---

Elasticsearch是位于Elastic Stack核心的分布式搜索和分析引擎。Logstash和Beats有助于收集、聚合和丰富数据，并将其存储在Elasticsearch中。Kibana使您能够交互式地探索、可视化和共享对数据的见解，并管理和监视堆栈。Elasticsearch是索引、搜索和分析魔术发生的地方。

Elasticsearch为所有类型的数据提供近乎实时的搜索和分析。无论您是结构化还是非结构化文本、数字数据还是地理空间数据，Elasticsearch都可以以一种支持快速搜索的方式有效地存储和索引它。您可以远远超出简单的数据检索和汇总信息，从而发现数据中的趋势和模式。随着数据和查询量的增长，Elasticsearch的分布式特性使您的部署能够无缝地随之增长。

Elasticsearch 软件包官方下载地址：https://www.elastic.co/cn/downloads/past-releases#elasticsearch

主机规则

主机名称	IP地址	CPU	内存	磁盘	操作系统版本	Elasticsearch版本	OpenJDK版本
elastic01	192.168.91.61	2*2	8GB	80GB	CentOS 7.9	7.16.2	17.0.1
elastic02	192.168.91.62	2*2	8GB	80GB	CentOS 7.9	7.16.2	17.0.1
elastic03	192.168.91.63	2*2	8GB	80GB	CentOS 7.9	7.16.2	17.0.1

---

一、操作系统优化（三台主机都操作）

1、操作系统优化

systemctl stop firewalld
systemctl disable firewalld

sed -i 's@SELINUX=enforcing@SELINUX=disabled@g' /etc/selinux/config
grep -i "^selinux=" /etc/selinux/config
setenforce 0
getenforce

sed -i 's/#UseDNS yes/UseDNS no/g' /etc/ssh/sshd_config
sed -i 's/GSSAPIAuthentication yes/GSSAPIAuthentication no/g' /etc/ssh/sshd_config
systemctl restart sshd

mv /etc/yum.repos.d/* /tmp/
curl -o /etc/yum.repos.d/CentOS-Base.repo http://elk.hanslaser.com:8080/repo/CentOS-Base.repo
yum clean all
yum makecache

yum -y install vim net-tools ntpdate wget
timedatectl set-timezone Asia/Shanghai

ntpdate 172.20.241.20
cat > /var/spool/cron/root << 'EOF'
### sync time
*/30 * * * * /usr/sbin/ntpdate 172.20.241.20 >/dev/null 2>&1
EOF
chmod 600 /var/spool/cron/root

cp -rp /etc/sysconfig/network-scripts/ifcfg-ens192 /tmp/
sed -i '/IPV6_*/d' /etc/sysconfig/network-scripts/ifcfg-ens192

ifconfig virbr0 down
brctl delbr virbr0
systemctl stop libvirtd.service
systemctl disable libvirtd.service
systemctl stop rpcbind
systemctl disable rpcbind
systemctl stop cups
systemctl disable cups
systemctl stop avahi-daemon
systemctl disable avahi-daemon
systemctl stop chronyd
systemctl disable chronyd

sysctl -w vm.swappiness=10
cat /proc/sys/vm/swappiness
cat >> /etc/sysctl.conf << EOF
vm.swappiness = 10
EOF

2、设置普通用户资源配置（最大创建进程数、最大打开文件描述符数量、最大锁定内存地址空间）

cat >> /etc/security/limits.conf << 'EOF'
*   soft   nproc       65535
*   hard   nproc       65535
*   soft   nofile      65535
*   hard   nofile      65535
*   soft   memlock     unlimited
*   hard   memlock     unlimited
EOF

3、设置控制进程最大可支持的vma数量。可以解决出现内存不足、OOM问题、影响节点可用性等问题。默认值65530

cat >> /etc/sysctl.conf << 'EOF'
vm.max_map_count=655360
EOF
sysctl -p

4、设置三台ES主机本地DNS域名解析

cat >> /etc/hosts << 'EOF'
192.168.91.61 elastic01
192.168.91.62 elastic02
192.168.91.63 elastic03
EOF

5、自定义禁用IPv6

cp -rp /etc/sysconfig/network-scripts/ifcfg-ens192 /tmp/
sed -i '/IPV6_*/d' /etc/sysconfig/network-scripts/ifcfg-ens33

