ELK日志分析系统之elasticsearch7.x最新版安装与配置

1、Elasticsearch

1.1、elasticsearch的简介

ElasticSearch是一个基于Lucene的搜索服务器。它提供了一个分布式多用户能力的全文搜索引擎，基于RESTful web接口。Elasticsearch是用Java开发的，并作为Apache许可条款下的开放源码发布，是第二流行的企业搜索引擎。设计用于云计算中，能够达到实时搜索，稳定，可靠，快速，安装使用方便。

1.2、下载地址：https://www.elastic.co/cn/downloads/elasticsearch，到此网页上下开elasticsearch安装包。

1.3、将下载的.tar包解压到目录/application下。创建软链接es文件。详情如下图所示：

1.4、关于JDK，此安装包里包含有JDK，不用再系统上重新安装其他的版本的JDK。

1.5、将此JDK放到系统变量文件/etc/profile中，在文件最后插入如下配置，详情如下：

#set java environment

export JAVA_HOME=/application/es/jdk

export JRE_HOME=${JAVA_HOME}/jre

export CLASSPATH=.:${JAVA_HOME}/lib/dt.JAVA_HOME/lib/tools.jar:${JRE_HOME}/lib

export PATH=${JAVA_HOME}/bin:${PATH}

1.6、使用source命令，使配置生效

source /etc/profile

1.7、配置elasticsearch的配置文件

[root@harlan_ansible ~]# vim /application/es/config/elasticsearch.yml 

# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: my-harlan   #配置集群的名称
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: harlan_ansible     #本节点的名称，此主机的名称
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /application/es/to/data      #日志存放地址
#
# Path to log files:
#
path.logs: /application/es/to/logs      #elasticsearch的本地日志
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 0.0.0.0               #任意IP都可以访问elasticsearch
#
# Set a custom port for HTTP:
#
http.port: 9200                  #elasticsearch的访问端口
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["harlan_ansible"]      #开启集群的节点
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes:
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
http.cors.enabled: true                  #下面这两个，是为了通过外网的浏览器访问
http.cors.allow-origin: "*"

1.8、通过上述配置后，还需要配置启动elasticsearch服务的用户和权限。因为elasticsearch的服务不能使用root用户进行启动。所以需要创建es帐号，并且更改/application/es的所属用户和组。

1.8.1 创建用户es

useradd es

1.8.2 更改/application/es的所属用户和组

chown -R es.es /application/es
chown -R es.es /application/elasticsearch-7.3.

1.9、切换到es帐户，启动elasticsearch服务

[es@harlan_ansible]$ su es

[es@harlan_ansible root]$ /application/es/bin/elasticsearch -d

1.10、查看服务是否已启动

1.11、由上图可知，elasticsearch服务已经启动。

测试：通过浏览器进行访问

1.12、由图可知，elasticsearch已经安装成功。