[TOC]

需要准备的安装包：

1）jdk

2）elasticsearch

3）filebeat

4）kibana

5）kafka

6）logstash

安装前的准备：

关闭防火墙、selinux：

systemctl stop firewalld

systemctl disable firewalld

sed -i``'s/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

Linux系统参数优化：

1. /etc/security/limits.conf 添加如下几行：

elasticsearch - nofile 65536

elasticsearch - nproc 65536

2. /etc/sysctl.conf 添加如下几行：

vm.zone_reclaim_mode=0

vm.max_map_count = 262144

vm.swappiness = 1

1. 从ES官网下载最新的elasticsearch tar包：

ES 官网：https://www.elastic.co/downloads/elasticsearch

tar包：https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.6.3.tar.gz

<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.6.3.tar.gz</pre></wiz_code_mirror>

2. 解压tar包：

<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">tar -zxvf elasticsearch-5.6.3.tar.gz</pre></wiz_code_mirror>

**# 3. !!! 注意：如果是用root账号启动，会报以下错误 **

<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">Exception in thread "main" java.lang.RuntimeException: don't run elasticsearch as root. at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:93) at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:144) at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:285) at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35) Refer to the log for complete error details.</pre></wiz_code_mirror>

出于系统安全考虑设置的条件。由于ElasticSearch可以接收用户输入的脚本并且执行，为了系统安全考虑，
建议创建一个单独的用户用来运行ElasticSearch。

（1）创建elsearch用户组及elsearch用户：

<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">groupadd elsearch</pre>

<pre class=" CodeMirror-line " role="presentation">useradd elsearch -g elsearch -p elasticsearch</pre></wiz_code_mirror>

（2）更改elasticsearch文件夹及内部文件的所属用户及组为elsearch:elsearch：

<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">chown -R elsearch:elsearch elasticsearch-5.6.3</pre></wiz_code_mirror>

4. 启动 elsearch 服务：（-d:后台启动）

<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">./bin/elasticsearch -d</pre></wiz_code_mirror>

5. 测试ES是否启动成功：

<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">curl 'http://localhost:9200/?pretty'</pre></wiz_code_mirror>

正确的返回结果：
{
"name" : "ben-es-2",
"cluster_name" : "ben-es",
"cluster_uuid" : "ydRmxXuMSF-ScokWulAq9w",
"version" : {
"number" : "6.6.0",
"build_flavor" : "default",
"build_type" : "tar",
"build_hash" : "a9861f4",
"build_date" : "2019-01-24T11:27:09.439740Z",
"build_snapshot" : false,
"lucene_version" : "7.6.0",
"minimum_wire_compatibility_version" : "5.6.0",
"minimum_index_compatibility_version" : "5.0.0"
},
"tagline" : "You Know, for Search"
}

6. 修改config/elasticsearch.yml配置文件

修改network.host的值：

<meta charset="utf-8">

默认情况下，Elastic 只允许本机访问，如果需要远程访问，可以修改 Elastic 安装目录的config/elasticsearch.yml文件，去掉network.host的注释，将它的值改成0.0.0.0，然后重新启动 Elastic。

network.host: 0.0.0.0

上面代码中，设成0.0.0.0让任何人都可以访问。线上服务不要这样设置，要设成具体的 IP。