搭建ES集群

下载安装就不说了，自行参考官网，很简单。

首先需要JAVA环境，安装JDK，然后安装 Maven

rpm -Uvh jdk-8u74-linux-x64.rpm

[root@k4274v /home/elk]# java -version
java version "1.8.0_74"
Java(TM) SE Runtime Environment (build 1.8.0_74-b02)
Java HotSpot(TM) 64-Bit Server VM (build 25.74-b02, mixed mode)

目录结构：/usr/local/elk

├── apache-maven-3.3.9 //安装分词插件要用到
├── elasticsearch-2.3.5
└── kibana-4.5.4-linux-x64

配置文件：elasticsearch.yml

# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please see the documentation for further information on configuration options:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration.html>
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
 cluster.name: mycluster
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
 node.name: bjcc-${HOSTNAME} //bjcc机房-主机名
#
# Add custom attributes to the node:
#
# node.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
# path.data: /path/to/data
#
# Path to log files:
#
# path.logs: /path/to/logs
#
# snapshot repo
 path.repo: ["/usr/local/elk/snapshot"] //快照存储路径
#
# Make sure that the `ES_HEAP_SIZE` environment variable is set to about half the memory
# available on the system and that the owner of the process is allowed to use this limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
 network.host: 10.20.20.202 //服务器的IP地址，通过ifconfig查看
#
# Set a custom port for HTTP:
#
 http.port: 9200
#
# For more information, see the documentation at:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html>
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
 discovery.zen.ping.unicast.hosts: ["10.20.20.201", "10.20.20.203", "10.20.20.204"] //配置集群的IP地址
#
# Prevent the "split brain" by configuring the majority of nodes (total number of nodes / 2 + 1):
#
# discovery.zen.minimum_master_nodes: 3
#
# For more information, see the documentation at:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-discovery.html>
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
# gateway.recover_after_nodes: 3
#
# For more information, see the documentation at:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-gateway.html>
#
# ---------------------------------- Various -----------------------------------
#
# Disable starting multiple nodes on a single system:
#
 node.max_local_storage_nodes: 1
#
# Require explicit names when deleting indices:
#
# action.destructive_requires_name: true

# 关闭自动创建索引，开启自动创建mapping
 action.auto_create_index: false
 index.mapper.dynamic: true

注意：ElasticSearch的配置文件，必须以一个空格开头，不然就报错，挺弱智的！

启动脚本：/etc/init.d/elasticsearch

官方提供的安全重启集群节点的方法

第一步：先暂停集群的shard自动均衡
curl -s -XPUT http://$SERVER_IP:9200/_cluster/settings -d '{"transient" : {"cluster.routing.allocation.enable" : "none"}}' > /dev/null

第二步：kill要升级的节点

第三步：恢复集群的shard自动均衡
curl -s -XPUT http://$SERVER_IP:9200/_cluster/settings -d '{"transient" : {"cluster.routing.allocation.enable" : "all"}}' > /dev/null

#!/bin/bash
#chkconfig: 2345 55 24
#description: elasticsearch service manager
BASE='/usr/local/elk/elasticsearch-2.3.5'
KIBBIN=$BASE'/bin/kibana'
LOCK=$BASE'/elasticsearch.lock'
SERVER_IP=`/sbin/ifconfig eth0|sed -n 2p|awk  '{ print $2 }'|awk -F : '{ print $2 }'`

START() {
    if [ -f $LOCK ];then
        echo -e "elasticsearch is already \033[32mrunning\033[0m, do nothing."
    else
        echo -e "Starting elasticsearch service..."
        cd  $BASE/bin
        ./elasticsearch -d
        touch $LOCK
        sleep 10 #wait es to start
        curl -s -XPUT http://$SERVER_IP:9200/_cluster/settings -d '{"transient" : {"cluster.routing.allocation.enable" : "all"}}' > /dev/null
        echo -e "\n\033[32mdone\033[m"
    fi
}

STOP() {
    if [ ! -f $LOCK ];then
        echo -e "elasticsearch is already stop, do nothing."
    else
        echo -e "Stop elasticsearch serivce"
        rm -rf $LOCK
        curl -s -XPUT http://$SERVER_IP:9200/_cluster/settings -d '{"transient" : {"cluster.routing.allocation.enable" : "none"}}' > /dev/null
        ps -ef | grep elasticsearch | grep -v "grep" | awk '{print $2}' | xargs kill -s 9 >/dev/null
        echo -e "\033[32mdone\033[m"
    fi
}

STATUS() {
        Port=$(netstat -tunl | grep ":9200")
    if [ "$Port" != "" ] && [ -f $LOCK ];then
        echo -e "elasticsearch is: \033[32mrunning\033[0m..."
    else
        echo -e "elasticsearch is: \033[31mstopped\033[0m..."
    fi
}
 
case "$1" in
  start)
    START
    ;;
  stop)
    STOP
    ;;
  status)
    STATUS
    ;;
  restart)
    STOP 
    sleep 2
    START
    ;;
  *)
    echo "Usage: /etc/init.d/elasticsearch (|start|stop|status|restart)"
    ;;
esac

启动服务：

chmod +x /etc/init.d/elasticsearch
chkconfig elasticsearch
service elasticsearch start

安装插件

./bin/plugin install mobz/elasticsearch-head //head插件
git clone https://github.com/medcl/elasticsearch-analysis-ik.git --depth=1 //IK分词插件
./bin/plugin install lmenezes/elasticsearch-kopf/{branch|version}

配置Nginx

upstream es_cluster {
    server 10.20.20.201:9200;
    server 10.20.20.202:9200;
    server 10.20.20.203:9200;
    server 10.20.20.204:9200;
    keepalive 15;
}

upstream kibana4 {
    server 10.20.20.201:5601 fail_timeout=0;
}

server {
    listen 8360;
    server_name  es.xxx.com;
    access_log   /data/nginx/logs/es.log;
    error_log    /data/nginx/logs/es.error.log;

    location ~ (/app/kibana|/bundles/|/kibana4|/status|/plugins|/api/status/|/elasticsearch|/app/sense) {
        proxy_pass http://kibana4;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Connection "Keep-Alive";
        proxy_set_header Proxy-Connection "Keep-Alive";
        rewrite /kibana4/(.*)$ /$1 break;
    }

    location / {
        proxy_pass http://es_cluster;
        proxy_set_header     X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header     Host            $host;
    }
}