下载安装就不说了，自行参考官网，很简单。
首先需要JAVA环境，安装JDK，然后安装 Maven
rpm -Uvh jdk-8u74-linux-x64.rpm
[root@k4274v /home/elk]# java -version
java version "1.8.0_74"
Java(TM) SE Runtime Environment (build 1.8.0_74-b02)
Java HotSpot(TM) 64-Bit Server VM (build 25.74-b02, mixed mode)
目录结构：/usr/local/elk
├── apache-maven-3.3.9 //安装分词插件要用到
├── elasticsearch-2.3.5
└── kibana-4.5.4-linux-x64
配置文件：elasticsearch.yml
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please see the documentation for further information on configuration options:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration.html>
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: mycluster
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: bjcc-${HOSTNAME} //bjcc机房-主机名
#
# Add custom attributes to the node:
#
# node.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
# path.data: /path/to/data
#
# Path to log files:
#
# path.logs: /path/to/logs
#
# snapshot repo
path.repo: ["/usr/local/elk/snapshot"] //快照存储路径
#
# Make sure that the `ES_HEAP_SIZE` environment variable is set to about half the memory
# available on the system and that the owner of the process is allowed to use this limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 10.20.20.202 //服务器的IP地址，通过ifconfig查看
#
# Set a custom port for HTTP:
#
http.port: 9200
#
# For more information, see the documentation at:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html>
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.zen.ping.unicast.hosts: ["10.20.20.201", "10.20.20.203", "10.20.20.204"] //配置集群的IP地址
#
# Prevent the "split brain" by configuring the majority of nodes (total number of nodes / 2 + 1):
#
# discovery.zen.minimum_master_nodes: 3
#
# For more information, see the documentation at:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-discovery.html>
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
# gateway.recover_after_nodes: 3
#
# For more information, see the documentation at:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-gateway.html>
#
# ---------------------------------- Various -----------------------------------
#
# Disable starting multiple nodes on a single system:
#
node.max_local_storage_nodes: 1
#
# Require explicit names when deleting indices:
#
# action.destructive_requires_name: true
# 关闭自动创建索引，开启自动创建mapping
action.auto_create_index: false
index.mapper.dynamic: true
注意：ElasticSearch的配置文件，必须以一个空格开头，不然就报错，挺弱智的！
启动脚本：/etc/init.d/elasticsearch
官方提供的安全重启集群节点的方法
第一步：先暂停集群的shard自动均衡
curl -s -XPUT http://$SERVER_IP:9200/_cluster/settings -d '{"transient" : {"cluster.routing.allocation.enable" : "none"}}' > /dev/null
第二步：kill要升级的节点
第三步：恢复集群的shard自动均衡
curl -s -XPUT http://$SERVER_IP:9200/_cluster/settings -d '{"transient" : {"cluster.routing.allocation.enable" : "all"}}' > /dev/null
#!/bin/bash
#chkconfig: 2345 55 24
#description: elasticsearch service manager
BASE='/usr/local/elk/elasticsearch-2.3.5'
KIBBIN=$BASE'/bin/kibana'
LOCK=$BASE'/elasticsearch.lock'
SERVER_IP=`/sbin/ifconfig eth0|sed -n 2p|awk '{ print $2 }'|awk -F : '{ print $2 }'`
START() {
if [ -f $LOCK ];then
echo -e "elasticsearch is already \033[32mrunning\033[0m, do nothing."
else
echo -e "Starting elasticsearch service..."
cd $BASE/bin
./elasticsearch -d
touch $LOCK
sleep 10 #wait es to start
curl -s -XPUT http://$SERVER_IP:9200/_cluster/settings -d '{"transient" : {"cluster.routing.allocation.enable" : "all"}}' > /dev/null
echo -e "\n\033[32mdone\033[m"
fi
}
STOP() {
if [ ! -f $LOCK ];then
echo -e "elasticsearch is already stop, do nothing."
else
echo -e "Stop elasticsearch serivce"
rm -rf $LOCK
curl -s -XPUT http://$SERVER_IP:9200/_cluster/settings -d '{"transient" : {"cluster.routing.allocation.enable" : "none"}}' > /dev/null
ps -ef | grep elasticsearch | grep -v "grep" | awk '{print $2}' | xargs kill -s 9 >/dev/null
echo -e "\033[32mdone\033[m"
fi
}
STATUS() {
Port=$(netstat -tunl | grep ":9200")
if [ "$Port" != "" ] && [ -f $LOCK ];then
echo -e "elasticsearch is: \033[32mrunning\033[0m..."
else
echo -e "elasticsearch is: \033[31mstopped\033[0m..."
fi
}
case "$1" in
start)
START
;;
stop)
STOP
;;
status)
STATUS
;;
restart)
STOP
sleep 2
START
;;
*)
echo "Usage: /etc/init.d/elasticsearch (|start|stop|status|restart)"
;;
esac
启动服务：
chmod +x /etc/init.d/elasticsearch
chkconfig elasticsearch
service elasticsearch start
安装插件
./bin/plugin install mobz/elasticsearch-head //head插件
git clone https://github.com/medcl/elasticsearch-analysis-ik.git --depth=1 //IK分词插件
./bin/plugin install lmenezes/elasticsearch-kopf/{branch|version}
配置Nginx
upstream es_cluster {
server 10.20.20.201:9200;
server 10.20.20.202:9200;
server 10.20.20.203:9200;
server 10.20.20.204:9200;
keepalive 15;
}
upstream kibana4 {
server 10.20.20.201:5601 fail_timeout=0;
}
server {
listen 8360;
server_name es.xxx.com;
access_log /data/nginx/logs/es.log;
error_log /data/nginx/logs/es.error.log;
location ~ (/app/kibana|/bundles/|/kibana4|/status|/plugins|/api/status/|/elasticsearch|/app/sense) {
proxy_pass http://kibana4;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header Connection "Keep-Alive";
proxy_set_header Proxy-Connection "Keep-Alive";
rewrite /kibana4/(.*)$ /$1 break;
}
location / {
proxy_pass http://es_cluster;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
}
}