---

二、安装部署ES集群

1、(三台主机都操作)创建ES服务的普通用户

提示：必须使用普通用户启动ES服务，不能直接使用root管理员用户启动ES服务，否则启动ES服务会报错

useradd -M -s /sbin/nologin elasticsearch
id elasticsearch

2、(三台主机都操作)下载ES二进制安装包并解压，授权属主属组elasticsearch

mkdir -p /data/software
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.16.2-linux-x86_64.tar.gz -D /data/software/
tar xf /data/software/elasticsearch-7.16.2-linux-x86_64.tar.gz -C /usr/local/
chown -R elasticsearch:elasticsearch /usr/local/elasticsearch-7.16.2
ln -s /usr/local/elasticsearch-7.16.2/bin/* /usr/local/bin/

3、(三台主机都操作)自定义ES数据存储目录和日志存储目录

mkdir -p /data/elasticsearch/data
mkdir -p /data/elasticsearch/logs
chown -R elasticsearch:elasticsearch /data/elasticsearch

4、(三台主机都操作)自定义ES数据存储目录和日志存储目录

mkdir -p /data/elasticsearch/data
mkdir -p /data/elasticsearch/logs
chown -R elasticsearch:elasticsearch /data/elasticsearch

5、(三台主机都操作) 使用ES二进制安装包自带的JDK

cat >> /etc/profile << 'EOF'
export ES_JAVA_HOME=/usr/local/elasticsearch-7.16.2/jdk/
export PATH=${ES_JAVA_HOME}/bin:$PATH
EOF
source /etc/profile
java -version

6、(三台主机都操作) 根据实际环境需求设置ES服务JVM使用内存分配的大小，默认是4GB，-Xms代表JVM初始值堆内存大小，-Xmx代表最大堆内存大小

sed -i 's/## -Xms4g/-Xms8g/g' /usr/local/elasticsearch-7.16.2/config/jvm.options
sed -i 's/## -Xmx4g/-Xmx8g/g' /usr/local/elasticsearch-7.16.2/config/jvm.options
cat /usr/local/elasticsearch-7.16.2/config/jvm.options | egrep -e "-Xms|-Xmx"

7、登录ES集群elastic01节点服务器，修改ES服务配置文件

### ES集群配置文件说明 ### 
cluster.name: plm-es-cluster      # 自定义ES集群名称，保证该局域网内集群名称是唯一，不能与其它ES集群名称相同
gateway.recover_after_nodes: 2    # 设置ES集群至少有2个节点启动时，ES集群才可以进行分片数据恢复（ES集群服务启动时执行）。默认值1
gateway.expected_nodes: 3         # 设置ES集群期望3个节点同时在线时，ES集群才可以进行分片数据恢复（ES集群服务在运行过程中执行）。默认值2
gateway.recover_after_time: 5m    # 设置ES集群启动后等待shard恢复时间。默认值5分钟

node.name: docker01               # 自定义ES集群节点名称，建议设置成本地主机名称，并且要在本地/etc/hosts能解析
node.master: true                 # 是否有资格被选为主节点
node.data: true                   # 是否存储数据
node.ingest: true                 # 启用ingest功能（处理ingest任务）。默认值true

path.data: /data/elasticsearch/data      # 指定ES集群数据存储目录
path.logs: /data/elasticsearch/logs      # 指定ES集群日志存储目录

bootstrap.memory_lock: true      # 设置Elasticsearch将其进程的JVM内存锁定在物理内存中，防止JVM内存交换磁盘，影响ES集群节点的性能与稳定。默认值false

network.host: 192.168.91.61      # 设置ES集群监听IP。默认值0.0.0.0(监听本机所有IP地址，包括回环地址127.0.0.1)
http.port: 9200                  # 设置ES集群监听端口。默认端口9200
http.cors.enabled: true
http.cors.allow-origin: true

discovery.seed_hosts: ["docker01", "docker02", "docker03"]  # 用于ES集群节点相互发现，提供ES集群内符合主节点条件的其它节点列表，可以填写IP或主机名称（所有节点主机名称要在本地/etc/hosts能解析）
cluster.initial_master_nodes: ["docker01", "docker02", "docker03"]    # 设置ES集群服务启动时，第一次投票选举主节点。确保设置的节点数量是一个奇数，防止出现"投票分裂"问题。
discovery.zen.fd.ping_interval: 10s  # 设置本节点相隔10秒向目标节点发送一次ping请求。默认值1s
discovery.zen.fd.ping_timeout:  60s  # 设置本节点等待发送给目标节点的ping请求等待时间。如果本地节点网络比较慢，可能就需要增加该节点属性值。默认值30s
discovery.zen.fd.ping_retries: 6     # 设置本节点发送给目标节点有6次ping请求失败的次数时，认定该目标节点失联。默认值3
discovery.zen.minimum_master_nodes: 2  # 防止ES群集脑裂，设置符合条件的主节点法定数量。最少的主节点应该设置成(总节点数/2)+1

xpack.security.enabled: true         # 启用x-pack安全认证功能
xpack.security.transport.ssl.enabled: true       
xpack.security.transport.ssl.verification_mode: certificate 
xpack.security.transport.ssl.keystore.path: /usr/local/elasticsearch-7.16.2/config/elasticsearch-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/local/elasticsearch-7.16.2/config/elasticsearch-certificates.p12

