ES版本：6.2.4

叢集環境：7臺機器，每臺部署一個master節點。其中3臺部署2個hot節點，另外4臺部署2個warm節點。共21個節點。

1. 掛盤

按實際情況分盤，一個機子上的2個data節點均分資料磁碟。

通過UUID掛盤，以防止以後換盤，碟符移動（這裡拿3個盤舉例）。

mkdir -p /data01a/esat
mkdir -p /data02b/esat
mkdir -p /data03c/esat

blkid

vi /etc/fstab
UUID="f78d2fb8-4b00-4f08-af69-07d533b54a85"	/data01a ext4 defaults 0 3
UUID="3cd45d40-e51c-42ce-9b6b-8d2c315a8f9d"	/data02b ext4 defaults 0 3
UUID="396e2e59-e92c-4813-a1f1-ed560731a361"	/data03c ext4 defaults 0 3

mount -a

2. 建立使用者，修改磁碟許可權

groupadd esadmin
useradd -g esadmin esadmin
useradd -g esadmin esmaster
useradd -g esadmin esdata

chown -R esadmin:esadmin /data01a
chown -R esadmin:esadmin /data02b
chown -R esadmin:esadmin /data03c

chmod -R 771 /data*

3. 系統設定

vi /etc/sysctl.conf
vm.swappiness = 1
vm.max_map_count = 262144

sysctl -p

vi /etc/security/limits.conf
@esadmin - nofile 65536
@esadmin - nproc 4096
@esadmin - memlock unlimited

4.安裝JDK8

rpm -i jdk-8u171-linux-x64.rpm

5. 安裝ES

將ES安裝檔案拷貝到對應目錄下。

安裝master：

cd /home/esmaster
unzip elasticsearch-6.2.4.zip

修改配置：
vi elasticsearch-6.2.4/config/elasticsearch.yml

cluster.name: es-xx

node.name: master-at-xx
node.master: true 
node.data: false 
node.ingest: false 
search.remote.connect: false

bootstrap.memory_lock: true
bootstrap.system_call_filter: false

network.host: xx.xx.xx.xx
http.port: 9200
transport.tcp.port: 9300

http.cors.enabled: true 
http.cors.allow-origin: "*" 

discovery.zen.ping.unicast.hosts: ["xx.xx.xx.xx:9300", "xx.xx.xx.xx:9300", "xx.xx.xx.xx:9300", ...] 
discovery.zen.minimum_master_nodes: 4 
discovery.zen.fd.ping_interval: 10s 
discovery.zen.fd.ping_timeout: 60s 
discovery.zen.fd.ping_retries: 3 

gateway.expected_master_nodes: 7 
gateway.recover_after_time: 10m 
gateway.recover_after_master_nodes: 4

安裝ik分詞器：

./elasticsearch-6.2.4/bin/elasticsearch-plugin install file:///home/esmaster/elasticsearch-analysis-ik-6.2.4.zip

chown -R esmaster:esadmin *

安裝data：

cd /home/esdata

unzip elasticsearch-6.2.4.zip

修改配置：
vi elasticsearch-6.2.4/config/elasticsearch.yml

cluster.name: es-xx

node.name: data-at-40

node.master: false
node.data: true
node.ingest: true
search.remote.connect: true
search.remote.node.attr: gateway

node.attr.type: hot
node.attr.gateway: true

path.data: ["/data01a/esat", "/data02b/esat", "/data03c/esat", ...]

bootstrap.memory_lock: true
bootstrap.system_call_filter: false

network.host: xx.xx.xx.xx
http.port: 9201
transport.tcp.port: 9301

http.cors.enabled: true
http.cors.allow-origin: "*"

discovery.zen.ping.unicast.hosts: ["xx.xx.xx.xx:9300", "xx.xx.xx.xx:9300", "xx.xx.xx.xx:9300", ...] 

discovery.zen.minimum_master_nodes: 4 
discovery.zen.fd.ping_interval: 10s 
discovery.zen.fd.ping_timeout: 60s 
discovery.zen.fd.ping_retries: 3 

gateway.expected_master_nodes: 7 
gateway.recover_after_time: 10m 
gateway.recover_after_master_nodes: 4

上面是hot節點的配置（node.attr.type: hot），warm節點類似。

安裝ik分詞器：

./elasticsearch-6.2.4/bin/elasticsearch-plugin install file:///home/esdata/elasticsearch-analysis-ik-6.2.4.zip

chown -R esdata:esadmin *

修改JVM配置檔案

vi /home/esmaster/elasticsearch-6.2.4/config/jvm.options
master 修改jvm.options -Xms10g -Xmx10g
vi /home/esdata/elasticsearch-6.2.4/config/jvm.options
data 修改jvm.options -Xms31g -Xmx31g

6 啟動

./bin/elasticsearch -p pid -d

7. 啟動監控工具head和Bigdesk

unzip es_tools.zip
cd es_tools
nohup python -m SimpleHTTPServer 9080 &

8. 設定索引模板

put _template/app_template
{
    "order": 0,
    "template": "app_*",
    "settings": {
      "index": {
        "unassigned": {
            "node_left": {
                "delayed_timeout": "10m"
            }
        },
        "routing": {
            "allocation": {
                "include": {"type": "hot"}
            }
        },
        "refresh_interval": "5s",
        "number_of_shards": "1",
        "number_of_replicas": "1"
      }
    },
    "mappings": {
        "_doc": {
            "date_detection": false,
            "properties": {
                "timestamp": {
                    "format": "yyyy-MM-dd HH:mm:ss:SSS||yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss||dateOptionalTime",
                    "type": "date"
                },
                "@timestamp": {
                    "format": "yyyy-MM-dd HH:mm:ss:SSS||yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss||dateOptionalTime",
                    "type": "date"
                },
                "attimestamp": {
                    "format": "yyyy-MM-dd HH:mm:ss:SSS||yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss||dateOptionalTime",
                    "type": "date"
                },
                "ip": {
                    "type": "ip"
                },
                "message": {
                    "search_analyzer": "ik_max_word",
                    "analyzer": "ik_max_word",
                    "type": "text"
                }
            },
            "dynamic_templates": [
                {
                  "strings_not_analyzed": {
                    "match_mapping_type": "string",
                    "mapping": {
                      "type": "keyword"
                    }
                  }
                }
            ]
        }
    }
}

以上設定所有以“app_”命名的索引的template，預設分配到hot節點。

9.遷移索引

動態修改某個索引到warm節點。如設定"app_index"這個索引到warm節點：

PUT app_index/_settings
{
  "index": {
    "routing": {
        "allocation": {
            "include": {"type": "warm"}
        }
    }
  }
}

參考：

https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-cluster.html

https://www.elastic.co/guide/en/elasticsearch/reference/6.2/modules-cross-cluster-search.html

https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html