ELK之elasticsearch5.6的安装和head插件的安装-白红宇

ELK之elasticsearch5.6的安装和head插件的安装

阅读量：5317 次

发布时间：2019-06-14

本文共 4666 字，大约阅读时间需要 15 分钟。

这里选择的elasticsearch为5.6的新版本，根据官方文档有几种暗装方式：

https://www.elastic.co/guide/en/elasticsearch/reference/current/install-elasticsearch.html

这里选择rpm包安装https://www.elastic.co/guide/en/elasticsearch/reference/current/rpm.html

1、wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.6.1.rpm

2、查看有哪些配置文件

[root@node1 ~]# cd /etc/elasticsearch/[root@node1 elasticsearch]# ll总用量 20-rw-rw----. 1 root elasticsearch 3024 9月  19 14:00 elasticsearch.yml-rw-rw----. 1 root elasticsearch 3123 9月  18 10:38 jvm.options-rw-rw----. 1 root elasticsearch 4456 9月   7 11:12 log4j2.propertiesdrwxr-x---. 2 root elasticsearch 4096 9月   7 11:12 scripts

　elasticsearch常用配置在elasticsearch.yml文件中，关于jvm的一些配置在jvm.options文件中，日志的配置在log4j2.properties文件中

[root@node1 elasticsearch]# grep -v "^#" /etc/elasticsearch/elasticsearch.yml cluster.name: my-elasticnode.name: node1network.host: 0.0.0.0http.port: 9200

　简单配置之后然后启动服务：/etc/init.d/elasticsearch start

默认日志文件为/var/log/elasticsearch/目录下，启动有报错都可以根据报错解决

这里将一些遇到的报错及解决方法列一些出来：

1、max number of threads [1024] for user [elasticsearch] is too low, increase to at least [2048]

解决：

[root@node1 elasticsearch]# cat /etc/security/limits.d/90-nproc.conf# Default limit for number of user's processes to prevent# accidental fork bombs.# See rhbz #432903 for reasoning.*          soft    nproc     2048root       soft    nproc     unlimited

2、max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

修改/etc/sysctl.conf配置文件，

cat /etc/sysctl.conf | grep vm.max_map_count

vm.max_map_count=262144

如果不存在则添加

echo "vm.max_map_count=262144" >>/etc/sysctl.conf

3、max file descriptors [65535] for elasticsearch process likely too low, increase to at least [65536]

ulimit -n 65536

4、启动异常：ERROR: bootstrap checks failed

system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

问题原因：因为Centos6不支持SecComp，而ES默认bootstrap.system_call_filter为true进行检测，所以导致检测失败，失败后直接导致ES不能启动

解决方法：在elasticsearch.yml中配置bootstrap.system_call_filter为false，注意要在Memory下面:

bootstrap.memory_lock: false

bootstrap.system_call_filter: false 添加此行

现在整个elasticsearch.yml配置如下：

[root@node1 elasticsearch]# grep -v "^#" /etc/elasticsearch/elasticsearch.yml cluster.name: my-elasticnode.name: node1bootstrap.system_call_filter: falsenetwork.host: 0.0.0.0http.port: 9200

　重新启动elasticsearch服务，查看日志是否报错，如没有报错，浏览器进行访问是否有效：

现在为elasticsearch安装上插件head，利用github找到head插件：

https://github.com/mobz/elasticsearch-head，根据文中说明：

There are multiple ways of running elasticsearch-head.

Running with built in server

git clone git://github.com/mobz/elasticsearch-head.git

cd elasticsearch-head

npm install

npm run start

open

This will start a local webserver running on port 9100 serving elasticsearch-head

Running as a plugin of Elasticsearch (deprecated)

for Elasticsearch 5.x: site plugins are not supported. Run

elasticsearch5.x以上需要安装head插件需要作为一个单独的服务，步骤如上，于是开始安装：

如果没有npm命令需要首先安装上：　　

　　安装npm：

yum install npm epel源提供的

添加npm源：

　　npm install -g cnpm --registry=

直接将本地的npm仓库指向淘宝的镜像地址

　　npm config set registry

开始安装head插件：

git clone git://github.com/mobz/elasticsearch-head.gitcd elasticsearch-headnpm installnpm run start

　默认监听在0.0.0.0，不需要修改监听地址

这里有两种启动方式：

　　1、npm run start（仓库拉取下来的elasticsearch-head目录下执行）

2、[root@node1 elasticsearch-head]# ./node_modules/grunt/bin/grunt server

启动后都是如下效果：

[root@node1 elasticsearch-head]# ./node_modules/grunt/bin/grunt serverLoading "watch.js" tasks...ERROR>> Error: Cannot find module 'http-parser-js'Running "connect:server" (connect) taskWaiting forever...Started connect web server on http://localhost:9100

　查看日志：

[2017-09-19T13:50:36,288][INFO ][o.e.p.PluginsService ] [node1] no plugins loaded

[2017-09-19T13:50:38,401][INFO ][o.e.d.DiscoveryModule ] [node1] using discovery type [zen]

[2017-09-19T13:50:39,079][INFO ][o.e.n.Node ] [node1] initialized

[2017-09-19T13:50:39,079][INFO ][o.e.n.Node ] [node1] starting ...

[2017-09-19T13:50:39,239][INFO ][o.e.t.TransportService ] [node1] publish_address {192.168.44.134:9300}, bound_addresses {[::]:9300}

9100端口已经监听了，访问浏览器http://192.168.44.134:9100却依然连接不到集群，然后谷歌到需要进行设置：

check http.cors.enabled and http.cors.allow-origin are set in config/elasticsearch.yml in order to enable cors.

Reference :

然后配置elastic，具体配置如下：

[root@node1 elasticsearch]# grep -v "^#" /etc/elasticsearch/elasticsearch.yml cluster.name: my-elasticnode.name: node1bootstrap.system_call_filter: falsehttp.cors.enabled: truehttp.cors.allow-origin: "*"network.host: 0.0.0.0http.port: 9200

　重启服务之后，浏览器访问