1. 安装配置JDK 8

（1）下载并解压缩

[root@node1 ~]# tar -zxvf jdk-8u112-linux-x64.tar.gz -C /opt

（2）编辑环境变量 
vi /etc/profile.d/custom.sh

[root@node1 ~]# vi /etc/profile.d/custom.sh
[root@node1 ~]# cat /etc/profile.d/custom.sh
#!/bin/bash
#java path
export JAVA_HOME=/opt/jdk1.8.0_112
export PATH=$PATH:$JAVA_HOME/bin
export CLASSPATH=.:$CLASSPATH:$JAVA_HOME/lib

（3）生效

[root@node1 ~]# source /etc/profile.d/custom.sh

（4）查看JDK版本

[root@node1 ~]# java -version
java version "1.8.0_112"
Java(TM) SE Runtime Environment (build 1.8.0_112-b15)
Java HotSpot(TM) 64-Bit Server VM (build 25.112-b15, mixed mode)
[root@node1 ~]#

2. 创建用户

从5.0开始，ElasticSearch 安全级别提高了，不允许采用root帐号启动，所以我们要添加一个用户。

（1）创建bigdata 用户组

[root@node1 ~]# groupadd bigdata

（2）创建用户es

[root@node1 ~]# useradd es
[root@node1 ~]# passwd es
Changing password for user es.
New password:
BAD PASSWORD: The password is shorter than 8 characters
Retype new password:
passwd: all authentication tokens updated successfully.
[root@node1 ~]#

（3）将es用户添加到bigdata组

[root@node1 ~]# usermod -G bigdata es

（4）设置sudo权限

[root@node1 ~]# visudo

找到root ALL=(ALL) ALL一行，添加es用户，如下。

## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
es      ALL=(ALL)       ALL

（5）切换用户

[root@node1 ~]# su es
[es@node1 root]$ cd
[es@node1 ~]$ 

3. ElasticSearch 6.x 软件包下载

（1）ElasticSearch官网 
https://www.elastic.co/cn/downloads

（2）下载ElasticSearch 
https://www.elastic.co/downloads/elasticsearch

[es@node1 ~]$ wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.1.1.tar.gz
--2018-01-06 08:24:06--  https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.1.1.tar.gz
Resolving artifacts.elastic.co (artifacts.elastic.co)... 54.225.188.6, 54.243.108.41, 184.72.218.26, ...
Connecting to artifacts.elastic.co (artifacts.elastic.co)|54.225.188.6|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 28462503 (27M) [application/x-gzip]
Saving to: ‘elasticsearch-6.1.1.tar.gz.1’100%[===================================================================================================================================================>] 28,462,503   232KB/s   in 3m 33s 2018-01-06 08:27:42 (130 KB/s) - ‘elasticsearch-6.1.1.tar.gz.1’ saved [28462503/28462503][es@node1 ~]$

（3）解压缩 
tar -zxvf elasticsearch-6.1.1.tar.gz

[es@node1 ~]$ tar -zxvf elasticsearch-6.1.1.tar.gz

[es@node1 ~]$ sudo mv elasticsearch-6.1.1 /opt

（4）修改目录权限 
更改elasticsearch-6.1.1文件夹以及内部文件的所属用户为es, 用户组组为bigdata，-R表示逐级（N层目录）

[es@node1 ~]$ sudo chown -R es:bigdata /opt/elasticsearch-6.1.1
[es@node1 ~]$ ll /opt/elasticsearch-6.1.1
total 220
drwxr-xr-x  2 es bigdata   4096 Jan  6 08:35 bin
drwxr-xr-x  2 es bigdata     75 Dec 17 15:24 config
drwxr-xr-x  2 es bigdata   4096 Dec 17 15:24 lib
-rw-r--r--  1 es bigdata  11358 Dec 17 15:22 LICENSE.txt
drwxr-xr-x 15 es bigdata    272 Dec 17 15:24 modules
-rw-r--r--  1 es bigdata 191887 Dec 17 15:24 NOTICE.txt
drwxr-xr-x  2 es bigdata      6 Dec 17 15:24 plugins
-rw-r--r--  1 es bigdata   9326 Dec 17 15:22 README.textile
[es@node1 ~]$

4. ElasticSearch 配置

（1）修改elasticsearch.yml

[es@node1 elasticsearch-6.1.1]$ vi config/elasticsearch.yml

修改network.host和http.port

# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 192.168.80.131
#
# Set a custom port for HTTP:
#
http.port: 9200
bootstrap.memory_lock: false
bootstrap.system_call_filter: false

