1. 创建用户，ES默认不允许使用root启动；
groupadd es #增加es组
useradd es -g es -p pwd #增加es用户并附加到es组
passwd es #设置es用户密码
chown -R es:es elasticsearch-6.2.4 #给目录权限
su es #使用es用户
cd /usr/local/elasticsearch-6.2.4
./bin/elasticsearch -d #后台运行es
2. 测试是否启动成功
可以验证一下服务是否正常
- [root@elk2 ~]# curl -i "http://localhost:9200"
- HTTP/1.1 200 OK
- content-type: application/json; charset=UTF-8
- content-length: 436
- {
- "name" : "linux-2",
- "cluster_name" : "li-application",
- "cluster_uuid" : "LeGL4ApCTDS-Nj76INkZAg",
- "version" : {
- "number" : "6.2.2",
- "build_hash" : "10b1edd",
- "build_date" : "2018-02-16T19:01:30.685723Z",
- "build_snapshot" : false,
- "lucene_version" : "7.2.1",
- "minimum_wire_compatibility_version" : "5.6.0",
- "minimum_index_compatibility_version" : "5.0.0"
- },
- "tagline" : "You Know, for Search"
- }
ps 。后台运行ES，可以加入-p 命令 让es在后台运行， -p 参数 记录进程ID为一个文件
- [es@elk2 elasticsearch-6.2.2]$ ./bin/elasticsearch -d -p pid
关闭后台运行ES，使用如下命令（前提是用上面的命令运行）：
- [es@elk2 elasticsearch-6.2.2]$ kill `cat pid`
3.配置ElasticSearch，让ElasticSearch支持外网访问，加入集群等
修改配置文件elasticsearch.yml
- [es@elk2 elasticsearch-6.2.2]$ vim config/elasticsearch.yml
去掉以下注释，修改以下配置（记得配置项名称冒号后面是有一个空格的，若没有空格会报错
- cluster.name: my-application #集群名称，可以自行修改
- node.name: node-1 #节点名称，自行修改
- network.host: 172.16.1.177 #主机地址，这里写本机IP
- http.port: 9200 #端口
修改后，再次启动ES后，会得到以下报错。日志错误可以查看 /usr/local/elasticsearch-6.2.4/logs/my-application.log
- [es@elk2 elasticsearch-6.2.2]$ ./bin/elasticsearch
- [1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
- [2]: max number of threads [1024] for user [es] is too low, increase to at least [4096]
- [3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
- [4]: system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
根据网上的各位大佬的解决办法，逐一去解决，使用root身份，执行以下操作
解决问题【1】【2】
- [root@elk2 ~]# vim /etc/security/limits.conf
在文件未添加以下内容（开头es 为用户名）
- es soft nofile 65536
- es hard nofile 131072
- es soft nproc 4096
- es hard nproc 4096
解决问题【3】
- [root@elk2 ~]# sysctl -w vm.max_map_count=262144
- [root@elk2 ~]# vim /etc/sysctl.conf #让配置永久生效
在文末添加以下内容
- vm.max_map_count=262144
解决问题【4】
Centos6不支持SecComp，而ES6默认bootstrap.system_call_filter为true
- [es@elk2 elasticsearch-6.2.2]$ vim config/elasticsearch.yml
禁用：在elasticsearch.yml中配置bootstrap.system_call_filter为false，注意要在Memory下面:
取消bootstrap.memory_lock的注释，添加bootstrap.system_call_filter 配置
- bootstrap.memory_lock: false
- bootstrap.system_call_filter: false
再次启动es，成功启动
- [es@elk2 elasticsearch-6.2.2]$ ./bin/elasticsearch
- [2018-02-28T14:16:23,893][INFO ][o.e.t.TransportService ] [linux-2] publish_address {172.16.1.177:9300}, bound_addresses {172.16.1.177:9300}
- [2018-02-28T14:16:23,914][INFO ][o.e.b.BootstrapChecks ] [linux-2] bound or publishing to a non-loopback address, enforcing bootstrap checks
- [2018-02-28T14:16:27,017][INFO ][o.e.c.s.MasterService ] [linux-2] zen-disco-elected-as-master ([0] nodes joined), reason: new_master {linux-2}{rAnzmAZLR2CCkXXZY1oxAA}{Diisd8m8SiOgBGPC_ET_Fg}{172.16.1.177}{172.16.1.177:9300}
- [2018-02-28T14:16:27,031][INFO ][o.e.c.s.ClusterApplierService] [linux-2] new_master {linux-2}{rAnzmAZLR2CCkXXZY1oxAA}{Diisd8m8SiOgBGPC_ET_Fg}{172.16.1.177}{172.16.1.177:9300}, reason: apply cluster state (from master [master {linux-2}{rAnzmAZLR2CCkXXZY1oxAA}{Diisd8m8SiOgBGPC_ET_Fg}{172.16.1.177}{172.16.1.177:9300} committed version [1] source [zen-disco-elected-as-master ([0] nodes joined)]])
- [2018-02-28T14:16:27,117][INFO ][o.e.h.n.Netty4HttpServerTransport] [linux-2] publish_address {172.16.1.177:9200}, bound_addresses {172.16.1.177:9200}
- [2018-02-28T14:16:27,117][INFO ][o.e.n.Node ] [linux-2] started
- [2018-02-28T14:16:27,170][INFO ][o.e.g.GatewayService ] [linux-2] recovered [0] indices into cluster_state
Ubuntu elasticsearch max virtual memory areas vm.max_map_count [65530] is too low, increase to at le
解决办法：
1、切换到root用户修改配置sysctl.conf
vi /etc/sysctl.conf 添加下面配置：
vm.max_map_count=655360并执行命令：
sysctl -p然后，重新启动elasticsearch，即可启动成功。