机器部署规划:
节点1:192.168.2.197 内存4g:es、kibana、nginx、filebeat
节点2:192.168.2.196 内存2g:nginx、filebeat
节点3:192.168.2.196 内存2g:nginx、filebeat
### 安装java
yum install -y java-1.8.0-openjdk.x86_64
### 下载安装软件
mkdir -p /tools
cd /tools
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.6.0.rpm
yum install -y elasticsearch-6.6.0.rpm
### 配置启动
systemctl daemon-reload
systemctl enable elasticsearch.service
systemctl start elasticsearch.service
systemctl status elasticsearch.service
### 检查是否启动成功
ps -ef|grep elastic
lsof -i:9200
### 检查是否启动成功
[root@centos7 tools]# ss -lnt|grep 9200
LISTEN 0 16384 ::ffff:127.0.0.1:9200 :::*
LISTEN 0 16384 ::1:9200
#检查日志
tail -f /var/log/elasticsearch/elasticsearch.log
Elasticsearch目录文件说明
rpm -ql elasticsearch #查看elasticsearch软件安装了哪些目录
rpm -qc elasticsearch #查看elasticsearch的所有配置文件
/etc/elasticsearch/elasticsearch.yml #配置文件
/etc/elasticsearch/jvm.options. #jvm虚拟机配置文件
/etc/init.d/elasticsearch #init启动文件
/etc/sysconfig/elasticsearch #环境变量配置文件
/usr/lib/sysctl.d/elasticsearch.conf #sysctl变量文件,修改最大描述符
/usr/lib/systemd/system/elasticsearch.service #systemd启动文件
/var/lib/elasticsearch # 数据目录
/var/log/elasticsearch #日志目录
/var/run/elasticsearch #pid目录
#文件说明
[root@centos7 tools]# rpm -qc elasticsearch
/etc/elasticsearch/elasticsearch.yml ES的主配置文件
/etc/elasticsearch/jvm.options jvm虚拟机配置
/etc/init.d/elasticsearch init的启动文件
/etc/sysconfig/elasticsearch 环境变量相关的参数
/usr/lib/sysctl.d/elasticsearch.conf jvm相关配置
/usr/lib/systemd/system/elasticsearch.service system启动文件
#es主配置文件说明
Elasticsearch 已经有了很好的默认值,特别是涉及到性能相关的配置或者选项,其它数据库可能需要调优,但总得来说,
Elasticsearch不需要。如果你遇到了性能问题,解决方法通常是更好的数据布局或者更多的节点。
egrep -v "^#" /etc/elasticsearch/elasticsearch.yml
cluster.name: dba5 #集群名称
node.name: node-1 #节点名称
path.data: /data/elasticsearch #数据目录
path.logs: /var/log/elasticsearch #日志目录
bootstrap.memory_lock: true #锁定内存
network.host: localhost #绑定IP地址
http.port: 9200 #端口号
discovery.zen.ping.unicast.hosts: [“localhost”] #集群发现的通讯节点
discovery.zen.minimum_master_nodes: 2 #最小主节点数
#创建数据目录并且授权
mkdir -p /data/elasticsearch
chown -R elasticsearch:elasticsearch /data/elasticsearch/
#重新配置配置文件
[root@centos7 tools]# cat /etc/elasticsearch/elasticsearch.yml
node.name: node-1
path.data: /data/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 192.168.2.197
http.port: 9200
bootstrap.memory_lock: true
#修改完配置文件后我们需要重启一下
systemctl restart elasticsearch
systemctl status elasticsearch
#修改完配置文件后我们需要重启一下
mkdir /data/elasticsearch
chown -R elasticsearch:elasticsearch /data/elasticsearch/
systemctl restart elasticsearch
systemctl status elasticsearch
可能会出现报错,或者无法启动

这个时候可能会启动失败,查看日志可能会发现是锁定内存失败
官方解决方案
https://www.elastic.co/guide/en/elasticsearch/reference/6.6/setup-configuration-memory.html
https://www.elastic.co/guide/en/elasticsearch/reference/6.6/setting-system-settings.html#sysconfig
### 修改启动配置文件或创建新配置文件
方法1: systemctl edit elasticsearch
方法2: vim /usr/lib/systemd/system/elasticsearch.service
### 增加如下参数
[Service]
LimitMEMLOCK=infinity
### 重新启动
systemctl daemon-reload
systemctl restart elasticsearch
#最后检查端口是否启动
[root@centos7 tools]# ss -lnt|grep '9'
LISTEN 0 16384 ::ffff:192.168.2.197:9200 :::*
LISTEN 0 16384 ::ffff:192.168.2.197:9300 :::*
#检测出现下面提示即是正常的
[root@centos7 tools]# curl 192.168.2.197:9200
{
"name" : "tc2jlGW",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "viBkIl4vQJy9qI3qPjNOQQ",
"version" : {
"number" : "6.6.0",
"build_flavor" : "default",
"build_type" : "rpm",
"build_hash" : "a9861f4",
"build_date" : "2019-01-24T11:27:09.439740Z",
"build_snapshot" : false,
"lucene_version" : "7.6.0",
"minimum_wire_compatibility_version" : "5.6.0",
"minimum_index_compatibility_version" : "5.0.0"
},
"tagline" : "You Know, for Search"
}