01 准备工作及下载

** 1)创建一个es专门的用户(必须),因为es不能用root用户启动。**

useradd es -m
passwd <input es>
mkdir -p /export/servers/es
mkdir -p /export/data/es
mkdir -p /export/logs/es
chown -R es /export/servers/es
chown -R es /export/data/es
chown -R es /export/logs/es

2)切换到es用户下,下载安装包

su es
cd <到es的home目录>
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.0.0.tar.gz
tar -zxvf elasticsearch-6.0.0.tar.gz -C /export/servers/es/

3)修改配置文件

cd /export/servers/es/elasticsearch-6.0.0/config
rm elasticsearch.yml
vi elasticsearch.yml
-
cluster.name: myes
node.name: node03  
path.data: /export/data/es  
path.logs: /export/logs/es  
network.host: 192.168.140.130
http.port: 9200  
discovery.zen.ping.unicast.hosts: ["node02"] 
bootstrap.memory_lock: false
bootstrap.system_call_filter: false

4)修改jvm内存大小

vi jvm.options 
-
-Xms512m
-Xmx512m

02 解决启动时报错

5) 启动命令
注意啦,同学们!这里是后台启动,要发现错误的话,去logs目录下查看。

nohup /export/servers/es/elasticsearch-6.0.0/bin/elasticsearch >/dev/null 2>&1 &

6)查看错误信息

tail -100f /export/logs/es/myes.log 

核心错误信息

[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
[2]: max number of threads [1024] for user [es] is too low, increase to at least [4096]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[4]: system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

7)解决办法

1)max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]
原因:无法创建本地文件问题,用户最大可创建文件数太小
解决方案:切换到root用户,编辑limits.conf配置文件, 添加类似如下内容:
vi /etc/security/limits.conf
添加如下内容:
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096

备注:* 代表Linux所有用户名称(比如 hadoop)
需要保存、退出、重新登录才可生效。

2)max number of threads [1024] for user [es] likely too low, increase to at least [4096]
原因:无法创建本地线程问题,用户最大可创建线程数太小
解决方案:切换到root用户,进入limits.d目录下,修改90-nproc.conf 配置文件。
vi /etc/security/limits.d/90-nproc.conf
找到如下内容:
* soft nproc 1024
#修改为
* soft nproc 4096

3)max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]
原因:最大虚拟内存太小
root用户执行命令:
[root@localhost ~]# sysctl -w vm.max_map_count=262144

4)system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
原因:Centos6不支持SecComp,而ES5.4.1默认bootstrap.system_call_filter为true进行检测,所以导致检测失败,失败后直接导致ES不能启动。
详见 :https://github.com/elastic/elasticsearch/issues/22899

解决方法:在elasticsearch.yml中新增配置bootstrap.system_call_filter,设为false,注意要在Memory下面:
bootstrap.memory_lock: false
bootstrap.system_call_filter: false

以上问题解决后,es启动成功了,但又遇到了新的问题,本地机器无法访问虚拟机的服务,两个原因:
1)9200被限制为本机访问,需要在es的配置文件elasticsearch.yml中新增配置:
    network.bind_host:0.0.0.0
2)关闭虚拟机防火墙

解决了这个两个问题后,本地能够顺利访问虚拟机的ES服务了。

注意,以上虚拟内存的更改,每次重启系统之后都要重新设置

ysctl -w vm.max_map_count=262144

8)解决完了之后,再次启动服务(先杀后启)。

ps -ef|grep elasticsearch|grep bootstrap |awk '{print $2}' |xargs kill -9
nohup /export/servers/es/elasticsearch-6.0.0/bin/elasticsearch >/dev/null 2>&1 &

03 访问es

** 9)在Google Chrome浏览器中,访问以下地址:**

http://node03:9200/?pretty

得到以下内容

{
  "name" : "node03",
  "cluster_name" : "myes",
  "cluster_uuid" : "Ir-WWjS8R0KirRVwcjlLlw",
  "version" : {
    "number" : "6.0.0",
    "build_hash" : "8f0685b",
    "build_date" : "2017-11-10T18:41:22.859Z",
    "build_snapshot" : false,
    "lucene_version" : "7.0.1",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}

04 使用原生方式创建索引

使用 Xput创建索引

curl -XPUT 'http://node02:9200/twitter/doc/1?pretty' -H 'Content-Type: application/json' -d '
{
    "user": "kimchy",
    "post_date": "2009-11-15T13:12:00",
    "message": "Trying out Elasticsearch, so far so good?"
}'

curl -XPUT 'http://node02:9200/twitter/doc/2?pretty' -H 'Content-Type: application/json' -d '
{
    "user": "kimchy",
    "post_date": "2009-11-15T13:12:00",
    "message": "Trying out Elasticsearch, so far so good?"
}'

curl -XPUT 'http://node02:9200/twitter/doc/3?pretty' -H 'Content-Type: application/json' -d '
{
    "user": "kimchy",
    "post_date": "2009-11-15T13:12:00",
    "message": "Trying out Elasticsearch, so far so good?"
}'

查询数据

curl -XGET 'http://node02:9200/twitter/doc/1?pretty=true'
curl -XGET 'http://node02:9200/twitter/doc/2?pretty=true'
curl -XGET 'http://node02:9200/twitter/doc/3?pretty=true'

搜索数据
通过字进行查询:q=user:kimchy

curl -XGET 'http://node02:9200/twitter/_search?q=user:kimchy&pretty=true'
curl -XGET 'http://node02:9200/twitter/_search?pretty=true' -H 'Content-Type: application/json' -d '
{
    "query" : {
        "match" : { "user": "kimchy" }
    }
}'

通过JSON的方式进行查询

curl -XGET 'http://node02:9200/twitter/_search?pretty=true' -H 'Content-Type: application/json' -d '
{
    "query" : {
        "match_all" : {}
    }
}'

通过JSON的方式查询,查询的时候指定区间

curl -XGET 'http://node02:9200/twitter/_search?pretty=true' -H 'Content-Type: application/json' -d '
{
    "query" : {
        "range" : {
            "post_date" : { "from" : "2009-11-15T13:00:00", "to" : "2009-11-15T14:00:00" }
        }
    }
}'

标签: elasticsearch

相关文章推荐

添加新评论,含*的栏目为必填