ELK-elasticsearch-6.3.2部署

时间:2022-07-26
本文章向大家介绍ELK-elasticsearch-6.3.2部署，主要内容包括其使用实例、应用技巧、基本知识点总结和需要注意事项，具有一定的参考价值，需要的朋友可以参考一下。

参考博客：linux下ElasticSearch.6.2.2集群安装与head、Kibana、X-Pack..插件的配置安装

参考博客：ELK5.5.1 插件安装实践纪要（head/bigdesk/kopf/cerebo/中文分词插件）

参考博客：ELK构建MySQL慢日志收集平台详解

参考博客：针对Logstash吞吐量一次优化

参考博客：ElasticStack系列之十八 & ElasticSearch5.x XPack 过期新 License 更新

1. 主机规划

主机名称

IP信息

内网IP

操作系统

安装软件

备注：运行程序

mini01

10.0.0.11

172.16.1.11

CentOS 7.4 2G内存

jdk、elasticsearch、kibana

插件head、bigdesk、cerebro

mini02

10.0.0.12

172.16.1.12

CentOS 7.4 4G内存

jdk、elasticsearch、logstash

mini03

10.0.0.13

172.16.1.13

CentOS 7.4 4G内存

jdk、elasticsearch、logstash

mini04

10.0.0.14

172.16.1.14

CentOS 7.4

jdk、logstash

添加hosts信息，保证每台都可以相互ping通

1 [root@mini01 ~]# cat /etc/hosts  
2 127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
3 ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
4 
5 10.0.0.11    mini01
6 10.0.0.12    mini02
7 10.0.0.13    mini03
8 10.0.0.14    mini04
9 10.0.0.15    mini05

windows的hosts文件也追加如下信息

1 c:windowssystem32driversetc
2 ########################################## 追加信息如下：
3 10.0.0.11    mini01
4 10.0.0.12    mini02
5 10.0.0.13    mini03
6 10.0.0.14    mini04
7 10.0.0.15    mini05

2. 添加用户账号

1 # 使用一个专门的用户，避免直接使用root用户
2 # 添加用户、指定家目录并指定用户密码
3 useradd -d /app yun && echo '123456' | /usr/bin/passwd --stdin yun
4 # sudo提权
5 echo "yun  ALL=(ALL)       NOPASSWD: ALL" >>  /etc/sudoers
6 # 让其它普通用户可以进入该目录查看信息
7 chmod 755 /app/

3. Jdk【java8】

3.1. 软件安装

 1 [yun@mini01 software]# pwd
 2 /app/software
 3 [yun@mini01 software]# tar xf jdk1.8.0_112.tar.gz 
 4 [yun@mini01 software]# ll
 5 total 201392
 6 drwxr-xr-x 8   10  143      4096 Dec 20 13:27 jdk1.8.0_112
 7 -rw-r--r-- 1 root root 189815615 Mar 12 16:47 jdk1.8.0_112.tar.gz
 8 [yun@mini01 software]# mv jdk1.8.0_112/ /app/
 9 [yun@mini01 software]# cd /app/
10 [yun@mini01 app]# ll
11 total 8
12 drwxr-xr-x  8   10   143 4096 Dec 20 13:27 jdk1.8.0_112
13 [yun@mini01 app]# ln -s jdk1.8.0_112/ jdk
14 [yun@mini01 app]# ll
15 total 8
16 lrwxrwxrwx  1 root root    13 May 16 23:19 jdk -> jdk1.8.0_112/
17 drwxr-xr-x  8   10   143 4096 Dec 20 13:27 jdk1.8.0_112

3.2. 环境变量

 1 [root@mini01 ~]$ pwd
 2 /app
 3 [root@mini01 ~]$ ll -d jdk*  # 选择jdk1.8  
 4 lrwxrwxrwx 1 yun yun   11 Mar 15 14:58 jdk -> jdk1.8.0_112
 5 drwxr-xr-x 8 yun yun 4096 Dec 20 13:27 jdk1.8.0_112
 6 [root@mini01 profile.d]$ pwd
 7 /etc/profile.d
 8 [root@mini01 profile.d]$ cat jdk.sh # java环境变量   
 9 export JAVA_HOME=/app/jdk
10 export JRE_HOME=/app/jdk/jre
11 export CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar:$JRE_HOME/lib:$CLASSPATH
12 export PATH=$JAVA_HOME/bin:$PATH
13 
14 [root@mini01 profile.d]# source /etc/profile
15 [root@mini01 profile.d]$ java -version  
16 java version "1.8.0_112"
17 Java(TM) SE Runtime Environment (build 1.8.0_112-b15)
18 Java HotSpot(TM) 64-Bit Server VM (build 25.112-b15, mixed mode)

