1 准备工作
服务器信息：
192.168.91.221 （elasticsearch-node1)
192.168.91.222 （elasticsearch-node2)
192.168.91.223 （elasticsearch-node3)
1.1 安装 Java 环境（3个节点）
91221.elk.node1.com ~root># yum install vim openssh-clients lrzsz -yroot># yum install java-1.8.0-openjdk java-1.8.0-openjdk-devel -y这里 java-1.8.0-openjdk-devel 非必须安装，但以后安装插件时可能会需要 Java 的编译器（javac），因此建议提前安装好。
验证版本：
91221.elk.node1.com ~
root># java -version
openjdk version "1.8.0_111"
OpenJDK Runtime Environment (build 1.8.0_111-b15)
OpenJDK 64-Bit Server VM (build 25.111-b15, mixed mode)
1.2 安装 elasticsearch 环境（3个节点）
Elasticsearch 集群：防止因Elasticsearch 服务挂掉，丢失数据Elasticsearch 集群原理:会自动寻找同一网段cluster.name: es-cluster 名称相同的节点。
软件下载:https://www.elastic.co/downloads
node1 配置
91221.elk.node1.com ~/elkroot># tar -zxvf elasticsearch-2.4.1.tar.gz -C /opt/
root># mv elasticsearch-2.4.1/ elasticsearch-node1
root># vim /opt/elasticsearch-node1/config/elasticsearch.yml
elasticsearch>$ cat config/elasticsearch.yml|grep -Ev "^#|^$"
cluster.name: es-cluster #集群名称，默认为elasticsearch
node.name: es-node1 #节点名称
node.master: true #是否作为主节点，每个节点都可以被配置成为主节点，默认值为true
node.data: true #是否存储数据，即存储索引片段，默认值为true
bootstrap.mlockall: true #JVM开始交换时，ElasticSearch表现并不好：你需要保障JVM不进行交换，可以将bootstrap.mlockall设置为true禁止交换：
network.host: 192.168.91.221
http.port: 9200
discovery.zen.ping.timeout: 3s #设置ping其他节点时的超时时间，网络比较慢时可将该值设大
discovery.zen.ping.unicast.hosts: ["192.168.91.221", "192.168.91.222", "192.168.91.223"] #设置新节点被启动时能够发现的主节点列表（主要用于不同网段机器连接）
node2 配置
root># scp -rp /opt/elasticsearch-node1/ [email protected]:/opt/elasticsearch-node2修改 elasticsearch.yml 配置文件
只需要修改以下配置，其它不用修改
http.port: 9202
node.name: "es-node2"
node3 配置
root># scp -rp /opt/elasticsearch-node1/ [email protected]:/opt/elasticsearch-node23修改 elasticsearch.yml 配置文件
只需要修改以下配置，其它不用修改
http.port: 9200
node.name: "es-node3"
启动(3台)
root># useradd elasticsearch
root># chown -R elasticsearch:elasticsearch /opt/elasticsearch-node1/
root># chown -R elasticsearch:elasticsearch /opt/elasticsearch-node2/
root># chown -R elasticsearch:elasticsearch /opt/elasticsearch-node3/
切换到elasticsearch启动
91221.elk.node1.com /opt/elasticsearch-node1/bin[2016-12-13 19:38:24,479][WARN ][bootstrap ] unable to install syscall filter: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in
[2016-12-13 19:38:24,486][WARN ][bootstrap ] Unable to lock JVM Memory: error=12,reason=Cannot allocate memory
[2016-12-13 19:38:24,487][WARN ][bootstrap ] This can result in part of the JVM being swapped out.
[2016-12-13 19:38:24,487][WARN ][bootstrap ] Increase RLIMIT_MEMLOCK, soft limit: 65536, hard limit: 65536
[2016-12-13 19:38:24,487][WARN ][bootstrap ] These can be adjusted by modifying /etc/security/limits.conf, for example:
# allow user 'elasticsearch' mlockall
elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited
[2016-12-13 19:38:24,487][WARN ][bootstrap ] If you are logged in interactively, you will have to re-login for the new limits to take effect.
[2016-12-13 19:38:24,732][INFO ][node ] [es-node1] version[2.4.1], pid[2205], build[c67dc32/2016-09-27T18:57:55Z]
[2016-12-13 19:38:24,732][INFO ][node ] [es-node1] initializing ...
[2016-12-13 19:38:25,547][INFO ][plugins ] [es-node1] modules [reindex, lang-expression, lang-groovy], plugins [head, kopf], sites [head, kopf]
[2016-12-13 19:38:25,576][INFO ][env ] [es-node1] using [1] data paths, mounts [[/ (/dev/mapper/VolGroup-lv_root)]], net usable_space [41.3gb], net total_space [44.8gb], spins? [possibly], types [ext4]
[2016-12-13 19:38:25,577][INFO ][env ] [es-node1] heap size [990.7mb], compressed ordinary object pointers [true]
[2016-12-13 19:38:25,577][WARN ][env ] [es-node1] max file descriptors [4096] for elasticsearch process likely too low, consider increasing to at least [65536]
[2016-12-13 19:38:27,698][INFO ][node ] [es-node1] initialized
[2016-12-13 19:38:27,699][INFO ][node ] [es-node1] starting ...
