install

• k8ssn125

[root@k8sn125 opt]# curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.5.2.tar.gz
...
[root@k8sn125 opt]# tar -xvf elasticsearch-6.5.2.tar.gz
[root@k8sn125 opt]# cd elasticsearch-6.5.2
[root@k8sn125 elasticsearch-6.5.2]# mkdir esData
[root@k8sn125 elasticsearch-6.5.2]# mkdir esData/data
[root@k8sn125 elasticsearch-6.5.2]# mkdir esData/logs
[root@k8sn125 elasticsearch-6.5.2]# cd ..

[root@k8sn125 opt]# scp -r elasticsearch-6.5.2 root@hostname:/opt/
...

• all node

[root@nodename opt]# groupadd es
[root@nodename opt]# useradd es
[root@nodename opt]# passwd es
...
[root@nodename opt]# chown -R es:es elasticsearch-6.5.2/

elasticsearch config

• 其中一个作为示例

[root@nodename opt]# su es
[root@nodename opt]# cd elasticsearch-6.5.2
[es@k8sn125 elasticsearch-6.5.2]$ mv config/elasticsearch.yml config/elasticsearch.yml_bak
[es@k8sn125 elasticsearch-6.5.2]$ vim config/elasticsearch.yml

# ---------------------------------- Cluster -----------------------------------
# Use a descriptive name for your cluster:
cluster.name: ELK
# ------------------------------------ Node ------------------------------------
# Use a descriptive name for the node:
node.name: node-125
# Add custom attributes to the node:
#node.attr.rack: r1
# ----------------------------------- Paths ------------------------------------
# Path to directory where to store the data (separate multiple locations by comma):
path.data: /opt/elasticsearch-6.5.2/esData/data/
# Path to log files:
path.logs: /opt/elasticsearch-6.5.2/esData/logs/
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
bootstrap.memory_lock: false
# myself config
bootstrap.system_call_filter: false

# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 172.20.32.125
#
# Set a custom port for HTTP:
#
http.port: 9200
transport.tcp.port: 9300
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.zen.ping.unicast.hosts: ["172.20.32.125:9300", "172.20.32.126:9300","172.20.32.134:9300"]
#
# Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1):
#
discovery.zen.minimum_master_nodes: 2
#
# For more information, consult the zen discovery module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
#
# myself config

启动

• all node

[es@k8sn125 elasticsearch-6.5.2]$ bin/elasticsearch
#后台启动
[es@k8sn125 elasticsearch-6.5.2]$ bin/elasticsearch -d

Error

• 1.org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root

[2018-12-10T15:42:59,865][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [node-125] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:140) ~[elasticsearch-6.5.2.jar:6.5.2]
	at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127) ~[elasticsearch-6.5.2.jar:6.5.2]
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.5.2.jar:6.5.2]
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.5.2.jar:6.5.2]
	at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.5.2.jar:6.5.2]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93) ~[elasticsearch-6.5.2.jar:6.5.2]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86) ~[elasticsearch-6.5.2.jar:6.5.2]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
	at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:103) ~[elasticsearch-6.5.2.jar:6.5.2]
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:170) ~[elasticsearch-6.5.2.jar:6.5.2]
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:333) ~[elasticsearch-6.5.2.jar:6.5.2]
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) ~[elasticsearch-6.5.2.jar:6.5.2]
	... 6 more

解决方法：
进入es用户再启动

注：要保证elasticsearch-6.5.2整个目录都是es有权限 eg：

drwxr-xr-x  3 es es   4096 12月 10 14:20 bin
drwxr-xr-x  2 es es   4096 12月 10 16:11 config
drwxrwxr-x  4 es es     28 12月 10 14:22 esData
drwxr-xr-x  3 es es   4096 11月 30 08:02 lib
-rw-r--r--  1 es es  13675 11月 30 07:55 LICENSE.txt
drwxr-xr-x  2 es es     29 12月 10 14:52 logs
drwxr-xr-x 28 es es   4096 11月 30 08:02 modules
-rw-r--r--  1 es es 403816 11月 30 08:01 NOTICE.txt
drwxr-xr-x  2 es es      6 11月 30 08:01 plugins
-rw-r--r--  1 es es   8519 11月 30 07:55 README.textile

• 2.ERROR: [1] bootstrap checks failed

[2018-12-10T15:28:18,576][INFO ][o.e.b.BootstrapChecks    ] [node-125] bound or publishing to a non-loopback address, enforcing bootstrap checks
ERROR: [1] bootstrap checks failed
[1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[2018-12-10T15:28:18,589][INFO ][o.e.n.Node               ] [node-125] stopping ...
[2018-12-10T15:28:18,634][INFO ][o.e.n.Node               ] [node-125] stopped

解决方法：从日志中看到重要信息max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

查看

sysctl -a|grep vm.max_map_count

更改

sysctl -w vm.max_map_count=262144

永久更改

vim /etc/sysctl.conf
#添加
vm.max_map_count=262144
使修改生效
sysctl -p