### 提示：根据实际环境修改node.name、network.host、discovery.seed.hosts、cluster.initial_master_nodes参数
cp -rp /usr/local/elasticsearch-7.16.2/config/elasticsearch.yml{,_20240820.bak}

cat > /usr/local/elasticsearch-7.16.2/config/elasticsearch.yml << 'EOF'
cluster.name: plm-es-cluster
gateway.recover_after_nodes: 2
gateway.expected_nodes: 3
gateway.recover_after_time: 5m

node.name: elastic01
node.master: true
node.data: true
node.ingest: true

path.data: /data/elasticsearch/data
path.logs: /data/elasticsearch/logs

bootstrap.memory_lock: true

network.host: 192.168.91.61
http.port: 9200
http.cors.enabled: true
http.cors.allow-origin: true

discovery.seed_hosts: ["elastic01", "elastic02", "elastic03"]
cluster.initial_master_nodes: ["elastic01", "elastic02", "elastic03"]
discovery.zen.fd.ping_interval: 10s
discovery.zen.fd.ping_timeout: 60s
discovery.zen.fd.ping_retries: 6
discovery.zen.minimum_master_nodes: 2
EOF

8、登录ES集群elastic02节点服务器，修改ES服务配置文件

提示：根据实际环境修改node.name、network.host、discovery.seed.hosts、cluster.initial_master_nodes参数

cp -rp /usr/local/elasticsearch-7.16.2/config/elasticsearch.yml{,_20240820.bak}

cat > /usr/local/elasticsearch-7.16.2/config/elasticsearch.yml << 'EOF'
cluster.name: plm-es-cluster
gateway.recover_after_nodes: 2
gateway.expected_nodes: 3
gateway.recover_after_time: 5m

node.name: elastic02
node.master: true
node.data: true
node.ingest: true

path.data: /data/elasticsearch/data
path.logs: /data/elasticsearch/logs

bootstrap.memory_lock: true

network.host: 192.168.91.62
http.port: 9200
http.cors.enabled: true
http.cors.allow-origin: true

discovery.seed_hosts: ["elastic01", "elastic02", "elastic03"]
cluster.initial_master_nodes: ["elastic01", "elastic02", "elastic03"]
discovery.zen.fd.ping_interval: 10s
discovery.zen.fd.ping_timeout: 60s
discovery.zen.fd.ping_retries: 6
discovery.zen.minimum_master_nodes: 2
EOF

9、登录ES集群elastic03节点服务器，修改ES服务配置文件

提示：根据实际环境修改node.name、network.host、discovery.seed.hosts、cluster.initial_master_nodes参数

cp -rp /usr/local/elasticsearch-7.16.2/config/elasticsearch.yml{,_20240820.bak}

cat > /usr/local/elasticsearch-7.16.2/config/elasticsearch.yml << 'EOF'
cluster.name: plm-es-cluster
gateway.recover_after_nodes: 2
gateway.expected_nodes: 3
gateway.recover_after_time: 5m

node.name: elastic03
node.master: true
node.data: true
node.ingest: true

path.data: /data/elasticsearch/data
path.logs: /data/elasticsearch/logs

bootstrap.memory_lock: true

network.host: 192.168.91.63
http.port: 9200
http.cors.enabled: true
http.cors.allow-origin: true

discovery.seed_hosts: ["elastic01", "elastic02", "elastic03"]
cluster.initial_master_nodes: ["elastic01", "elastic02", "elastic03"]
discovery.zen.fd.ping_interval: 10s
discovery.zen.fd.ping_timeout: 60s
discovery.zen.fd.ping_retries: 6
discovery.zen.minimum_master_nodes: 2
EOF

10、(三台主机都操作)设置ES服务添加到systemd启动列表

cat > /usr/lib/systemd/system/elasticsearch.service << 'EOF'
[Unit]
Description=Elasticsearch
Documentation=https://www.elastic.co
Wants=network-online.target
After=network-online.target

[Service]
LimitCORE=infinity
User=elasticsearch
Group=elasticsearch
Environment=ES_JAVA_HOME=/usr/local/elasticsearch-7.16.2/jdk
ExecStart=/usr/local/elasticsearch-7.16.2/bin/elasticsearch

