Linux部署ElasticSearch+Kibana及踩坑

安装ElasticSearch：

1. 下载ElasticSearch

• ElasticSearch 7.7.1已上传我的个人云盘，点击下载 点这里
  • 官方下载网址：https://www.elastic.co/cn/downloads/elasticsearch

    2. 解压elasticsearch-7.7.1-linux-x86_64.tar.gz到/usr/local/目录

    tar -zxvf elasticsearch-7.7.1-linux-x86_64.tar.gz -C /usr/local/

3. 进入bin目录，运行ElasticSearch

cd /usr/local/elasticsearch-7.7.1/bin
./elasticSearch

4. 常见异常解决

异常信息:

Exception in thread "main" java.lang.RuntimeException: starting java failed with [1]
output:
#
# There is insufficient memory for the Java Runtime Environment to continue.
# Native memory allocation (mmap) failed to map 986513408 bytes for committing reserved memory.
# An error report file with more information is saved as:
# logs/hs_err_pid24201.log
error:
Java HotSpot(TM) 64-Bit Server VM warning: INFO: os::commit_memory(0x00000000c5330000, 986513408, 0) failed; error='Cannot allocate memory' (errno=12)
	at org.elasticsearch.tools.launchers.JvmErgonomics.flagsFinal(JvmErgonomics.java:126)
	at org.elasticsearch.tools.launchers.JvmErgonomics.finalJvmOptions(JvmErgonomics.java:88)
	at org.elasticsearch.tools.launchers.JvmErgonomics.choose(JvmErgonomics.java:59)
	at org.elasticsearch.tools.launchers.JvmOptionsParser.jvmOptions(JvmOptionsParser.java:139)
	at org.elasticsearch.tools.launchers.JvmOptionsParser.main(JvmOptionsParser.java:95)

解决：
编辑config文件夹中的jvm.options文件

cd /usr/local/elasticsearch-7.7.1/config
vim /jvm.options
修改默认的1g为128m：
	-Xms128m
	-Xmx128m

异常信息:

org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:174) ~[elasticsearch-7.7.1.jar:7.7.1]
	at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161) ~[elasticsearch-7.7.1.jar:7.7.1]
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.7.1.jar:7.7.1]
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:127) ~[elasticsearch-cli-7.7.1.jar:7.7.1]
	at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-7.7.1.jar:7.7.1]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126) ~[elasticsearch-7.7.1.jar:7.7.1]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-7.7.1.jar:7.7.1]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
	at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:111) ~[elasticsearch-7.7.1.jar:7.7.1]
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:178) ~[elasticsearch-7.7.1.jar:7.7.1]
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:393) ~[elasticsearch-7.7.1.jar:7.7.1]
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.7.1.jar:7.7.1]
	... 6 more
uncaught exception in thread [main]
java.lang.RuntimeException: can not run elasticsearch as root
	at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:111)
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:178)
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:393)
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170)
	at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161)
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:127)
	at org.elasticsearch.cli.Command.main(Command.java:90)
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126)
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92)
For complete error details, refer to the log at /usr/local/elasticsearch-7.7.1/logs/elasticsearch.log
[root@iZuf65vg2nr3x1h1yzuyq1Z bin]# 2020-06-09 09:59:40,887430 UTC [25753] ERROR CNamedPipeFactory.cc@224 Unable to open named pipe /tmp/elasticsearch-48021366/controller_log_25625 for writing: Interrupted system call
2020-06-09 09:59:40,887543 UTC [25753] ERROR CLogger.cc@298 Cannot log to named pipe /tmp/elasticsearch-4802127868216853366/controller_log_25625 as it couldned for writing
2020-06-09 09:59:40,887558 UTC [25753] FATAL Main.cc@102 Could not reconfigure logging

解决：

• 新建用户组groupadd esgroup
• 新增用户useradd esroot -g esgroup -p esroot
• 设置权限chown -R esroot:esgroup /usr/local/elasticsearch-7.7.1
• 切换权限su esroot
• 运行elasticsearch./usr/local/elasticsearch-7.7.1/bin/elasticsearch