4. elasticsearch部署

4.1. 软件部署

1 [yun@mini01 software]$ pwd
2 /app/software
3 [yun@mini01 software]$ tar xf elasticsearch-6.3.2.tar.gz 
4 [yun@mini01 software]$ mv elasticsearch-6.3.2 /app/
5 [yun@mini01 software]$ cd /app/
6 [yun@mini01 ~]$ ln -s elasticsearch-6.3.2/ elasticsearch

4.2. 环境变量

所有安装es的机器都要有该配置

1 [root@mini01 profile.d]# pwd
2 /etc/profile.d
3 [root@mini01 profile.d]# cat es.sh 
4 export ES_HOME="/app/elasticsearch"
5 export PATH=$ES_HOME/bin:$PATH
6 
7 [root@mini01 profile.d]# logout
8 [yun@mini01 es-data]$ source /etc/profile  # 重加在环境变量

4.3. 配置修改

由于node.name使用了变量，所以所有集群的该配置都可以一样

 1 [yun@mini01 config]$ pwd
 2 /app/elasticsearch/config
 3 [yun@mini01 config]$ vim elasticsearch.yml
 4 ………………
 5 # ---------------------------------- Cluster -----------------------------------
 6 #
 7 # Use a descriptive name for your cluster:
 8 #
 9 #cluster.name: my-application
10 # 集群名称
11 cluster.name: zhang-es
12 #
13 # ------------------------------------ Node ------------------------------------
14 #
15 # Use a descriptive name for the node:
16 #
17 #node.name: node-1
18 # 节点名称
19 node.name: ${HOSTNAME}
20 
21 #
22 # Add custom attributes to the node:
23 ………………
24 # Path to directory where to store the data (separate multiple locations by comma):
25 #
26 #path.data: /path/to/data
27 # 该目录需要创建
28 path.data: /app/es-data
29 
30 #
31 # Path to log files:
32 #
33 #path.logs: /path/to/logs
34 # 该目录需要创建
35 path.logs: /app/es-data/logs
36 ………………
37 # Lock the memory on startup:
38 #
39 # 锁定内存
40 bootstrap.memory_lock: true
41 #
42 ………………
43 # Set the bind address to a specific IP (IPv4 or IPv6):
44 #
45 #network.host: 192.168.0.1
46 # 绑定
47 network.host: 0.0.0.0
48 
49 #
50 # Set a custom port for HTTP:
51 #
52 http.port: 9200
53 #
54 ………………
55 # Elasticsearch performs poorly when the system is swapping the memory.
56 #
57 #discovery.zen.ping.unicast.hosts: ["host1", "host2"]
58 # 集群节点ip或者主机
59 discovery.zen.ping.unicast.hosts: ["mini01", "mini02", "mini03"]
60 
61 #
62 # Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1):
63 #
64 # 防止脑裂配置，注意在多master时，这个值应该等于 Math.floor(master候选节点数/2)+1
65 # 意思是master候选节点的数目最少达到多少个，才去选举master
66 # 没有这个配置,在多master时容易造成脑裂,出现多个集群
67 # 这里只有一个master就设置成1即可  【默认为1】
68 #discovery.zen.minimum_master_nodes: 
69 ………………
70 #action.destructive_requires_name: true
71 
72 # 下面两行配置为haad和bigdesk插件配置，各服务器一致
73 http.cors.enabled: true
74 http.cors.allow-origin: "*"

4.4. 启动es程序

 1 # -d 后台运行   -p 指定pid文件
 2 [yun@mini01 ~]$ elasticsearch -d -p /app/elasticsearch/es.pid  # 添加了环境变量，所以可以在任何地方启动程序 
 3 [yun@mini01 ~]$ cat elasticsearch/es.pid 
 4 2637
 5 [yun@mini01 ~]$ netstat -lntup | grep '9200'
 6 (Not all processes could be identified, non-owned process info
 7  will not be shown, you would have to be root to see it all.)
 8 tcp6       0      0 :::9200                 :::*                    LISTEN      2637/java   
 9 [yun@mini01 ~]$ kill -9 2637   # 停止es
10 [yun@mini01 ~]$ ps -ef | grep 'ela'
11 yun        3263   1807  0 20:56 pts/0    00:00:00 grep --color=auto ela

4.5. 浏览器访问

1 http://mini01:9200/    
2 http://mini02:9200/    
3 http://mini03:9200/

4.6. 启动报错与解决

1 # 启动报错如下：
2 [3] bootstrap checks failed
3 [1]: max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536]
4 [2]: memory locking requested for elasticsearch process but memory is not locked
5 [3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