# Specifies the maximum file descriptor number that can be opened by this process
LimitNOFILE=65535
# Specifies the maximum number of processes
LimitNPROC=65536
# Specifies the maximum size of virtual memory
LimitAS=infinity
# Specifies the maximum file size
LimitFSIZE=infinity
# Disable timeout logic and wait until process is stopped
TimeoutStopSec=0
# SIGTERM signal is used to stop the Java process
KillSignal=SIGTERM
# Send the signal only to the JVM rather than its control group
KillMode=process
# Java process is never killed
SendSIGKILL=no
# When a JVM receives a SIGTERM signal it exits with code 143
SuccessExitStatus=143
# Allow a slow startup before the systemd notifier module kicks in to extend the timeout
TimeoutStartSec=75

[Install]
WantedBy=multi-user.target
EOF

11、(三台主机都操作) 针对ES服务锁定内存配置，配置完后配置项自动保存

在/etc/systemd/system/elasticsearch.service.d/override.conf配置文件中
systemctl edit elasticsearch

[Service]
LimitMEMLOCK=infinity

cat /etc/systemd/system/elasticsearch.service.d/override.conf

12、(三台主机都操作) 重新加载ES服务并启动

systemctl daemon-reload
systemctl start elasticsearch 
systemctl status elasticsearch

13、登录ES集群任意一个节点检查ES集群情况

### 查看ES集群哪个IP是主节点
curl -X GET http://192.168.91.62:9200/_cat/master?format=json?pretty

### 查看ES集群健康状态
curl -X GET http://192.168.91.62:9200/_cat/health?v

### 查看ES集群状态
curl -X GET http://192.168.91.62:9200/_cluster/health?pretty

### 这个API返回ES集群基本的索引指标(分片数、存储大小、内存使用情况)和关于当前集群节点的信息(数量、角色、操作系统、jvm版本、内存使用情况、cpu和已安装的插件)
curl -X GET http://192.168.91.62:9200/_cluster/stats/nodes/docker01?pretty 

### 查看每个节点相关信息,ip、heap百分比、ram百分比、CPU负载情况
curl -X GET http://192.168.91.62:9200/_cat/nodes?v

### 查看ES服务设置的总分片数量，默认值1000
curl -s -X GET 'http://192.168.91.62:9200/_cluster/settings?include_defaults&flat_settings' | python -m json.tool | egrep -w "\"cluster.max_shards_per_node\""
### 查看ES集群总共使用分片数量，参数shards的值就是使用的分片数量
curl -X GET http://192.168.91.62:9200/_cat/health?v
### 查看ES集群每个节点使用分片数量情况
curl -X GET http://192.168.91.62:9200/_cat/allocation?v
### 查看ES集群索引分布的节点
curl -X GET http://192.168.91.62:9200/_cat/shards?v

---

三、ES集群开启x-pack安全认证

1、登录ES集群主节点生成证书，并把证书远程传输给其它ES节点服务器

注意：ES集群生成的证书一定要放在ES服务配置文件目录下并授于属主和属组elasticsearchn，x-pack安全证书开启先要配置x-pack安全认证功能，重启ES服务后，最后才设置x-pack安全认证的用户和密码。

### 查看ES集群主节点是哪台主机
curl -X GET http://192.168.91.62:9200/_cat/master?format=json?pretty

### 生成x-pack安全认证证书
/usr/local/elasticsearch-7.16.2/bin/elasticsearch-certutil cert -out /usr/local/elasticsearch-7.16.2/config/elasticsearch-certificates.p12 -pass ""

### 证书授权属主和属组elasticsearchn和权限
chown -R elasticsearch:elasticsearch /usr/local/elasticsearch-7.16.2/config/elasticsearch-certificates.p12
chmod 660 /usr/local/elasticsearch-7.16.2/config/elasticsearch-certificates.p12

### 远程复制给其它ES节点服务器，使用rsync –avzP远程复制能确保证书的属主属组和权限不变的情况下远程复制过去
rsync -avzP /usr/local/elasticsearch-7.16.2/config/elasticsearch-certificates.p12 root@192.168.91.61:/usr/local/elasticsearch-7.16.2/config/
rsync -avzP /usr/local/elasticsearch-7.16.2/config/elasticsearch-certificates.p12 root@192.168.91.63:/usr/local/elasticsearch-7.16.2/config/

2、(三台主机都操作) 每个ES节点都要添加以下ES服务x-pack安全认证配置参数

cat >> /usr/local/elasticsearch-7.16.2/config/elasticsearch.yml << 'EOF'

