---

前言

上一篇簡(jiǎn)單了解了一下 Elasticsearch 的發(fā)展史，特性和使用場(chǎng)景，為了方便接下來(lái)的數(shù)據(jù)測(cè)試，本篇內(nèi)容先開(kāi)始安裝 Elasticsearch。

官網(wǎng)下載

---

一、Linux 安裝

1、下載安裝包

⑴、選擇需要的安裝包

進(jìn)入 官網(wǎng) 選擇自己需要版本，我這里選擇 Linux x86_64：

登錄服務(wù)器查看系 Linux 內(nèi)核版本：

a[root@VM-0-12-centos ~]# arch
x86_64
[root@VM-0-12-centos ~]# uname -a
Linux VM-0-12-centos 3.10.0-1160.71.1.el7.x86_64 #1 SMP Tue Jun 28 15:37:28 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

⑵、下載解壓到安裝目錄

進(jìn)入 /usr/local/ 目錄，這個(gè)目錄是我的安裝目錄，根據(jù)自己的習(xí)慣選擇，下載安裝包并解壓：

[root@VM-0-12-centos ~]# cd /usr/local/
[root@VM-0-12-centos local]# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.6.1-linux-x86_64.tar.gz
--2023-02-14 09:45:52--  https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.6.1-linux-x86_64.tar.gz
Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130, 2600:1901:0:1d7::
Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 581763080 (555M) [application/x-gzip]
Saving to: ‘elasticsearch-8.6.1-linux-x86_64.tar.gz’100%[=====================================================================>] 581,763,080 12.2MB/s   in 46s    2023-02-14 09:46:38 (12.2 MB/s) - ‘elasticsearch-8.6.1-linux-x86_64.tar.gz’ saved [581763080/581763080][root@VM-0-12-centos local]# tar -zvxf elasticsearch-8.6.1-linux-x86_64.tar.gz 
[root@VM-0-12-centos local]# rm -f elasticsearch-8.6.1-linux-x86_64.tar.gz 
[root@VM-0-12-centos local]# ll -a
total 80
drwxr-xr-x. 20 root  root  4096 Feb 14 14:11 .
drwxr-xr-x. 13 root  root  4096 Aug  8  2018 ..
drwxr-xr-x.  2 root  root  4096 Dec 21 16:33 bin
drwxr-xr-x   9 root  root  4096 Jan 25 05:47 elasticsearch-8.6.1
drwxr-xr-x.  2 root  root  4096 Apr 11  2018 etc
drwxr-xr-x   6 root  root  4096 Dec 21 16:21 freetype
drwxr-xr-x.  2 root  root  4096 Apr 11  2018 games
drwxr-xr-x.  3 root  root  4096 Dec 21 16:23 include
drwxr-xr-x.  4 root  root  4096 Dec 21 16:23 lib
drwxr-xr-x.  2 root  root  4096 Apr 11  2018 lib64
drwxr-xr-x.  2 root  root  4096 Apr 11  2018 libexec
drwxr-xr-x   3 root  root  4096 Dec 21 16:20 man
drwxr-xr-x  10 mysql mysql 4096 Dec 21 16:22 mysql
drwxr-xr-x  11 root  root  4096 Dec 22 10:40 mysql-master-slave
drwxr-xr-x  11 root  root  4096 Dec 21 16:37 nginx
drwxr-xr-x  10 root  root  4096 Dec 21 16:33 php
drwxr-xr-x  17 root  root  4096 Dec 21 16:07 qcloud
drwxr-xr-x.  2 root  root  4096 Apr 11  2018 sbin
drwxr-xr-x.  8 root  root  4096 Dec 21 16:20 share
drwxr-xr-x.  2 root  root  4096 Apr 11  2018 src
[root@VM-0-12-centos local]# 

2、查看解壓后目錄結(jié)構(gòu)

