Elasticsearch 是一个分布式可扩展的实时搜索和分析引擎,一个建立在全文搜索引擎 Apache Lucene(TM) 基础上的搜索引擎
特点：分布式，可扩展，实时分析

安装前提：需要jdk8

使用系统：centos7
配置jdk1.8参考：Linux JDK1.8配置

安装前配置、参数调整

#elasticsearch 需要使用非root用户启动，创建一个用户
[root@localhost ~]# useradd elk
[root@localhost ~]# passwordd elk

#修改系统配置参数，以免启动时候出问题

#会出现的错误：max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536]
[root@localhost ~]#  vim /etc/security/limits.conf
* soft nofile 65536
* hard nofile 65536

#会出现的错误：max number of threads [1024] for user [elk] is too low, increase to at least [2048]
[root@localhost ~]#  vim /etc/security/limits.d/20-nproc.conf
* soft nproc 4096
root soft nproc unlimited

#会出现的错误：max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[root@localhost ~]# vim /etc/sysctl.con
vm.max_map_count=262144

#再执行读取生效下
[root@localhost ~]# sysctl -p


 
#会出现的错误：centos6.* 下面会报一个错误
[2017-07-14T19:35:42,948][ERROR][o.e.b.Bootstrap ] [node-1] node validation exception
[1] bootstrap checks failed
[1]: system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
这是在因为Centos6不支持SecComp，而ES5.2默认bootstrap.system_call_filter为true进行检测，所以导致检测失败，失败后直接导致ES不能启动。

解决 elasticsearch配置文件加入：
bootstrap.memory_lock: false
bootstrap.system_call_filter: false
 

1，下载、解压

[root@localhost ~]# mkdir /elk
[root@localhost ~]# mkdir /source && cd /source

[root@localhost source]# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.4.1.tar.gz
[root@localhost source]# tar xf elasticsearch-5.6.0.tar.gz
[root@localhost source]# mv elasticsearch-5.6.0 /elk/elasticsearch
[root@localhost source]# chown elk.elk -R /elk/elasticsearch

切换elk用户操作、启动

[root@localhost source]# su - elk
[elk@localhost ~]$ cd /elk/elasticsearch/config
[elk@localhost config]$ vim elasticsearch.yml
#修改下面几项（名称自定义）
cluster.name: my-elk
node.name: node-1
network.host: 0.0.0.0
http.port: 9200

#启动服务（如果有没有进程和端口请查看日志是否有报错）
[elk@localhost config]$ /elk/elasticsearch/bin/elasticsearch -d

#查看进程
[elk@localhost config]$ ps -ef |grep elasticsearch
elk      24658     1 18 11:43 pts/1    00:00:13 /usr/local/jdk1.8.0_131/bin/java -Xms2g -Xmx2g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+AlwaysPreTouch -server -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -Djdk.io.permissionsUseCanonicalPath=true -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Dlog4j.skipJansi=true -XX:+HeapDumpOnOutOfMemoryError -Des.path.home=/elk/elasticsearch -cp /elk/elasticsearch/lib/* org.elasticsearch.bootstrap.Elasticsearch -d
elk      24782 24491  0 11:45 pts/1    00:00:00 grep --color=auto elasticsearch

#查看端口
[elk@localhost config]$ netstat -lntp
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name                     
tcp6       0      0 :::9200                 :::*                    LISTEN      24658/java          
tcp6       0      0 :::9300                 :::*                    LISTEN      24658/java          
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
tcp6       0      0 ::1:25 

2.安装head插件 root用户操作

#需要node支持，安装node
[root@localhost ~]# cd /source
[root@localhost source]# wget https://www.jinchuang.org/novel/lnmp/node-v6.11.0-linux-x64.tar.xz
[root@localhost source]# tar xf node-v6.11.0-linux-x64.tar.xz -C /usr/local/
[root@localhost source]# cd /usr/local/
[root@localhost local]# mv node-v6.11.0-linux-x64 node

#修改系统变量
[root@localhost ~]# vim /etc/profile
export PATH=$PATH:/usr/local/node/bin
 
#重新读取系统变量
[root@localhost ~]# source /etc/profile

#验证node和npm
[root@localhost ~]# node -v
v6.11.0
[root@localhost ~]# npm -v
3.10.10

#安装head插件
[root@localhost ~]# yum install git -y
[root@localhost ~]# cd /elk

[root@localhost elk]# git clone git://github.com/mobz/elasticsearch-head.git
Cloning into 'elasticsearch-head'...
remote: Enumerating objects: 4224, done.
remote: Total 4224 (delta 0), reused 0 (delta 0), pack-reused 4224
Receiving objects: 100% (4224/4224), 2.16 MiB | 22.00 KiB/s, done.
Resolving deltas: 100% (2328/2328), done.

[root@localhost elasticsearch-head]# cd elasticsearch-head/
[root@localhost elasticsearch-head]# npm install -g grunt
[root@localhost elasticsearch-head]# npm install -g grunt-cli
[root@localhost elasticsearch-head]# npm install

#修改配置文件
[root@localhost elasticsearch-head]# vim Gruntfile.js
#找到connect-server-options选项 添加一条hostname
.....
                connect: {
                        server: {
                                options: {
                                        hostname: '0.0.0.0',
                                        port: 9100,
                                        base: '.',
                                        keepalive: true
                                }
                        }
                }
......

[root@localhost elasticsearch-head]# vim _site/app.js 
#搜索 9200 ,把连接地址修改为你的ip(如果elasticsearch是本机可以不用改)
......
init: function(parent) {
                        this._super();
                        this.prefs = services.Preferences.instance();
                        this.base_uri = this.config.base_uri || this.prefs.get("app-base_uri") || "http://192.168.16.202:9200";
                        if( this.base_uri.charAt( this.base_uri.length - 1 ) !== "/" ) {
                                // XHR request fails if the URL is not ending with a "/"
                                this.base_uri += "/";
                        }
......

#启动插件
[root@localhost elasticsearch-head]# grunt server &
[1] 27138
[root@localhost elasticsearch-head]# Running "connect:server" (connect) task
Waiting forever...
Started connect web server on http://localhost:9100

切换elk用户，修改elasticsearch配置文件

vim /elk/elasticsearch/config/elasticsearch.yml
#添加2行
http.cors.enabled: true
http.cors.allow-origin: "*"

#重启elasticsearch
[elk@localhost config]$ pkill java
[elk@localhost config]$ /elk/elasticsearch/bin/elasticsearch -d

访问head插件地址 http://192.168.16.202:9100