CentOS6.5 安装 Elasticsearch5.5 超详

一、Elasticsearch 简介

下面摘自官网

Elasticsearch is a distributed, RESTful search and analytics engine capable of solving a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data so you can discover the expected and uncover the unexpected.
(Elasticsearch是一种分布式，REST风格的搜索和分析引擎，能够解决越来越多的用例。 作为弹性堆栈的核心，它集中存储您的数据，以便您可以发现预期并发现意外。)

二、Elasticsearch 安装

安装前准备

• 安装最新版 JDK ，本人测试环境是JDK 1.8.0_112，官方说 JDK 1.7 + 即可
• 下载 Elasticsearch 最新安装包。

安装Elasticsearch

• 解压安装包

  $ cd /opt/es
  
  $ tar zxvf elasticsearch-5.5.0.tar.gz
  

• 修改 Elasticsearch 相关参数

  vi /opt/es/elasticsearch-5.5.0/config/elasticsearch.yml

  修改如下内容:

  # 集群的名字
  cluster.name: elasticsearch

  # 节点名字
  node.name: node-1

  # 索引分片个数，默认为5片
  index.number_of_shards: 5

  # 索引副本个数，默认为1个副本
  index.number_of_replicas: 1

  # 数据存储目录（多个路径用逗号分隔）
  path.data: /home/ntc/es/data

  # 日志目录
  path.logs: /home/ntc/es/logs

  # 修改一下ES的监听地址，这样别的机器才可以访问
  network.host: 172.16.X.X

  # 设置节点间交互的tcp端口（集群）,默认是9300
  transport.tcp.port: 9300

  # 监听端口（默认的就好）
  http.port: 9200

  # 增加新的参数，这样head插件才可以访问es
  http.cors.enabled: true
  http.cors.allow-origin: "*"

• 启动Elasticsearch

  $ cd elasticsearch-5.5.0
  
  $ ./bin/elasticsearch
  

  此时由于是用root用户启动的，所以会报如下错误。

[2017-07-11T12:10:33,262][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
    at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:127) ~[elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:114) ~[elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:67) ~[elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122) ~[elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.cli.Command.main(Command.java:88) ~[elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:91) ~[elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:84) ~[elasticsearch-5.5.0.jar:5.5.0]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
    at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:106) ~[elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:194) ~[elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:351) ~[elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:123) ~[elasticsearch-5.5.0.jar:5.5.0]
    ... 6 more

解决方案有两种：

1. 直接修改Elasticsearch配置，支持用root启动。

   因为未验证，后续补充
   

2. 出于系统安全考虑，建议新建单独的用户运行 Elasticsearch。

   (1) 创建用户组和用户

   $ groupadd esgroup
   $ useradd es -g esgroup
   

   (2) 修改 Elasticsearch 文件夹及内部所有文件的所属用户组和用户（注意用户和用户组的顺序）。

   $ chown -R es:esgroup /opt/es/elasticsearch-5.5.0
   

   (3) 切换到es用户，并启动Elasticsearch

   $ su - es
   [es@localhost ~]$ cd /opt/es/elasticsearch-5.5.0
   [es@localhost elasticsearch-5.5.0]$ ./bin/elasticsearch
   

   (4) 启动后，输出如下信息，启动成功

   [2017-07-11T12:48:13,611][INFO ][o.e.n.Node               ] initialized
   [2017-07-11T12:48:13,611][INFO ][o.e.n.Node               ] [zzZc25X] starting ...
   [2017-07-11T12:48:13,878][INFO ][o.e.t.TransportService   ] [zzZc25X] publish_address {127.0.0.1:9300}, bound_addresses {[::1]:9300}, {127.0.0.1:9300}
   [2017-07-11T12:48:13,898][WARN ][o.e.b.BootstrapChecks    ] [zzZc25X] max number of threads [1024] for user [es] is too low, increase to at least [2048]
   [2017-07-11T12:48:13,899][WARN ][o.e.b.BootstrapChecks    ] [zzZc25X] max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
   [2017-07-11T12:48:13,899][WARN ][o.e.b.BootstrapChecks    ] [zzZc25X] system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
   [2017-07-11T12:48:17,005][INFO ][o.e.c.s.ClusterService   ] [zzZc25X] new_master {zzZc25X}{zzZc25XOTdacyXbQyrqhMw}{ajlhWEWxTZyitnVUy-OFHQ}{127.0.0.1}{127.0.0.1:9300}, reason: zen-disco-elected-as-master ([0] nodes joined)
   [2017-07-11T12:48:17,056][INFO ][o.e.h.n.Netty4HttpServerTransport] [zzZc25X] publish_address {127.0.0.1:9200}, bound_addresses {[::1]:9200}, {127.0.0.1:9200}
   [2017-07-11T12:48:17,058][INFO ][o.e.n.Node               ] [zzZc25X] started
   [2017-07-11T12:48:17,321][INFO ][o.e.g.GatewayService     ] [zzZc25X] recovered [0] indices into cluster_state
   