[2016-12-13 19:38:27,802][INFO ][transport ] [es-node1] publish_address {192.168.91.221:9300}, bound_addresses {192.168.91.221:9300}
[2016-12-13 19:38:27,810][INFO ][discovery ] [es-node1] es-cluster/eSp8hMm5Q5Cp2Txk-cWdmg
[2016-12-13 19:38:30,888][INFO ][cluster.service ] [es-node1] new_master {es-node1}{eSp8hMm5Q5Cp2Txk-cWdmg}{192.168.91.221}{192.168.91.221:9300}{master=true}, added {{es-node2}{a-Jjk2FDQJeVRd3v7l6txg}{192.168.91.222}{192.168.91.222:9300}{master=false},{node-3}{r4P8l0P5QNWztxI4ILuwhw}{192.168.91.223}{192.168.91.223:9300}{master=false},}, reason: zen-disco-join(elected_as_master, [0] joins received)
[2016-12-13 19:38:31,039][INFO ][http ] [es-node1] publish_address {192.168.91.221:9200}, bound_addresses {192.168.91.221:9200}
[2016-12-13 19:38:31,039][INFO ][node ] [es-node1] started
[2016-12-13 19:38:31,272][INFO ][gateway ] [es-node1] recovered [0] indices into cluster_state
后台启动
91221.elk.node1.com /opt/elasticsearch-node1/binelasticsearch>$ ./elasticsearch -d
1.3检查是否启动成功(OK)
elasticsearch>$ curl http://192.168.91.221:9200
"name" : "es-node1",
"cluster_name" : "es-cluster",
"cluster_uuid" : "igGG2L-HR-2xXTWC6FgLbQ",
"version" : {
"number" : "2.4.1",
"build_hash" : "c67dc32e24162035d18d6fe1e952c4cbcbe79d16",
"build_timestamp" : "2016-09-27T18:57:55Z",
"build_snapshot" : false,
"lucene_version" : "5.5.2"
},
"tagline" : "You Know, for Search"
}
或打开网页
2 集群管理插件
Elasticsearch-head
安装
# /opt/elasticsearch-node1/bin/plugin install mobz/elasticsearch-head
-> Installing mobz/elasticsearch-head...
Trying https://github.com/mobz/elasticsearch-head/archive/master.zip ...
Downloading ............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................DONE
Verifying https://github.com/mobz/elasticsearch-head/archive/master.zip checksums if available ...
NOTE: Unable to verify checksum for downloaded plugin (unable to find .sha1 or .md5 file to verify)
Installed head into /opt/elasticsearch-node1/plugins/head
访问 hhttp://192.168.91.221:9200/_plugin/head/
可方便查询索引数据及索引大小，如下图所示:
91222.elk.node2.com /opt/elasticsearch-node2/bin
elasticsearch>$ /opt/elasticsearch-node2/bin/plugin install mobz/elasticsearch-head
node3安装
91223.elk.node3.com /opt/elasticsearch-node3/bin
elasticsearch>$ /opt/elasticsearch-node3/bin/plugin install mobz/elasticsearch-head
Elasticsearch-kofp
功能: 集群管理，监控查看cpu、内存使用情况、在线查询/提交elsticsearch数据
安装
91221.elk.node1.com /opt/elasticsearch-node1
elasticsearch>$ /opt/elasticsearch-node1/bin/plugin install lmenezes/elasticsearch-kopf
访问 http://192.168.91.221:9200/_plugin/kopf
ES插件BigDesk安装
bigdesk支持的最新版本的ES是1.3.0 ... 1.3.x
然而想要在新版本ES上安装（2.x.x），项目中遇到过一些BUG，在ES在最新版本中有修复
https://github.com/lukas-vlcek/bigdesk/archive/master.zip
2.解压到安装路径下 elasticsearch-2.4.1/plugins/目录下，会有一个bigdesk或者bigdesk-master（可以改成bigdesk）目录,然后再新建一个目录_site,压缩包里的文件放到_site目录中。
3.提示没有找到'plugin-descriptor.properties'文件，那就创建这个文件，并写入以下内容
91221.elk.node1.com /opt/elasticsearch-node1/plugins/bigdesk
elasticsearch>$ cat /opt/elasticsearch-node1/plugins/bigdesk/plugin-descriptor.properties
description=bigdesk
version=bigdesk
name=bigdesk
site=true
保存OK，大功告成。
然后在本地浏览器中输入 http://localhost:9200/_plugin/bigdesk/
注：_plugin后面的bigdesk就是plugins地下目录名字，若是bigdesk-master，则需要写这个名字
本以为会正常运行，然而出现了一个js弹框，有这样的内容
**************************
Bigdesk may not work correctly!
Found ES node version:2.3.0
Require ES node version:>= 1.0.0.RC1
**************************
解决办法：
定位到plugins/bigdesk/_site/js/store目录，打开BigdeskStore.js，定位到142行
| return (major == 1 && minor >= 0 && maintenance >= 0 && (build != 'Beta1' || build != 'Beta2')); |
浏览器重新打开 http://192.168.91.221:9200/_plugin/bigdesk/
OK.可以看到正常运行了。
Marvel
安装步骤：
1) 在Elasticsearch中安装Marvel插件。
bin/plugin install license
bin/plugin install marvel-agent
2) 在Kibana中安装Marvel插件
bin/kibana plugin --install elasticsearch/marvel/latest
3) 启动Elasticsearch和Kibana
bin/elasticsearch
bin/kibana
安装好后在浏览器中输入：http://127.0.0.1:5601/即可看到界面如图9.1所示。
参考文档：
https://my.oschina.net/topeagle/blog/405149 elasticsearch配置文件详解http://www.iyunv.com/thread-271492-1-1.html Elasticsearch 2.x.x版本如何安装bigdesk