環(huán)境：centos6.5义郑，三個(gè)節(jié)點(diǎn)，master交汤，slaver1芙扎，slaver2
安裝包下載：https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.4.1.tar.gz
jdk版本要求：1.8.0_131
</br>
<h3>配置文件修改</h3>

$ES_HOME/conf/elasticsearch.yml
<li>cluster.name: wpchao_first ：集群名稱(chēng)填大，相同名稱(chēng)的節(jié)點(diǎn)會(huì)組成一個(gè)集群
<li>node.name: wpchao_first_node1：節(jié)點(diǎn)名稱(chēng)允华，每個(gè)節(jié)點(diǎn)名稱(chēng)都不相同
<li>path.data: /data/es/wpchao_first ： es數(shù)據(jù)目錄
<li>path.logs: /data/es/wpchao_first/logs ：es日志目錄
<li>network.host: 192.168.2.3 ：服務(wù)綁定和與其他節(jié)點(diǎn)通信的ip
<li>discovery.zen.ping.unicast.hosts： ["master", "slaver1", "slaver2"]，能夠發(fā)現(xiàn)集群中新加入節(jié)點(diǎn)的節(jié)點(diǎn)
<li>discovery.zen.minimum_master_nodes：3 集群中有資格成為master節(jié)點(diǎn)個(gè)數(shù)

默認(rèn)情況下修改這些配置就夠了召耘，其他的參數(shù)修改參考：http://blog.csdn.net/an74520/article/details/8219814
</br>
</br>
<h3>集群?jiǎn)?dòng)及問(wèn)題處理</h3>
將es安裝文件scp到其他的節(jié)點(diǎn)褐隆，并修改對(duì)應(yīng)的配置文件庶弃，分別啟動(dòng)每個(gè)節(jié)點(diǎn)，此時(shí)es會(huì)自動(dòng)選舉某個(gè)節(jié)點(diǎn)為master節(jié)點(diǎn)祥山，注意es不允許root用戶(hù)啟動(dòng)
啟動(dòng)腳本：$ES_HOME/bin/elasticsearch

<li>啟動(dòng)時(shí)異常及處理方法

[2017-06-04T14:57:52,826][ERROR][o.e.b.Bootstrap          ] [wpchao_first_node] node validation exception
[4] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
[2]: max number of threads [1024] for user [biligeci] is too low, increase to at least [2048]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[4]: system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

問(wèn)題一：

  max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
  原因：無(wú)法創(chuàng)建本地文件問(wèn)題,用戶(hù)最大可創(chuàng)建文件數(shù)太小
  解決方法：切換到root用戶(hù)缝呕，編輯limits.conf配置文件斧散， 添加類(lèi)似如下內(nèi)容：
  vi /etc/security/limits.conf
  添加如下內(nèi)容:
  *  soft nofile 65536
  *  hard nofile 131072
  *  soft nproc 2048
  *  hard nproc 4096
  重新登錄才可生效

問(wèn)題二：

max number of threads [1024] for user [biligeci] is too low, increase to at least [2048]
原因：無(wú)法創(chuàng)建本地線程問(wèn)題,用戶(hù)最大可創(chuàng)建線程數(shù)太小
解決方法：切換到root用戶(hù)鸡捐，進(jìn)入limits.d目錄下箍镜，修改90-nproc.conf 配置文件。
vi /etc/security/limits.d/90-nproc.conf
找到如下內(nèi)容：
* soft nproc 1024
修改為
* soft nproc 2048

問(wèn)題三：

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
原因：最大虛擬內(nèi)存太小
解決方法：切換到root用戶(hù)下香缺，修改配置文件sysctl.conf
vi /etc/sysctl.conf
添加下面配置：
vm.max_map_count=655360
并執(zhí)行命令：
sysctl -p

問(wèn)題四：

system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
原因：因?yàn)镃entos6不支持SecComp图张，而ES5.4.1默認(rèn)bootstrap.system_call_filter為true進(jìn)行檢測(cè)诈悍，所以導(dǎo)致檢測(cè)失敗，失敗后直接導(dǎo)致ES不能啟動(dòng)
解決辦法：在es的配置文件elasticsearch.yml將bootstrap.system_call_filter 設(shè)置為false

到此侥钳，分別啟動(dòng)各個(gè)節(jié)點(diǎn)适袜，集群進(jìn)入可以用狀態(tài)

<li>查看集群狀態(tài)

單節(jié)點(diǎn)檢測(cè)，可以分別檢測(cè)每個(gè)節(jié)點(diǎn)是否啟動(dòng)成功

集群檢測(cè)

一般的集群檢測(cè)中就可以看出整體集群的狀態(tài)慕趴，不必要去檢測(cè)單節(jié)點(diǎn)的狀態(tài)痪蝇，當(dāng)然看下總是好的
</br>
</br>
<h3>kibana</h3>
Kibana是一個(gè)基于瀏覽器頁(yè)面的Elasticsearch前端展示工具,使用kibana可以比較方便的在圖形界面的執(zhí)行es的curd操作

安裝：https://artifacts.elastic.co/downloads/kibana/kibana-5.4.1-linux-x86_64.tar.gz鄙陡，下載完后解壓安裝即可
默認(rèn)是解壓即用冕房，默認(rèn)會(huì)監(jiān)聽(tīng)本機(jī)的9200端口躏啰，也就是默認(rèn)的elasticsearch綁定的端口，如果elasticsearch綁定的端口不是9200耙册，那么kibanan中也要對(duì)應(yīng)的額更改，在集群中任何一個(gè)節(jié)點(diǎn)啟動(dòng)kibana都可以

[root@master config]# kibana
log   [14:16:01.000] [info][status][plugin:kibana@5.4.1] Status changed from uninitialized to green - Ready
log   [14:16:01.141] [info][status][plugin:elasticsearch@5.4.1] Status changed from uninitialized to yellow -   Waiting for Elasticsearch
log   [14:16:01.190] [info][status][plugin:console@5.4.1] Status changed from uninitialized to green - Ready
log   [14:16:01.241] [info][status][plugin:metrics@5.4.1] Status changed from uninitialized to green - Ready
log   [14:16:01.254] [info][status][plugin:elasticsearch@5.4.1] Status changed from yellow to green - Kibana index ready
log   [14:16:01.457] [info][status][plugin:timelion@5.4.1] Status changed from uninitialized to green - Ready
log   [14:16:01.462] [info][listening] Server running at http://master:5601
log   [14:16:01.464] [info][status][ui settings] Status changed from uninitialized to green - Ready

出現(xiàn)上的log表示kibanna啟動(dòng)并連接elasticsearch成功详拙，可以通過(guò)http://master:5601來(lái)訪問(wèn)kibanan