异常信息:

ERROR: [2] bootstrap checks failed
[1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[2]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured

解决：
问题1：sudo sysctl -w vm.max_map_count=262144
问题2：修改elasticsearch.yml，取消注释保留一个节点
cluster.initial_master_nodes: ["node-1"]

测试本地访问：curl localhost:9200

5. 远程访问elasticsearch

默认情况下，Elasticsearch 只允许本机访问，如果需要远程访问，需修改 Elasticsearch 安装目录中的config/elasticsearch.yml文件，将network.host的值改成0.0.0.0。

vim /usr/local/elasticsearch-7.7.1/config/elasticsearch.yml
修改为：
  network.host: 0.0.0.0
  http.port: 9200

开放9200端口（注意：我使用的是centos7.3的版本，防火墙是firewall）：
firewall-cmd --zone=public --add-port=9200/tcp --permanent
重启防火墙：firewall-cmd --reload
查看端口是否开启：firewall-cmd --query-port=9200/tcp

如果是阿里云的服务器 ， 还需进入服务器管理控制台，给防火墙9200端口号添加规则

远程访问9200端口：

---

安装Kibana：

1. 下载Kibana，版本要与ElasticSearch一致

• Kibana7.7.1已上传我的个人云盘，点击下载 点这里
  • 官方下载网址：https://www.elastic.co/cn/downloads/kibana

    2. 解压kibana-7.7.1-linux-x86_64.tar.gz到/usr/local/目录

    tar -zxvf kibana-7.7.1-linux-x86_64.tar.gz -C /usr/local/

3. 打开kibana.yml配置文件，修改配置

vim /usr/local/kibana-7.7.1-linux-x86_64/config/kibana.yml

server.port: 5601
server.host: "0.0.0.0"
# 之前的一些版本是这个 elasticsearch.url: "http://47.100.105.124:9200"
elasticsearch.hosts: ["http://47.100.105.124:9200"]

4. 开放5601端口(参考上面9200端口)

5. 进入bin目录，运行Kibana

cd /usr/local/kibana-7.7.1-linux-x86_64/bin
./kibana

---

运行Kibana异常i情况：

log   [05:21:32.045] [error][admin][elasticsearch] Request error, retrying
POST http://47.100.105.124:9200/.kibana/_search?ignore_unavailable=true&filter_path=aggregations.types.buckets => socket hang up
  log   [05:21:32.049] [error][admin][elasticsearch] Request error, retrying
GET http://47.100.105.124:9200/.kibana/doc/config%3A6.4.3 => connect ECONNREFUSED 47.100.105.124:9200
  log   [05:21:32.054] [error][admin][elasticsearch] Request error, retrying
POST http://47.100.105.124:9200/.reporting-*/_search?filter_path=hits.total%2Caggregations.jobTypes.buckets%2Caggregations.objectTypes.buckets%2Caggregations.layoutTypes.buckets%2Caggregations.statusTypes.buckets => connect ECONNREFUSED 47.100.105.124:9200
  log   [05:21:32.064] [error][elasticsearch][monitoring-ui] Request error, retrying
GET http://47.100.105.124:9200/_xpack => socket hang up
  log   [05:21:32.065] [error][admin][elasticsearch] Request error, retrying
HEAD http://47.100.105.124:9200/ => connect ECONNREFUSED 47.100.105.124:9200
  log   [05:21:32.067] [warning][admin][elasticsearch] Unable to revive connection: http://47.100.105.124:9200/
  log   [05:21:32.067] [warning][admin][elasticsearch] No living connections

如果运行kibana的时候，出现连接ES异常，ES可能是被kill，说明内存不足，需要调低ES jvm.options中的内存参数，当出现kibana运行时被kill，则需要优化kibana内存，将可执行文件kibanad的NODE_OPTIONS中加入--max_old_space_size=200，数值可以适当调整，然后重新运行即可。

NODE_OPTIONS="--no-warnings --max-http-header-size=65536 ${NODE_OPTIONS} --max-old-space-size=200"