4.6.1. 解决1和2

 1 # 将 soft nofile和hard nofile从 65535 改为 131070，如下：
 2 # 添加soft memlock和hard memlock
 3 [yun@mini01 ~]$ tail /etc/security/limits.conf   # 需要退出重新登录才生效
 4 #*               hard    rss             10000
 5 #@student        hard    nproc           20
 6 #@faculty        soft    nproc           20
 7 #@faculty        hard    nproc           50
 8 #ftp             hard    nproc           0
 9 #@student        -       maxlogins       4
10 
11 # End of file
12 * soft nofile 131070
13 * hard nofile 131070
14 * soft memlock unlimited
15 * hard memlock unlimited

4.6.2. 解决3

1 [root@mini01 ~]# vim /etc/sysctl.conf  # 追加如下信息
2 ………………
3 
4 vm.max_map_count=655360
5 [root@mini01 ~]# sysctl -p  # 生效

5. ES的XPack 过期新 License 更新

当我们直接访问ES的索引，出现如下信息时，表示license已经过期，需要重新更新

其中涉及ES的账号信息------elastic：是可以 build 这个项目的超级用户，对应默认的密码为：changeme

命令行访问

 1 [yun@mini02 ~]$ curl -XGET -u elastic:changeme 'http://mini01:9200/_xpack/license'
 2 {
 3   "license" : {
 4     "status" : "expired",
 5     "uid" : "59bc0e32-685b-48a9-bfdb-ddd373f672ab",
 6     "type" : "trial",
 7     "issue_date" : "2018-06-03T08:56:33.376Z",
 8     "issue_date_in_millis" : 1528016193376,
 9     "expiry_date" : "2018-07-03T08:56:33.376Z",
10     "expiry_date_in_millis" : 1530608193376,
11     "max_nodes" : 1000,
12     "issued_to" : "zhang-es",
13     "issuer" : "elasticsearch",
14     "start_date_in_millis" : -1
15   }
16 }
17 [yun@mini02 ~]$ curl -XGET -u elastic:changeme 'http://mini01:9200/_cat/indices'
18 {"error":{"root_cause":[{"type":"security_exception","reason":"current license is non-compliant for [security]","license.expired.feature":"security"}],"type":"security_exception","reason":"current license is non-compliant for [security]","license.expired.feature":"security"},"status":403}

浏览器访问

1 http://mini01:9200/_cat/indices

获取License 

1 https://register.elastic.co/marvel_register

需要你输入你对应的邮箱等基本信息，随便填写，但是邮箱和国家必须是真实的，将对应新下载的 license 上传到对应集群的某一台服务器上即可，我将我下载的一堆很长名字的 license 修改为简单的名称即：

mv xxxxx-license.json license.json

更新 license

我们更新最新的 license 不需要重启相应的 ElasticSearch 节点，只需要通过一个命令就可以动态的生效

 1 [yun@mini02 ~]$ curl -XPUT -u elastic:changeme 'http://mini01:9200/_xpack/license?acknowledge=true' -H "Content-Type: application/json" -d @license.json 
 2 {"acknowledged":true,"license_status":"valid"}
 3 [yun@mini02 ~]$ curl -XGET -u elastic:changeme 'http://mini01:9200/_xpack/license'
 4 {
 5   "license" : {
 6     "status" : "active",
 7     "uid" : "aad141e1-c24b-453c-92d1-0fdf5ac63540",
 8     "type" : "basic",
 9     "issue_date" : "2018-09-07T00:00:00.000Z",
10     "issue_date_in_millis" : 1536278400000,
11     "expiry_date" : "2019-09-07T23:59:59.999Z",
12     "expiry_date_in_millis" : 1567900799999,
13     "max_nodes" : 100,
14     "issued_to" : "zhang lia (myself)",
15     "issuer" : "Web Form",
16     "start_date_in_millis" : 1536278400000
17   }
18 }

之后就可以正常访问了

1 [yun@mini02 ~]$ curl http://mini01:9200/_cat/indices
2 green open logstash-2018.08.21         MoHGSrCBQgyYrA5PLcHePg 5 1     9 0  74.5kb  37.2kb
3 green open nginx-access-log-2018.08.25 TJRUOCELRPaNBLj_t943Ww 5 1   121 0 652.8kb 321.3kb
4 green open httpd-access-log-2018.08.31 21NENLdBTNu49oIg9bIlnw 5 1   573 0 739.6kb 409.6kb
5 green open index-demo                  cTz0lN39SmSQfOLAM89GRg 5 1     2 0  17.9kb   8.9kb
6 green open system-rsyslog-2018.08      zHmPivsQS72dtkQzVhIFBQ 5 1   154 0 605.9kb 302.9kb
7 ………………

随机文章
本站知识点必读
最近更新