Elasticsearch、Kibana 的部署安装（7.17.3）
Elasticsearch
历史版本 releases：
https://www.elastic.co/cn/downloads/past-releases#elasticsearch
解压，并启动服务：
tar zxf elasticsearch-7.17.3-linux-x86_64.tar.gz
cd elasticsearch-7.17.3
bin/elasticsearch
异常提示，不可使用 root 用户启动：
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
处理方式，创建用户并赋权，再切换用户启动：
useradd es
passwd es
chown -R es elasticsearch-7.17.3
su es
bin/elasticsearch
异常提示，下载 GeoIP2 数据库失败（如果你的网络无法访问）：
exception during geoip databases update
java.net.SocketTimeoutException: Read timed out
处理方式，修改配置文件：
vi config/elasticsearch.yml
添加配置：
ingest.geoip.downloader.enabled: false
异常提示，进程的最大文件描述符大小需要 65535：
max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
处理方式，修改配置文件：
vi /etc/security/limits.conf
添加或修改配置：
# 注意 /etc/security/limits.d/ 下配置会覆盖 /etc/security/limits.conf
* soft nofile 65535
* hard nofile 65535
异常提示，最大虚拟内存太小：
max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
处理方式，修改配置文件：
vi /etc/sysctl.conf
添加或修改配置：
vm.max_map_count = 262144
让内核参数立即生效：
sysctl -p
异常提示，没有对发现进行配置，至少需要配置一个：
the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured
处理方式，修改配置文件：
vi config/elasticsearch.yml
添加或修改配置：
# 集群名称
cluster.name: es-94
# 节点名称
node.name: node-94
# 启动地址，可以配置为 0.0.0.0
network.host: 192.168.1.94
# 对外端口
http.port: 9200
# 节点列表
discovery.seed_hosts: ["192.168.1.94"]
# 初始化时 master 节点的选举列表
cluster.initial_master_nodes: ["node-94"]
# 跨域支持
http.cors.enabled: true
http.cors.allow-origin: "*"
http.cors.allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
http.cors.allow-headers: X-Requested-With,X-Auth-Token,Content-Type,Content-Length
http.cors.allow-credentials: true
集群配置：
- node.name：各自定义
- discovery.seed_hosts：填写全部节点
- cluster.initial_master_nodes：填写若干节点，且该项不需要在每个节点中都配置
查看集群健康状态：
http://ip:9200/_cluster/health
如果需要开启安全功能：
vi config/elasticsearch.yml
# 添加配置
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
https://www.elastic.co/guide/en/c/reference/current/security-settings.html
重启服务后设置账号密码：
bin/elasticsearch-setup-passwords interactive
# 设置密码
Enter password for [elastic]:
Reenter password for [elastic]:
Enter password for [apm_system]:
Reenter password for [apm_system]:
Enter password for [kibana_system]:
Reenter password for [kibana_system]:
Enter password for [logstash_system]:
Reenter password for [logstash_system]:
Enter password for [beats_system]:
Reenter password for [beats_system]:
Enter password for [remote_monitoring_user]:
Reenter password for [remote_monitoring_user]:
Changed password for user [apm_system]
Changed password for user [kibana_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]
请求时使用账号密码：
curl -u elastic http://ip:9200/_cat/indices
curl -u elastic:password http://ip:9200/_cat/indices
修改密码：
curl -XPOST -u elastic http://ip:9200/_security/user/elastic/_password -H "Content-Type:application/json" -d "{\"password\":\"new_password\"}"
忘记密码时：
取消认证，删除
elasticsearch.yml中对应两项，然后重启服务删除
.security-x的 index，回到无密码认证状态# 查找具体 index curl http://ip:9200/_cat/indices | grep ".security" # 删除 curl -XDELETE http://localhost:9200/.security-x
使用中文分词器：
https://github.com/medcl/elasticsearch-analysis-ik
cd plugins
mkdir analysis-ik
cd analysis-ik
unzip elasticsearch-analysis-ik-7.17.3.zip
解压后重启服务。
作为守护进程运行：
./bin/elasticsearch -d -p pid
pkill -F pid
其他安装形式对应的启动方式：
https://www.elastic.co/guide/en/elasticsearch/reference/7.17/starting-elasticsearch.html
Kibana
历史版本 releases：
https://www.elastic.co/cn/downloads/past-releases#kibana
解压：
tar zxf kibana-7.17.3-linux-x86_64.tar.gz
cd kibana-7.17.3-linux-x86_64
修改配置文件：
vi config/kibana.yml
完善 elasticsearch 节点信息：
# 服务端口
server.port: 5601
# 启动地址，可以配置为 0.0.0.0
server.host: 192.168.1.94
# 服务名称
server.name: "Kibana-94"
# elasticsearch 集群地址
elasticsearch.hosts: ["http://192.168.1.94:9200"]
# 如果 elasticsearch 配置了账号密码，则需要填写
elasticsearch.username: "kibana_system"
elasticsearch.password: "pass"
为 es 赋权并启动：
chown -R es kibana-7.17.3-linux-x86_64
nohup bin/kibana &