基于Centos7.6安装ElasticSearch7.3

想起以前的一个需求，需要统计10几台服务器上Tomcat产生的日志，提取规则就是每天定时采集前一天的日志，当时用shell(find-tar-scp-tar)弄的比较简单,
随着项目规模扩大，服务器需要扩容，以前的日志收集方案发现不是很方便，网上收集资料使用EFK(非ELK)，本文先安装ZS集群。

1. elastic官网 https://www.elastic.co/cn/products/elasticsearch
2. elastic官方文档 https://www.elastic.co/guide/en/elastic-stack/current/overview.html
3. es可视化插件 https://github.com/mobz/elasticsearch-head

下载启动，可以去(官网提供下载页面)[https://www.elastic.co/cn/downloads/elasticsearch
]，根据系统版本进行下载安装,此日志搜集系统EFK使用的版本均为最新版本:7.3.1。
例如我们服务器系统为Centos7.6

wget -P /data/app/ https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.3.1-linux-x86_64.tar.gz
tar -xvf 
cd /data/app 
tar -xvf elasticsearch-7.3.1-linux-x86_64.tar.gz
cd elasticsearch-7.3.1
bin/elasticsearch

启动报错：

【1】: max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536] 
【2】: max number of threads [1024] for user [es] is too low, increase to at least [4096] 
【3】: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解决:
1
2
3

使用另一终端测试:

[lhadmin@reptestweb ~]$ curl http://10.231.134.190:9200/
{
  "name" : "master",
  "cluster_name" : "my-application",
  "cluster_uuid" : "_na_",
  "version" : {
    "number" : "7.3.1",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "4749ba6",
    "build_date" : "2019-08-19T20:19:25.651794Z",
    "build_snapshot" : false,
    "lucene_version" : "8.1.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

集群

配置

#master
cluster.name: my-application
node.name: master
network.host: 10.231.134.190
http.port: 9200
transport.port: 9300
discovery.seed_hosts: ["10.231.134.190:9300", "10.231.134.190:9301", "10.231.134.190:9302"]
cluster.initial_master_nodes: ["master", "slave1", "slave2"]

#slave1
cluster.name: my-application
node.name: slave1
network.host: 10.231.134.190
http.port: 9201
transport.port: 9301
discovery.seed_hosts: ["10.231.134.190:9300", "10.231.134.190:9301", "10.231.134.190:9302"]
cluster.initial_master_nodes: ["master", "slave1", "slave2"]

#slave2
cluster.name: my-application
node.name: slave2
network.host: 10.231.134.190
http.port: 9202
transport.port: 9302
discovery.seed_hosts: ["10.231.134.190:9300", "10.231.134.190:9301", "10.231.134.190:9302"]
cluster.initial_master_nodes: ["master", "slave1", "slave2"]

分别启动多个节点

$bin/elasticsearch > out.log & 2& 1 &

安装可视化插件

elasticsearch-head是基于es提供的restful接口来管理ES

安装

git clone git://github.com/mobz/elasticsearch-head.git
cd elasticsearch-head
npm install
npm run start

浏览器打开:http://localhost:9100/
默认情况下，页面调用的es接口都是跨域的，所以页面不会看到数据，需要配置es跨域，如下：

http.cors.enabled: true
http.cors.allow-origin: "*"

##后记
这里只是安装搭建好了ES集群，后面搭建FileBeat以及kina。。
由于版本比较新，网上资源比较少，几乎都是安装官网提供的文档来操作，那个英文头疼死老子了。。。