ELK环境搭建-Elasticsearch

0.前置条件

0.1 安装jdk8

下载安装包

wget https://mirrors.tuna.tsinghua.edu.cn/Adoptium/8/jdk/x64/linux/OpenJDK8U-jdk_x64_linux_hotspot_8u422b05.tar.gz

解压并移动到目标路径

tar xzvf OpenJDK8U-jdk_x64_linux_hotspot_8u422b05.tar.gz
mv jdk8u422-b05 jdk8
mv jdk8 /software/

配置环境变量

 vim ~/.bashrc

export JAVA_HOME=/software/jdk8
export PATH=$PATH:$JAVA_HOME/bin

 source ~/.bashrc

验证

[root@localhost ~]# java -version

1.源码部署[单节点]

1.1下载源码包并解压

下载地址：https://www.elastic.co/cn/downloads/elasticsearch

https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.14.3-linux-x86_64.tar.gz
tar xzvf elasticsearch-8.14.3-linux-x86_64.tar.gz
mv elasticsearch-8.14.3 /software/
cd /software/elasticsearch-8.14.3/

1.2 修改配置文件

cd config/
vim elasticsearch.yml

修改数据和日志目录(这里可以不用修改，如果不修改，默认放在elasticsearch根目录下)

# 数据目录位置
path.data: /xxxx/elasticsearch/data 
# 日志目录位置
path.logs: /xxxx/elasticsearch/logs

修改绑定的ip允许远程访问

#默认只允许本机访问，修改为0.0.0.0后则可以远程访问
# 绑定到0.0.0.0，允许任何ip来访问
network.host: 0.0.0.0

初始化节点名称

cluster.name: es 
node.name: es-node1
cluster.initial_master_nodes: ["es-node1"]

1.3 启动测试

cd bin
[root@localhost bin]# ./elasticsearch
warning: ignoring JAVA_HOME=/software/jdk8; using bundled JDK
Jul 28, 2024 12:07:26 AM sun.util.locale.provider.LocaleProviderAdapter <clinit>
WARNING: COMPAT locale provider will be removed in a future release
[2024-07-28T00:07:26,940][INFO ][o.e.n.NativeAccess       ] [localhost.localdomain] Using [jdk] native provider and native methods for [Linux]
[2024-07-28T00:07:26,953][ERROR][o.e.b.Elasticsearch      ] [localhost.localdomain] fatal exception while booting Elasticsearchjava.lang.RuntimeException: can not run elasticsearch as root
        at org.elasticsearch.server@8.14.3/org.elasticsearch.bootstrap.Elasticsearch.initializeNatives(Elasticsearch.java:286)
        at org.elasticsearch.server@8.14.3/org.elasticsearch.bootstrap.Elasticsearch.initPhase2(Elasticsearch.java:169)
        at org.elasticsearch.server@8.14.3/org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:74)

See logs for more details.

ERROR: Elasticsearch did not exit normally - check the logs at /software/elasticsearch-8.14.3/logs/elasticsearch.log

ERROR: Elasticsearch died while starting up, with exit code 1

出现症状 :无法已root用户启动，解决办法创建用户并进行目录授权

# 创建用户
useradd es
# 目录授权
chown es:es -R /software/elasticsearch-8.14.3/
# 切换用户
su es

再次启动

# 再次启动
cd /software/elasticsearch-8.14.3/bin/
./elasticsearch

再次启动报错

[2024-07-28T02:28:31,731][ERROR][o.e.b.Elasticsearch      ] [es-node1] node validation exception
[2] bootstrap checks failed. You must address the points described in the following [2] lines before starting Elasticsearch. For more information see [https://www.elastic.co/guide/en/elasticsearch/reference/8.14/bootstrap-checks.html]
bootstrap check failure [1] of [2]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]; for more information see [https://www.elastic.co/guide/en/elasticsearch/reference/8.14/_file_descriptor_check.html]
bootstrap check failure [2] of [2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]; for more information see [https://www.elastic.co/guide/en/elasticsearch/reference/8.14/_maximum_map_count_check.html]
ERROR: Elasticsearch did not exit normally - check the logs at /software/elasticsearch-8.14.3/logs/es.log
[2024-07-28T02:28:31,735][INFO ][o.e.n.Node               ] [es-node1] stopping ...
[2024-07-28T02:28:31,749][INFO ][o.e.n.Node               ] [es-node1] stopped
[2024-07-28T02:28:31,750][INFO ][o.e.n.Node               ] [es-node1] closing ...
[2024-07-28T02:28:31,756][INFO ][o.e.n.Node               ] [es-node1] closed
[2024-07-28T02:28:31,758][INFO ][o.e.x.m.p.NativeController] [es-node1] Native controller process has stopped - no new native processes can be started