[root@VM-0-12-centos local]# cd elasticsearch-8.6.1/
[root@VM-0-12-centos elasticsearch-8.6.1]# ll -X
total 2224
drwxr-xr-x  2 root root    4096 Jan 25 05:47 bin
drwxr-xr-x  3 root root    4096 Feb 14 14:06 config
drwxr-xr-x  8 root root    4096 Jan 25 05:47 jdk
drwxr-xr-x  5 root root    4096 Jan 25 05:47 lib
drwxr-xr-x  2 root root    4096 Jan 25 05:43 logs
drwxr-xr-x 69 root root    4096 Jan 25 05:47 modules
drwxr-xr-x  2 root root    4096 Jan 25 05:43 plugins
-rw-r--r--  1 root root    8106 Jan 25 05:34 README.asciidoc
-rw-r--r--  1 root root    3860 Jan 25 05:34 LICENSE.txt
-rw-r--r--  1 root root 2235851 Jan 25 05:43 NOTICE.txt

以下為 Elasticsearch 目錄及主要配置文件介紹：

目錄|文件	描述
bin/	二進(jìn)制腳本包含啟動(dòng)節(jié)點(diǎn)的elasticsearch
????|-- elasticsearch	elasticsearch的啟動(dòng)命令，Linux下加”-d”參數(shù)以服務(wù)的形式后臺(tái)運(yùn)行。
????|-- …
config/	配置文件目錄（elasticsearch、log、jvm、role、user）
????|-- elasticsearch.yml	配置文件中可進(jìn)行端口、是否允許外部訪問(wèn)、端口等的設(shè)置。
????|-- jvm.options	jvm 配置文件
????|-- log4j2.properties	日志配置文件
????|-- …
data/	在節(jié)點(diǎn)上申請(qǐng)的每個(gè)index/shard的數(shù)據(jù)文件的位置，可容納多個(gè)位置
jdk/	jdk包（7.0版本以后自帶jdk環(huán)境，如果已經(jīng)配置了jdk，會(huì)優(yōu)先使用外部 jdk 環(huán)境）
lib/	引用的相關(guān)類(lèi)庫(kù)的存放目錄，elasticsearch.jar本身也放于該目錄
logs/	日志文件位置
modules/	功能模塊的存放目錄，如aggs、reindex、geoip、xpack、eval。。。
plugins/	插件文件位置。每個(gè)插件將包含在一個(gè)子目錄中
README.asciidoc	readme文檔
LICENSE.txt	證書(shū)
NOTICE.txt	通知

注意事項(xiàng)：

• es依賴jdk環(huán)境，現(xiàn)在7.0以后的es壓縮包中自帶有jdk。
• 若已提前安裝了jdk環(huán)境，則es啟動(dòng)時(shí)，會(huì)優(yōu)先找linux中的jdk。若此時(shí)jdk的版本不一致，就會(huì)造成jdk不能正常運(yùn)行。
• 所以，若Linux服務(wù)本來(lái)沒(méi)有配置jdk，則會(huì)直接使用es目錄下默認(rèn)的jdk，反而不會(huì)報(bào)錯(cuò)。

3、啟動(dòng) Elasticsearch

⑴、正常啟動(dòng)流程

• 1、創(chuàng)建用戶 elastic，專(zhuān)門(mén)用于管理 Elasticsearch。

  [root@VM-0-12-centos elasticsearch-8.6.1]# useradd elastic
  [root@VM-0-12-centos elasticsearch-8.6.1]# chown -R elastic:elastic /usr/local/elasticsearch-8.6.1/
  

• 2、修改配置文件 elasticsearch.yml，這里為了驗(yàn)證是否安裝成功，關(guān)閉安全認(rèn)證：xpack.security.enabled和xpack.security.http.ssl: enabled 都改為 false，否則無(wú)法直接通過(guò)瀏覽器訪問(wèn) 9200端口，后正式應(yīng)用的時(shí)候在啟用。

  # Enable security features
  xpack.security.enabled: false# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
  xpack.security.http.ssl:enabled: falsekeystore.path: certs/http.p12
  