三、验证 Elasticsearch 启动状态

• 浏览器直接访问地址查看状态

  输入地址：

  http://172.16.X.X:9200/
  

  输出结果：

  {
    "name" : "zzZc25X",
    "cluster_name" : "elasticsearch",
    "cluster_uuid" : "m52p74pBSIeX-Le50BM_qQ",
    "version" : {
      "number" : "5.5.0",
      "build_hash" : "260387d",
      "build_date" : "2017-06-30T23:16:05.735Z",
      "build_snapshot" : false,
      "lucene_version" : "6.6.0"
    },
    "tagline" : "You Know, for Search"
  }
  

• 命令查看状态

  输入命令：

  [es@localhost elasticsearch-5.5.0]$ ps -ef | grep elastic
  

  输出结果：

  es       26430 26272 16 12:59 pts/1    00:00:22 /opt/jdk1.8.0_112/bin/java -Xms2g -Xmx2g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -server -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -Djdk.io.permissionsUseCanonicalPath=true -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Dlog4j.skipJansi=true -XX:+HeapDumpOnOutOfMemoryError -Des.path.home=/opt/es/elasticsearch-5.5.0 -cp /opt/es/elasticsearch-5.5.0/lib/* org.elasticsearch.bootstrap.Elasticsearch
  

四、Elasticsearch 后台启动及关闭

• Elasticsearch后台启动

  通过./bin/elasticsearch 启动服务，按 ctrl+c 的时候程序就会stop掉比较尴尬，所以需要后台启动程序。
  
  首先授权执行命令：
  chmod +x ./bin/elasticsearch
  再次执行后台启动命令：
  ./bin/elasticsearch -d
  

• 通过上一步查看到的 Elasticsearch 状态中的端口，执行下面命令杀死 Elasticsearch 进程

  [es@localhost elasticsearch-5.5.0]$ kill -9 26430
  

五、安装过程中的一些其他问题

• 启动时会有这么一个警告，不影响使用，网上查询说使用最新linux版本就可以了。

[2017-07-11T13:13:08,465][WARN ][o.e.b.JNANatives         ] unable to install syscall filter: 
java.lang.UnsupportedOperationException: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in
    at org.elasticsearch.bootstrap.SystemCallFilter.linuxImpl(SystemCallFilter.java:350) ~[elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.SystemCallFilter.init(SystemCallFilter.java:638) ~[elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.JNANatives.tryInstallSystemCallFilter(JNANatives.java:215) [elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Natives.tryInstallSystemCallFilter(Natives.java:99) [elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:111) [elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:194) [elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:351) [elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:123) [elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:114) [elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:67) [elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122) [elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.cli.Command.main(Command.java:88) [elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:91) [elasticsearch-5.5.0.jar:5.5.0]
    at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:84) [elasticsearch-5.5.0.jar:5.5.0]

• max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]

  解决方案：切换到root用户，编辑 limits.conf 添加下面内容

  vi /etc/security/limits.conf

  添加如下内容:

  * soft nofile 65536

  * hard nofile 131072

  * soft nproc 2048

  * hard nproc 4096

• max number of threads [1024] for user [es] is too low, increase to at least [2048]

  解决方案：切换到root用户，进入limits.d目录下修改配置文件。

  修改如下内容：

  * soft nproc 1024

  #修改为

  * soft nproc 2048

• max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

  解决方案：切换到root用户修改配置sysctl.conf

  vi /etc/sysctl.conf

  添加下面配置：

  vm.max_map_count=655360

  并执行命令：

  sysctl -p

• system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

  原因： CentOS6.X 不支持SecComp，而ES5.2.0默认bootstrap.system_call_filter为true进行检测，所以导致检测失败，失败后直接导致ES不能启动。

  解决方案：修改/opt/es/elasticsearch-5.5.0/config/elasticsearch.yml中配置

  vi /opt/es/elasticsearch-5.5.0/config/elasticsearch.yml

  修改如下配置

  #bootstrap.memory_lock: true

  #修改为

  bootstrap.memory_lock: false

  bootstrap.system_call_filter: false