ELKElasticsearch 8.7单节点配置、安装和运行

时间来到了2023年4月，今天和大家一起研究下在虚拟机安装Elasticsearch 8.7.0单节点。

首先，就是一个很熟悉的报错

1.  
   # ./elasticsearch
2.  
   [2023-04-07T11:53:16,972][ERROR][o.e.b.Elasticsearch ] [vm-fsdh23re9ff] fatal exception while booting Elasticsearchjava.lang.RuntimeException: can not run elasticsearch as root
3.  
   at org.elasticsearch.server@8.7.0/org.elasticsearch.bootstrap.Elasticsearch.initializeNatives(Elasticsearch.java:262)
4.  
   at org.elasticsearch.server@8.7.0/org.elasticsearch.bootstrap.Elasticsearch.initPhase2(Elasticsearch.java:161)
5.  
   at org.elasticsearch.server@8.7.0/org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:66)
6.  
    
7.  
   See logs for more details.
8.  
    
9.  
   ERROR: Elasticsearch did not exit normally - check the logs at /app/elasticsearch-8.7.0/logs/elasticsearch.log
10.  
     
11.  
    ERROR: Elasticsearch exited unexpectedly

嗯，许久不碰es了，忘了不能使用root用户运行了。赶紧创建一个普通用户……

1.  
   # groupadd app
2.  
    
3.  
   # useradd -d /app -g app app
4.  
    
5.  
   # chown -R app:app /app

关于elasticsearch.yml的配置，8.7.0版本默认启用了xpack.security认证。

1.  
   -bash-4.2$ grep -v "#" elasticsearch.yml
2.  
   cluster.name: mycluster
3.  
   node.name: node-1
4.  
   path.data: /app/elasticsearch-8.7.0/data
5.  
   path.logs: /app/elasticsearch-8.7.0/logs
6.  
   bootstrap.memory_lock: false
7.  
   network.host: 192.168.223.199
8.  
   http.port: 9200
9.  
    
10.  
     
11.  
    xpack.security.enabled: true
12.  
     
13.  
    xpack.security.enrollment.enabled: true
14.  
     
15.  
    xpack.security.http.ssl:
16.  
    enabled: true
17.  
    keystore.path: certs/http.p12
18.  
     
19.  
    xpack.security.transport.ssl:
20.  
    enabled: true
21.  
    verification_mode: certificate
22.  
    keystore.path: certs/transport.p12
23.  
    truststore.path: certs/transport.p12
24.  
    cluster.initial_master_nodes: ["vm-fsdh23re9ff"]
25.  
     
26.  
    http.host: 0.0.0.0

再次启动，又出现两个报错：1）文件句柄数设置太小；2）最大虚拟内存设置太小。

1.  
   [2023-04-07T14:25:36,912][INFO ][o.e.b.BootstrapChecks ] [node-1] bound or publishing to a non-loopback address, enforcing bootstrap checks
2.  
   [2023-04-07T14:25:36,930][ERROR][o.e.b.Elasticsearch ] [node-1] node validation exception
3.  
   [2] bootstrap checks failed. You must address the points described in the following [2] lines before starting Elasticsearch.
4.  
   bootstrap check failure [1] of [2]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
5.  
   bootstrap check failure [2] of [2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
6.  
   [2023-04-07T14:25:36,934][INFO ][o.e.n.Node ] [node-1] stopping ...
7.  
   [2023-04-07T14:25:36,968][INFO ][o.e.n.Node ] [node-1] stopped
8.  
   [2023-04-07T14:25:36,969][INFO ][o.e.n.Node ] [node-1] closing ...
9.  
   [2023-04-07T14:25:36,986][INFO ][o.e.n.Node ] [node-1] closed
10.  
    [2023-04-07T14:25:36,991][INFO ][o.e.x.m.p.NativeController] [node-1] Native controller process has stopped - no new native processes can be started

修改系统最大文件句柄数（修改后需要重启系统才能生效）

1.  
   # vi /etc/security/limits.conf
2.  
   * soft nproc 65535
3.  
   * hard nproc 65535
4.  
   * soft nofile 65535
5.  
   * hard nofile 65535
6.  
    
7.  
   # vi /etc/security/limits.d/20-nproc.conf
8.  
   * soft nproc 65535
9.  
   root soft nproc 65535
10.  
     
11.  
    # reboot
12.  
     
13.  
    # ulimit -n
14.  
    65535

修改最大虚拟内存

1.  
   # vi /etc/sysctl.conf
2.  
   vm.max_map_count=655360

使用后台方式启动

1.  
   $ cd /app/elasticsearch-8.7.0/bin
2.  
   $ ./elasticsearch -d

启动后，使用浏览器测试访问，弹出登陆框，查询了下，原来需要重置elastic用户密码

1.  
   $ cd /app/elasticsearch-8.7.0/bin
2.  
    
3.  
   $ ./elasticsearch-reset-password --username elastic
4.  
   This tool will reset the password of the [elastic] user to an autogenerated value.
5.  
   The password will be printed in the console.
6.  
   Please confirm that you would like to continue [y/N]y
7.  
    
8.  
    
9.  
   Password for the [elastic] user successfully reset.
10.  
    New value: WRRr6nNEYm423uBPzIzW

登录成功

这篇好文章是转载于：学新通技术网