前提是先安装jdk，最好是jdk11（部署略过，可以参考https://blog.csdn.net/qq_41788609/article/details/108361975）
1、下载安装包：
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.9.0-linux-x86_64.tar.gz
2、部署：
#创建部署目录
mkdir -p /home/elk
#解压
tar -xf elasticsearch-7.9.0-linux-x86_64.tar.gz
mv elasticsearch-7.9.0 /home/elk/
#创建用户
groupadd elasticsearch
useradd elasticsearch -g elasticsearch
#创建数据存储路劲和日志存放路径
mkdir -p /data/elasticsearch/{data,logs}
3、修改配置：
vim /home/elk/elasticsearch-7.9.0/config/elasticsearch.yml 配置内容在后面
4、启动（不能用root启动）：
chown -R elasticsearch. /data/elasticsearch/ chown -R elasticsearch. /home/elk/ su - elasticsearch cd /home/elk/elasticsearch-7.9.0/bin ./elasticsearch -d
5、查询集群状态：
curl 'localhost:9200/_cluster/health?pretty'
6、查看端口号，分别为9200和9300
ss -ntulp| egrep "9200|9300"
7、配置文件内容：
节点1：
cluster.name: elk node.name: node1 node.master: true node.data: true http.cors.enabled: true http.cors.allow-origin: /.*/ path.data: /data/elasticsearch/data path.logs: /data/elasticsearch/logs network.host: 0.0.0.0 http.port: 9200 discovery.seed_hosts: ["192.168.245.233", "192.168.245.237", "192.168.245.238"] cluster.initial_master_nodes: ["node1", "node2","node3"]
节点2：
cluster.name: elk node.name: node2 node.master: true node.data: true http.cors.enabled: true http.cors.allow-origin: /.*/ path.data: /data/elasticsearch/data path.logs: /data/elasticsearch/logs network.host: 0.0.0.0 http.port: 9200 discovery.seed_hosts: ["192.168.245.233", "192.168.245.237", "192.168.245.238"] cluster.initial_master_nodes: ["node1", "node2","node3"]
节点3
cluster.name: elk node.name: node3 node.master: true node.data: true http.cors.enabled: true http.cors.allow-origin: /.*/ path.data: /data/elasticsearch/data path.logs: /data/elasticsearch/logs network.host: 0.0.0.0 http.port: 9200 discovery.seed_hosts: ["192.168.245.233", "192.168.245.237", "192.168.245.238"] cluster.initial_master_nodes: ["node1", "node2","node3"]
8、启动报错：
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535] [2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
需要配置/etc/security/limits.conf和/etc/sysctl.conf，在末尾加上如下内容
vim /etc/security/limits.conf * soft nofile 65536 * hard nofile 65536 * soft nproc 4096 * hard nproc 4096
vim /etc/sysctl.conf vm.max_map_count=262144
配置重新生效
sysctl -p
9、安装elasticsearch-head插件
安装nodejs：
wget https://nodejs.org/dist/v16.13.0/node-v16.13.0-linux-x64.tar.xz tar -xvf node-v16.13.0-linux-x64.tar.xz mv node-v16.13.0-linux-x64 /usr/local/ vim /etc/profile #加上环境变量 export PATH=$PATH:/usr/local/node-v16.13.0-linux-x64/bin #验证 node -v
安装elasticsearch-head
yum install git git clone https://github.com/mobz/elasticsearch-head.git mv elasticsearch-head/ /home/elk/ cd /home/elk/elasticsearch-head/ cd elasticsearch-head/ npm install #可能报错，执行下面语句 npm install phantomjs-prebuilt@2.1.16 --ignore-scripts #启动 nohup npm run start &
网页访问9100端口即可