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /usr/local/elasticsearch-7.16.2/config/elasticsearch-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/local/elasticsearch-7.16.2/config/elasticsearch-certificates.p12
EOF

3、(三台主机都操作)重新加载ES服务并重启ES服务

systemctl daemon-reload
systemctl restart elasticsearch
systemctl status elasticsearch

4、登录ES集群主节点设置elastic管理员密码，其它ES节点会自动同步主节点信息

提示：建议所有用户设置成统一的密码，防止遗忘密码

[root@elastic02 ~]# /usr/local/elasticsearch-7.16.2/bin/elasticsearch-setup-passwords interactive

Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y    ### 输入y确认

Enter password for [elastic]:                       # 输入elastic用户密码
Reenter password for [elastic]:                     # 再次输入elastic用户密码
Enter password for [apm_system]:                    # 输入apm_system用户密码
Reenter password for [apm_system]:                  # 再次输入apm_system用户密码
Enter password for [kibana_system]:                 # 输入kibana_system用户密码
Reenter password for [kibana_system]:               # 再次输入kibana_system用户密码
Enter password for [logstash_system]:               # 输入logstash_system用户密码
Reenter password for [logstash_system]:             # 再次输入logstash_system用户密码
Enter password for [beats_system]:                  # 输入beats_system用户密码 
Reenter password for [beats_system]:                # 再次输入beats_system用户密码 
Enter password for [remote_monitoring_user]:        # 输入remote_monitoring_user用户密码
Reenter password for [remote_monitoring_user]:      # 再次输入remote_monitoring_user用户密码
Changed password for user [apm_system]
Changed password for user [kibana_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]

5、登录ES集群任意一个节点检查ES集群x-pack安全认证功能

### 查看ES集群哪个IP是主节点
curl -u elastic:123456 -X GET http://192.168.91.62:9200/_cat/master?format=json?pretty

### 查看ES集群健康状态
curl -u elastic:123456 -X GET http://192.168.91.62:9200/_cat/health?v

### 查看ES集群状态
curl -u elastic:123456 -X GET http://192.168.91.62:9200/_cluster/health?pretty

### 这个API返回ES集群基本的索引指标(分片数、存储大小、内存使用情况)和关于当前集群节点的信息(数量、角色、操作系统、jvm版本、内存使用情况、cpu和已安装的插件)
curl -u elastic:123456 -X GET http://192.168.91.62:9200/_cluster/stats/nodes/docker01?pretty

### 查看每个节点相关信息,ip、heap百分比、ram百分比、CPU负载情况
curl -u elastic:123456 -X GET http://192.168.91.62:9200/_cat/nodes?v

### 查看ES服务设置的总分片数量，默认值1000
curl -u elastic:123456 -s -X GET 'http://192.168.91.62:9200/_cluster/settings?include_defaults&flat_settings' | python -m json.tool | egrep -w "\"cluster.max_shards_per_node\""
### 查看ES集群总共使用分片数量，参数shards的值就是使用的分片数量
curl -u elastic:123456 -X GET http://192.168.91.62:9200/_cat/health?v
### 查看ES集群每个节点使用分片数量情况
curl -u elastic:123456 -X GET http://192.168.91.62:9200/_cat/allocation?v
### 查看ES集群索引分布的节点
curl -u elastic:123456 -X GET http://192.168.91.62:9200/_cat/shards?v

---

四、索引指南

1、查询ES集群所有索引

curl -u elastic:123456 -X GET http://192.168.91.62:9200/_cat/indices?v

2、创建索引名称为customer索引

curl -u elastic:123456 -X PUT http://192.168.91.62:9200/customer?pretty

3、现在插入一条数据到ES集群索引，必须给ES指定索引类型，Elasticsearch 7版本之后默认索引类型都是_doc

curl -u elastic:123456 -X POST "http://192.168.91.62:9200/customer/_doc" -H 'Content-Type: application/json' -d '{ "name": "xiaoming" }'

4、查询索引名称为customer索引的文档数量

curl -u elastic:123456 -X GET http://192.168.91.62:9200/customer/_count?pretty

5、查询索引名称为customer索引的文档内容

### 查询索引名称为customer索引的文档所有内容
curl -u elastic:123456 -X GET http://192.168.91.62:9200/customer/_search?pretty

### 查询索引名称为customer索引的文档指定name:xiaoming的内容
curl -u elastic:123456 -X GET "http://192.168.91.62:9200/customer/_search?pretty" -H 'Content-Type: application/json' -d '{ "query": { "match": { "name": "xiaoming" } } }'

6、删除索引名称为customer索引

curl -u elastic:123456 -X DELETE http://192.168.91.62:9200/customer?pretty