保存退出。

修改线程数threads

vi /etc/security/limits.d/90-nproc.conf* soft nproc 1024#修改为* soft nproc 2048

（2）修改/etc/sysctl.conf 
切换到root用户，

[root@node1 elasticsearch-6.1.1]# vi /etc/sysctl.conf

添加内容如下：

vm.max_map_count=262144

用命令sysctl -p 生效

[root@node1 ~]# sysctl -p
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
vm.max_map_count = 262144
[root@node1 ~]# 

（3）修改文件/etc/security/limits.conf

[root@node1 logs]# vi /etc/security/limits.conf

添加如下内容

* hard nofile 65536
* soft nofile 65536* soft nproc 4096
* hard nproc 4096# End of file

5.ElasticSearch启动与停止

（1）直接启动

[es@node1 elasticsearch-6.1.1]$ bin/elasticsearch

（2）停止 
ctrl+c停止。

^C[2018-01-06T08:55:24,513][INFO ][o.e.n.Node               ] [cNWkQjt] stopping ...

（3）后台运行 
可以通过参数-d后台运行

[es@node1 elasticsearch-6.1.1]$ bin/elasticsearch -d

（4）查询进程

[es@node1 elasticsearch-6.1.1]$ jps
3120 Elasticsearch
3135 Jps
[es@node1 elasticsearch-6.1.1]$

6. 验证

（1）使用curl验证

[es@node1 elasticsearch-6.1.1]$ curl http://192.168.80.131:9200
{"name" : "cNWkQjt","cluster_name" : "elasticsearch","cluster_uuid" : "Kd_e-tqxSx20dl_HjAt1ZQ","version" : {"number" : "6.1.1","build_hash" : "bd92e7f","build_date" : "2017-12-17T20:23:25.338Z","build_snapshot" : false,"lucene_version" : "7.1.0","minimum_wire_compatibility_version" : "5.6.0","minimum_index_compatibility_version" : "5.0.0"},"tagline" : "You Know, for Search"
}
[es@node1 elasticsearch-6.1.1]$

（2）浏览器验证 
http://node1:9200/

 
如果在Windows平台通过浏览器打开，需要配置hosts。编辑C:\Windows\System32\drivers\etc\hosts 
添加

192.168.80.131  node1

6.问题解决

（1）jps看不到Java进程

[es@node1 elasticsearch-6.1.1]$ bin/elasticsearch -d
[es@node1 elasticsearch-6.1.1]$ jps
[es@node1 elasticsearch-6.1.1]$ jps
[es@node1 elasticsearch-6.1.1]$ ps -aux|grep elasticsearch
es         2930  125 65.2 3627480 1218920 pts/0 Sl   09:33   0:15 /opt/jdk1.8.0_112/bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+AlwaysPreTouch -server -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -XX:+HeapDumpOnOutOfMemoryError -Des.path.home=/opt/elasticsearch-6.1.1 -Des.path.conf=/opt/elasticsearch-6.1.1/config -cp /opt/elasticsearch-6.1.1/lib/* org.elasticsearch.bootstrap.Elasticsearch -d
es         2998  0.0  0.0 112660   968 pts/0    S+   09:33   0:00 grep --color=auto elasticsearch
[es@node1 elasticsearch-6.1.1]$

查找原因

[es@node1 ~]$ ll /tmp
total 0
drwxr-xr-x 2 1000 1000   6 Jan  5 10:28 hsperfdata_es
drwxr-xr-x 2 root root   6 Jan  6 08:56 hsperfdata_root
drwxrwxr-x 2 1000 1000   6 Jan  5 10:21 jna-3246
drwxrwxr-x 3 1000 1000  32 Jan  5 09:40 npm-2339-f258bfea
drwxr-xr-x 3 root root  37 Jan  5 09:46 npm-2381-44b2a32e
drwxrwxr-x 3 es   es    37 Jan  6 02:21 npm-2404-e0646f46
drwxrwxr-x 2 es   es     6 Jan  6 02:24 npm-2416-56232d2b
drwxr-xr-x 3 root root  37 Jan  6 02:25 npm-2427-ac7dea5c
drwxrwxr-x 3 1000 1000  32 Jan  5 09:54 npm-2466-3358fd28
drwxrwxr-x 3 1000 1000  37 Jan  5 10:09 npm-2590-5ae8499b
drwxrwxrwx 5 1000 1000 202 Jan  6 02:27 phantomjs
drwx------ 3 root root  17 Jan  6 09:12 systemd-private-3333a83cac6947c59f5bb80f042de342-vmtoolsd.service-nRUgwa
[es@node1 ~]$

原因是当前es用户没有/tmp/hsperfdata_es目录的写权限。 
解决办法：

[root@node1 ~]# chown -R es:es /tmp/hsperfdata_es

• 1