• 3、切換到 elastic 用戶，后臺(tái)啟動(dòng) Elasticsearch，瀏覽器訪問(wèn) 9200端口：http://你的IP:9200/；Linux 記得在安全組配置9200端口允許訪問(wèn)。

  [root@VM-0-12-centos elasticsearch-8.6.1]# su elastic
  [elastic@VM-0-12-centos elasticsearch-8.6.1]$ ./bin/elasticsearch -d
  

⑵、啟動(dòng)過(guò)程遇到的問(wèn)題

①、啟動(dòng)報(bào)錯(cuò)

運(yùn)行 bin/ 目錄下的 elasticsearch 腳本，啟動(dòng) elasticsearch：

[root@VM-0-12-centos elasticsearch-8.6.1]# ./bin/elasticsearch
[2023-02-14T17:44:22,531][ERROR][o.e.b.Elasticsearch      ] [VM-0-12-centos] fatal exception while booting Elasticsearchjava.lang.RuntimeException: can not run elasticsearch as rootat org.elasticsearch.server@8.6.1/org.elasticsearch.bootstrap.Elasticsearch.initializeNatives(Elasticsearch.java:260)at org.elasticsearch.server@8.6.1/org.elasticsearch.bootstrap.Elasticsearch.initPhase2(Elasticsearch.java:166)at org.elasticsearch.server@8.6.1/org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:66)See logs for more details.ERROR: Elasticsearch did not exit normally - check the logs at /usr/local/elasticsearch-8.6.1/logs/elasticsearch.logERROR: Elasticsearch exited unexpectedly
[root@VM-0-12-centos elasticsearch-8.6.1]# 

報(bào)錯(cuò)了，提示 can not run elasticsearch as root，不能使用root用戶啟動(dòng)會(huì)報(bào)錯(cuò)。

②、創(chuàng)建運(yùn)行 Elasticsearch 的用戶，啟動(dòng)成功，但無(wú)法訪問(wèn)

[root@VM-0-12-centos elasticsearch-8.6.1]# useradd elastic
[root@VM-0-12-centos elasticsearch-8.6.1]# chown -R elastic:elastic /usr/local/elasticsearch-8.6.1/
[root@VM-0-12-centos elasticsearch-8.6.1]# su elastic
[elastic@VM-0-12-centos elasticsearch-8.6.1]$ ./bin/elasticsearch

啟動(dòng)成功，這時(shí)候我們?cè)囍L問(wèn)你的 9200端口 ：http://你的IP:9200/ ，失敗。

并且啟動(dòng)臺(tái)那邊也報(bào)錯(cuò)了 http client did not trust this server's certificate，如下：

[2023-02-14T18:04:06,931][WARN ][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [VM-0-12-centos] received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/172.17.0.12:9200, remoteAddress=/218.81.82.139:2348}
[2023-02-14T18:06:25,213][WARN ][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [VM-0-12-centos] http client did not trust this server's certificate, closing connection Netty4HttpChannel{localAddress=/172.17.0.12:9200, remoteAddress=/218.81.82.139:2349}
[2023-02-14T18:06:25,214][WARN ][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [VM-0-12-centos] http client did not trust this server's certificate, closing connection Netty4HttpChannel{localAddress=/172.17.0.12:9200, remoteAddress=/218.81.82.139:2350}

原因是因?yàn)?Elasticsearch 默認(rèn)開(kāi)啟了安全認(rèn)證，雖然啟動(dòng)臺(tái)啟動(dòng)成功，但訪問(wèn) 9200 端口失敗。

解決辦法：找到config/目錄下面的elasticsearch.yml配置文件，把安全認(rèn)證開(kāi)關(guān)從原先的true都改成false，實(shí)現(xiàn)免密登錄訪問(wèn)即可，修改這兩處都為false后，重新啟動(dòng)：

③、停止Elasticsearch，修改配置文件重新啟動(dòng)

