環(huán)境

[10:18:27 root@elk-01 ~ $]cat /etc/centos-release
CentOS Linux release 7.6.1810 (Core)

elasticsearch-7.1.1-x86_64.rpm

要點(diǎn)

搜索性能取決于最慢的節(jié)點(diǎn)的響應(yīng)時(shí)間

環(huán)境規(guī)劃

節(jié)點(diǎn)1：Elasticsearch + kafka     192.168.50.14   負(fù)責(zé)存儲(chǔ)數(shù)據(jù)、可參與 Master 訊據(jù)
節(jié)點(diǎn)2：Elasticsearch + kafka     192.168.50.15   負(fù)責(zé)存儲(chǔ)數(shù)據(jù)、可參與 Master 訊據(jù)
節(jié)點(diǎn)3：Elasticsearch + kafka     192.168.50.16   負(fù)責(zé)存儲(chǔ)數(shù)據(jù)、可參與 Master 訊據(jù)
節(jié)點(diǎn)4：Elasticsearch協(xié)調(diào)節(jié)點(diǎn) + Kibana   192.168.50.17   充當(dāng) ES 集群智能負(fù)載均衡器 + Kibana前端展示用頁面使用

第一步：系統(tǒng)優(yōu)化設(shè)置

1.告訴操作系統(tǒng)可以無限制分配內(nèi)存給一個(gè)進(jìn)程

echo '* soft memlock unlimited' >>/etc/security/limits.conf
echo '* hard memlock unlimited' >>/etc/security/limits.conf
cat /etc/security/limits.conf

2.禁用SWAP

## 完全禁用SWAP
## swapoff -a
## 盡量避免使用SWAP
echo 'vm.swappiness = 1' >> /etc/sysctl.conf

3. 修改最大打開文件描述符

echo '* soft nofile 65535' >> /etc/security/limits.conf
echo '* hard nofile 65535' >> /etc/security/limits.conf
cat /etc/security/limits.conf
ulimit -n 65535

4.重啟生效

init 6

第二步：安裝和配置Elasticsearch

下載地址：https://www.elastic.co/cn/downloads/elasticsearch

幫助文檔：https://www.elastic.co/cn/webinars/getting-started-elasticsearch?elektra=startpage

1.下載并安裝

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.1.1-x86_64.rpm
rpm -ivh elasticsearch-7.1.1-x86_64.rpm

2.修改配置文件以支持集群

1.注意修改network.host為各節(jié)點(diǎn)IP地址

2.注意修改discovery.zen.ping.unicast.hosts列表

cp /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/elasticsearch.yml.bak
cat <<EOF >>/etc/elasticsearch/elasticsearch.yml
## 集群名稱
cluster.name: ELK-Cluster

## 節(jié)點(diǎn)名稱（每個(gè)節(jié)點(diǎn)名稱不能相同）
node.name: elk-01

## 允許 JVM 鎖住內(nèi)存，禁止操作系統(tǒng)交換出去
# bootstrap.memory_lock: true

## 是否有資格成為主節(jié)點(diǎn)
## 通過 node.master 可以配置該節(jié)點(diǎn)是否有資格成為主節(jié)點(diǎn)，如果配置為 true，則主機(jī)有資格成為主節(jié)點(diǎn)
## 注意這里是有資格成為主節(jié)點(diǎn)，不是一定會(huì)成為主節(jié)點(diǎn)
node.master: true

## 是否是數(shù)據(jù)節(jié)點(diǎn)
## 當(dāng) node.master 和 node.data 均為 false，則該主機(jī)會(huì)作為負(fù)載均衡節(jié)點(diǎn)
node.data: true

## 設(shè)置訪問的地址和端口
network.host: 192.168.50.14
http.port: 9200

## 集群地址設(shè)置
## 配置之后集群的主機(jī)之間可以自動(dòng)發(fā)現(xiàn)
# discovery.zen.ping.unicast.hosts: ["192.168.50.14", "192.168.50.15", "192.168.50.16"]
discovery.seed_hosts: ["192.168.50.14", "192.168.50.15", "192.168.50.16"]
cluster.initial_master_nodes: ["192.168.50.14", "192.168.50.15", "192.168.50.16"] 

