *      node-127 192.168.2.128            4          63   0    0.00    0.06     0.08 mdi       -      node-128

============================================== #叢集的名稱 cluster.name: es6.2 #節點名稱,其餘兩個節點分別為node-2 和node-3 node.name: node-1 #指定該節點是否有資格被選舉成為master節點，預設是true，es是預設叢集中的第一臺機器為master，如果這臺機掛了就會重新選舉master node.master: true #允許該節點儲存資料(預設開啟) node.data: true #索引資料的儲存路徑 path.data: /usr/local/elk/elasticsearch/data #日誌檔案的儲存路徑 path.logs: /usr/local/elk/elasticsearch/logs #設定為true來鎖住記憶體。因為記憶體交換到磁碟對伺服器效能來說是致命的，當jvm開始swapping時es的效率會降低，所以要保證它不swap bootstrap.memory_lock: true #繫結的ip地址 network.host: 0.0.0.0 #設定對外服務的http埠，預設為9200 http.port: 9200 # 設定節點間互動的tcp埠,預設是9300  transport.tcp.port: 9300 #Elasticsearch將繫結到可用的環回地址，並將掃描埠9300到9305以嘗試連線到執行在同一臺伺服器上的其他節點。 #這提供了自動叢集體驗，而無需進行任何配置。陣列設定或逗號分隔的設定。每個值的形式應該是host:port或host #（如果沒有設定，port預設設定會transport.profiles.default.port 回落到transport.tcp.port）。 #請注意，IPv6主機必須放在括號內。預設為127.0.0.1, [::1] discovery.zen.ping.unicast.hosts: ["192.168.8.101:9300", "192.168.8.103:9300", "192.168.8.104:9300"] #如果沒有這種設定,遭受網路故障的叢集就有可能將叢集分成兩個獨立的叢集 - 分裂的大腦 - 這將導致資料丟失 discovery.zen.minimum_master_nodes: 2