两年前写过一篇elasticsearch介绍入门及常用用法整理，是单机版的，这次补下集群的搭建记录。
以ubuntu为例，三台机器搭建集群,ip分别为172.20.10.3,172.20.10.6,172.20.10.8
下载
elasticsearch官网下载地址：https://www.elastic.co/cn/downloads/elasticsearch
截止发文最新版本是8.3.2,下载链接为：https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.3.2-linux-x86_64.tar.gz
注意事项
1.要用非root用户运行，这三台机器已经都有非root用户了，如果没有可以新建一个,如下命令：
#创建用户组
groupadd esgroup
#创建用户并添加至用户组
useradd es -g esgroup -s /bin/bash
#设置密码
passwd es
#设置新用户对于/es/目录的权限
chown -R es:esgroup es
2.下载的安装包里自带jdk,要求jdk11或以上，我的机器上已经是java11的jdk,如果服务器上java版本是jdk8，那么要自己修改安装包下bin文件夹下的elasticsearch-env文件，把指定路径改成安装包自带的jdk路径。
安装及修改配置文件
把下载的tar.gz发送到172.20.10.3机器上，我是发送到了/home/zhaohy/elasticsearch文件夹下
解压
tar -zxvf elasticsearch-8.3.2-linux-x86_64.tar.gz
修改config/elasticsearch.yml配置文件（172.20.10.3这台机为例，其他两台机只要改其中各自的ip和节点名就好）
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: es-cluster
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: es-node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /home/zhaohy/elasticsearch/data
#
# Path to log files:
#
#path.logs: /path/to/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# By default Elasticsearch is only accessible on localhost. Set a different
# address here to expose this node on the network:
#
network.host: 172.20.10.3
#
# By default Elasticsearch listens for HTTP traffic on the first free port it
# finds starting at 9200. Set a specific HTTP port here:
#
http.port: 9200
transport.port: 9300
xpack.security.enabled: false
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.seed_hosts: ["172.20.10.8:9300", "172.20.10.6:9300", "172.20.10.3:9300"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["es-node-3", "es-node-2", "es-node-1"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# --------------------------------- Readiness ----------------------------------
#
# Enable an unauthenticated TCP readiness endpoint on localhost
#
#readiness.port: 9399
#
# ---------------------------------- Various -----------------------------------
#
# Allow wildcard deletion of indices:
#
#action.destructive_requires_name: false
如果使用的是域名或主机名进行互相访问，还需要增加以下2个参数：
http.cors.enabled: true
http.cors.allow-origin: "*"
把安装包发送到其他两台机（以172.20.10.6为例）
cd /home/zhaohy
scp -r elasticsearch/ [email protected]:/home/zhaohy
其他两台机也配置好 只要修改node.name和network.host为对应的节点名和ip就好，这里省略不写
启动（需要非root用户，如果是root用户先切到其他用户）
cd /home/zhaohy/elasticsearch/elasticsearch-8.3.2/bin
./elasticsearch &
有可能会遇到的启动异常：
1.内存太小，默认es需要4g的内存，如果是做测试，可以设置config/jvm.options文件里的内存为1g
-Xms1g
-Xmx1g
2.max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
系统虚拟内存默认最大映射数为65530，无法满足ES系统要求，需要调整为262144以上。
设置vm.max_map_count参数:
#修改文件
sudo vi /etc/sysctl.conf
#添加参数
vm.max_map_count = 262144
#重新加载/etc/sysctl.conf配置
sudo sysctl -p
以上修改的，其他两台机也要做修改
三台机依次启动，es会自动连接为集群，单独一台机启动构不成集群，至少两台才能启动，至少三台才能可用（确保至少挂掉一台es还能正常使用，可以无缝滚动升级版本）。
3.TOO_MANY_REQUESTS/12/disk usage exceeded flood-stage watermark
是因为一次请求中批量插入的数据条数巨多，以及短时间内的请求次数巨多引起ES节点服务器内存超过限制，ES主动给索引上锁。
解决方法:
紧急给Elasticsearch的硬盘扩容，扩容完毕后执行以下语句关闭索引的只读状态：
PUT _all/_settings
{
"index.blocks.read_only_allow_delete": null
}
检查集群健康
curl http://172.20.10.3:9200/_cat/health?v
结果如下：
epoch timestamp cluster status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1657698121 07:42:01 es-cluster green 3 3 2 1 0 0 0 0 - 100.0%
可以看到集群成功了
关掉es命令
jps
kill -9 es的pid
重启
jps
kill -9 es的pid
cd /home/zhaohy/elasticsearch/elasticsearch-8.3.2/bin
./elasticsearch &