## 配置大多數(shù)節(jié)點(diǎn)（通常為主節(jié)點(diǎn)的節(jié)點(diǎn)總數(shù)/ 2 + 1）來防止“裂腦”：
discovery.zen.minimum_master_nodes: 2

## 在完全集群重啟后阻止初始恢復(fù)，直到啟動(dòng)N個(gè)節(jié)點(diǎn)
gateway.recover_after_nodes: 2
EOF
vim /etc/elasticsearch/elasticsearch.yml

3.為elasticsearch設(shè)置jdk路徑，否則啟動(dòng)時(shí)候會(huì)報(bào)錯(cuò)

請(qǐng)根據(jù)自己實(shí)際路徑進(jìn)行修改

cp /etc/sysconfig/elasticsearch /etc/sysconfig/elasticsearch.bak
cat <<EOF >>/etc/sysconfig/elasticsearch
JAVA_HOME=/home/jdk1.8.0_202
EOF

4.設(shè)置堆內(nèi)存（根據(jù)物理內(nèi)存情況設(shè)置）

http://openskill.cn/article/304
https://www.elastic.co/guide/en/elasticsearch/guide/current/heap-sizing.html
https://www.elastic.co/guide/cn/elasticsearch/guide/current/_limiting_memory_usage.html
https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html

## 編輯以下值
## 內(nèi)存設(shè)置為物理內(nèi)存的50%，并且不要超過32G
## 確保這兩個(gè)值相等，防止程序在運(yùn)行時(shí)改變堆內(nèi)存大小， 這是一個(gè)很耗系統(tǒng)資源的過程
cp /etc/elasticsearch/jvm.options /etc/elasticsearch/jvm.options.bak
vim /etc/elasticsearch/jvm.options

-Xms2g
-Xmx2g

5.啟動(dòng)服務(wù)

systemctl daemon-reload
systemctl enable elasticsearch.service
systemctl stop elasticsearch.service
systemctl start elasticsearch.service
systemctl status elasticsearch.service

6.驗(yàn)證

## 查看單節(jié)點(diǎn)狀態(tài)
curl -X GET "192.168.50.14:9200/"
curl -X GET "192.168.50.15:9200/"
curl -X GET "192.168.50.16:9200/"

## 查看集群內(nèi)節(jié)點(diǎn)分布
curl -XGET 'http://192.168.50.14:9200/_cat/nodes?pretty'
curl -XGET 'http://192.168.50.15:9200/_cat/nodes?pretty'
curl -XGET 'http://192.168.50.16:9200/_cat/nodes?pretty'

## 檢測(cè)集群健康狀態(tài)
curl 192.168.50.14:9200/_cat/health?v
curl 192.168.50.15:9200/_cat/health?v
curl 192.168.50.16:9200/_cat/health?v

## 查看所有支持的 _cat 命令
curl -XGET 'http://192.168.50.14:9200/_cat?pretty'
curl -XGET 'http://192.168.50.15:9200/_cat?pretty'
curl -XGET 'http://192.168.50.16:9200/_cat?pretty'

    _cat代表查看信息
    nodes為查看節(jié)點(diǎn)信息，默認(rèn)會(huì)顯示為一行，所以就用刀了?preety讓信息更有好的顯示
    ?preety讓輸出信息更友好的顯示

第三步：安裝中文分詞器 elasticsearch-analysis-ik

https://github.com/medcl/elasticsearch-analysis-ik

1.創(chuàng)建目錄

mkdir /usr/share/elasticsearch/plugins/ik

2.下載并解壓

cd /usr/share/elasticsearch/plugins/ik
wget https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.1.1/elasticsearch-analysis-ik-7.1.1.zip
unzip elasticsearch-analysis-ik-7.1.1.zip

3.重啟 Elasticsearch

systemctl stop elasticsearch.service
systemctl start elasticsearch.service
systemctl status elasticsearch.service

4.驗(yàn)證

## 1.登錄 Kibana 
## 2.Dev Tools - Console

    GET _analyze?pretty
    {
      "analyzer": "ik_smart",
      "text":"安徽省長江流域"
    }

    GET _analyze?pretty
    {
      "analyzer": "ik_max_word",
      "text":"安徽省長江流域"
    }

第四步：常用命令

## 查詢所有索引的分片和副本信息
GET _settings?pretty