ERROR: Elasticsearch died while starting up, with exit code 78

针对max file descriptors [4096] for elasticsearch process is too low

# 在root用户下追加配置
vim /etc/security/limits.conf 
# 配置内容   *表示所有用户生效
* soft nofile 65536
* hard nofile 65536
# 重启生效
reboot
# 可使用命令查看是否生效
ulimit  -H -n

针对ax virtual memory areas vm.max_map_count [65530] is too low

# 在root用户下追加配置
vim /etc/sysctl.conf
# 配置内容 
vm.max_map_count=262144
# 重启生效
reboot 
# 可使用命令查看是否生效
sysctl -p

再次重启

# 再次启动
cd /software/elasticsearch-8.14.3/bin/
./elasticsearch

访问http://192.168.124.16:9200/测试，页面无法加载，后台日志出现报错

[2024-07-28T02:51:56,319][WARN ][o.e.h.n.Netty4HttpServerTransport] [es-node1] received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/192.168.124.16:9200, remoteAddress=/192.168.124.16:40472}
[2024-07-28T02:52:05,731][WARN ][o.e.x.c.s.t.n.SecurityNetty4Transport] [es-node1] received plaintext traffic on an encrypted channel, closing connection Netty4TcpChannel{localAddress=/192.168.124.16:9300, remoteAddress=/192.168.124.16:57560, profile=default}
^[[B^[[B^[[B[2024-07-28T03:03:25,366][WARN ][o.e.h.n.Netty4HttpServerTransport] [es-node1] received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/192.168.124.16:9200, remoteAddress=/192.168.124.16:40476}

原因：是因为ES8默认开启了 SSL 认证,解决办法

1、使用 https 发送请求,需要完成https证书配置等，暂时跳过

2、修改elasticsearch.yml配置文件将xpack.security.enabled设置为false[生产环境下不建议这么使用]

cd /software/elasticsearch-8.14.3/conf/
vim elasticsearch.yml

xpack.security.enabled: false

再次重启访问访问http://192.168.124.16:9200/测试(注意:请确认端口9200防火墙开放！)

{
    "name": "es-node1",
    "cluster_name": "es",
    "cluster_uuid": "P_mYyZhLTy2CNOFOxmwItw",
    "version": {
        "number": "8.14.3",
        "build_flavor": "default",
        "build_type": "tar",
        "build_hash": "d55f984299e0e88dee72ebd8255f7ff130859ad0",
        "build_date": "2024-07-07T22:04:49.882652950Z",
        "build_snapshot": false,
        "lucene_version": "9.10.0",
        "minimum_wire_compatibility_version": "7.17.0",
        "minimum_index_compatibility_version": "7.0.0"
    },
    "tagline": "You Know, for Search"
}

参考资料

ELK介绍、Elasticsearch单节点部署、Elasticsearch集群部署_systemctl 管理elsearch-CSDN博客
[ES错误：max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]-CSDN博客](https://blog.csdn.net/weixin_43950568/article/details/122459088)
[vm.max_map_count [65530] is too low 问题解决（Windows 10、WSL 2、Docker Desktop）_容器化vm.max map count [65530] istoo low-CSDN博客](https://blog.csdn.net/Pointer_v/article/details/112395425)
ELasticsearch基本使用——基础篇_elasticsearch使用-CSDN博客
Elasticsearch 8.0报错：received plaintext http traffic on an https channel, closing connection_closing connection -1-CSDN博客
ES 8.x 系列教程：ES 8.0 服务安装（可能是最详细的ES 8教程）-阿里云开发者社区 (aliyun.com)
【ES三周年】吊打ElasticSearch和Kibana（入门保姆级教程-2）-腾讯云开发者社区-腾讯云 (tencent.com)

ELK环境搭建-Elasticsearch

0.前置条件

1.源码部署[单节点]

1.1下载源码包并解压

1.2 修改配置文件

1.3 启动测试

参考资料

评论 (0)