ELK之elasticsearch5.6的安裝和head插件的安裝

這里選擇的elasticsearch為5.6的新版本，根據官方文檔有幾種暗裝方式：

https://www.elastic.co/guide/en/elasticsearch/reference/current/install-elasticsearch.html

這里選擇rpm包安裝https://www.elastic.co/guide/en/elasticsearch/reference/current/rpm.html

1、wget?https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.6.1.rpm

2、查看有哪些配置文件

[root@node1 ~]# cd /etc/elasticsearch/
[root@node1 elasticsearch]# ll
總用量 20
-rw-rw----. 1 root elasticsearch 3024 9月  19 14:00 elasticsearch.yml
-rw-rw----. 1 root elasticsearch 3123 9月  18 10:38 jvm.options
-rw-rw----. 1 root elasticsearch 4456 9月   7 11:12 log4j2.properties
drwxr-x---. 2 root elasticsearch 4096 9月   7 11:12 scripts

　elasticsearch常用配置在elasticsearch.yml文件中，關于jvm的一些配置在jvm.options文件中，日志的配置在log4j2.properties文件中

[root@node1 elasticsearch]# grep -v "^#" /etc/elasticsearch/elasticsearch.yml 
cluster.name: my-elastic
node.name: node1
network.host: 0.0.0.0
http.port: 9200

　簡單配置之后然后啟動服務：/etc/init.d/elasticsearch start

默認日志文件為/var/log/elasticsearch/目錄下，啟動有報錯都可以根據報錯解決

這里將一些遇到的報錯及解決方法列一些出來：

1、max number of threads [1024] for user [elasticsearch] is too low, increase to at least [2048]

解決：

[root@node1 elasticsearch]# cat /etc/security/limits.d/90-nproc.conf
# Default limit for number of user's processes to prevent
# accidental fork bombs.
# See rhbz #432903 for reasoning.*          soft    nproc     2048
root       soft    nproc     unlimited

2、max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

修改/etc/sysctl.conf配置文件，

cat /etc/sysctl.conf | grep vm.max_map_count

vm.max_map_count=262144

如果不存在則添加

echo "vm.max_map_count=262144" >>/etc/sysctl.conf

3、max file descriptors [65535] for elasticsearch process likely too low, increase to at least [65536]

ulimit -n?65536

4、啟動異常：ERROR: bootstrap checks failed

system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

問題原因：因為Centos6不支持SecComp，而ES默認bootstrap.system_call_filter為true進行檢測，所以導致檢測失敗，失敗后直接導致ES不能啟動

解決方法：在elasticsearch.yml中配置bootstrap.system_call_filter為false，注意要在Memory下面:

bootstrap.memory_lock: false

bootstrap.system_call_filter: false 添加此行

現在整個elasticsearch.yml配置如下：

[root@node1 elasticsearch]# grep -v "^#" /etc/elasticsearch/elasticsearch.yml 
cluster.name: my-elastic
node.name: node1
bootstrap.system_call_filter: false
network.host: 0.0.0.0
http.port: 9200

　重新啟動elasticsearch服務，查看日志是否報錯，如沒有報錯，瀏覽器進行訪問是否有效：

現在為elasticsearch安裝上插件head，利用github找到head插件：

https://github.com/mobz/elasticsearch-head，根據文中說明：

There are multiple ways of running elasticsearch-head.

Running with built in server

• git clone git://github.com/mobz/elasticsearch-head.git
• cd elasticsearch-head
• npm install
• npm run start

• open?http://localhost:9100/

This will start a local webserver running on port 9100 serving elasticsearch-head

Running as a plugin of Elasticsearch (deprecated)

• for Elasticsearch 5.x: site plugins are not supported. Run?as a standalone server

?elasticsearch5.x以上需要安裝head插件需要作為一個單獨的服務，步驟如上，于是開始安裝：

如果沒有npm命令需要首先安裝上：　　

安裝npm：

yum install npm ? ? ? ? ? ? ? ? ? ? ? epel源提供的

添加npm源：

npm install -g cnpm --registry=https://registry.npm.taobao.org

直接將本地的npm倉庫指向淘寶的鏡像地址

npm config set registry https://registry.npm.taobao.org

開始安裝head插件：

git clone git://github.com/mobz/elasticsearch-head.git
cd elasticsearch-head
npm install
npm run start

　默認監聽在0.0.0.0，不需要修改監聽地址

這里有兩種啟動方式：

　　1、npm run start（倉庫拉取下來的elasticsearch-head目錄下執行）

? ? ? ?2、[root@node1 elasticsearch-head]# ./node_modules/grunt/bin/grunt server

啟動后都是如下效果：

[root@node1 elasticsearch-head]# ./node_modules/grunt/bin/grunt server
Loading "watch.js" tasks...ERROR
>> Error: Cannot find module 'http-parser-js'Running "connect:server" (connect) task
Waiting forever...
Started connect web server on http://localhost:9100

　查看日志：

[2017-09-19T13:50:36,288][INFO ][o.e.p.PluginsService ] [node1] no plugins loaded
[2017-09-19T13:50:38,401][INFO ][o.e.d.DiscoveryModule ] [node1] using discovery type [zen]
[2017-09-19T13:50:39,079][INFO ][o.e.n.Node ] [node1] initialized
[2017-09-19T13:50:39,079][INFO ][o.e.n.Node ] [node1] starting ...
[2017-09-19T13:50:39,239][INFO ][o.e.t.TransportService ] [node1] publish_address {192.168.44.134:9300}, bound_addresses {[::]:9300}

9100端口已經監聽了，訪問瀏覽器http://192.168.44.134:9100卻依然連接不到集群，然后谷歌到需要進行設置：

check?http.cors.enabled?and?http.cors.allow-origin?are set in?config/elasticsearch.yml?in order to enable cors.
Reference :?https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-http.html

然后配置elastic，具體配置如下：

[root@node1 elasticsearch]# grep -v "^#" /etc/elasticsearch/elasticsearch.yml 
cluster.name: my-elastic
node.name: node1
bootstrap.system_call_filter: false
http.cors.enabled: true
http.cors.allow-origin: "*"
network.host: 0.0.0.0
http.port: 9200

　重啟服務之后，瀏覽器訪問

至此elasticsearch5.6版本安裝head插件成功！！！

?

插件head的一些配置，如果node1不是監聽在0.0.0.0而是ip：

還有一個配置文件：（我這里沒有hostname這個選項）

?