新開(kāi)一個(gè)SSH連接，停止Elasticsearch：

[root@VM-0-12-centos ~]# ps -ef | grep elastic
root     26132 24103  0 18:23 pts/4    00:00:00 su elastic
elastic  26133 26132  0 18:23 pts/4    00:00:00 bash
elastic  26178 26133  2 18:23 pts/4    00:00:02 /usr/local/elasticsearch-8.6.1/jdk/bin/java -Xms4m -Xmx64m -XX:+UseSerialGC -Dcli.name=server -Dcli.script=./bin/elasticsearch -Dcli.libs=lib/tools/server-cli -Des.path.home=/usr/local/elasticsearch-8.6.1 -Des.path.conf=/usr/local/elasticsearch-8.6.1/config -Des.distribution.type=tar -cp /usr/local/elasticsearch-8.6.1/lib/ *:/usr/local/elasticsearch-8.6.1/lib/cli-launcher/ * org.elasticsearch.launcher.CliToolLauncher
elastic  26246 26178 31 18:23 pts/4    00:00:31 /usr/local/elasticsearch-8.6.1/jdk/bin/java -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -Djava.security.manager=allow -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Dlog4j2.formatMsgNoLookups=true -Djava.locale.providers=SPI,COMPAT --add-opens=java.base/java.io=ALL-UNNAMED -XX:+UseG1GC -Djava.io.tmpdir=/tmp/elasticsearch-2471405775610397709 -XX:+HeapDumpOnOutOfMemoryError -XX:+ExitOnOutOfMemoryError -XX:HeapDumpPath=data -XX:ErrorFile=logs/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m -Xms999m -Xmx999m -XX:MaxDirectMemorySize=524288000 -XX:G1HeapRegionSize=4m -XX:InitiatingHeapOccupancyPercent=30 -XX:G1ReservePercent=15 -Des.distribution.type=tar --module-path /usr/local/elasticsearch-8.6.1/lib --add-modules=jdk.net -m org.elasticsearch.server/org.elasticsearch.bootstrap.Elasticsearch
elastic  26275 26246  0 18:23 pts/4    00:00:00 /usr/local/elasticsearch-8.6.1/modules/x-pack-ml/platform/linux-x86_64/bin/controller
root     26681 26605  0 18:24 pts/5    00:00:00 grep --color=auto elastic
[root@VM-0-12-centos ~]# kill -9 26133
[root@VM-0-12-centos ~]# kill -9 26178

修改配置文件 elasticsearch.yml，把這兩處改為 false：

# Enable security features
xpack.security.enabled: falsexpack.security.enrollment.enabled: true# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:enabled: falsekeystore.path: certs/http.p12

重新啟動(dòng) Elasticsearch，訪問(wèn) 9200 端口成功。

或者curl 訪問(wèn)：

[root@VM-0-12-centos ~]# curl localhost:9200/
{"name" : "VM-0-12-centos","cluster_name" : "elasticsearch","cluster_uuid" : "3e6bNn6dS_G7bEfl7YhXcA","version" : {"number" : "8.6.1","build_flavor" : "default","build_type" : "tar","build_hash" : "180c9830da956993e59e2cd70eb32b5e383ea42c","build_date" : "2023-01-24T21:35:11.506992272Z","build_snapshot" : false,"lucene_version" : "9.4.2","minimum_wire_compatibility_version" : "7.17.0","minimum_index_compatibility_version" : "7.0.0"},"tagline" : "You Know, for Search"
}
[root@VM-0-12-centos ~]# 

④、JDK 問(wèn)題

這里安裝了一下 JDK，但是 Elasticsearch8.6 仍會(huì)自動(dòng)選擇自己內(nèi)置的JDK。如果其他版本優(yōu)先選擇系統(tǒng)環(huán)境變量中的JDK可以參考這篇博客 Elasticsearch JDK選擇。

[elastic@VM-0-12-centos elasticsearch-8.6.1]$ ps -ef | grep elastic
root     20695 17356  0 13:40 pts/3    00:00:00 su elastic
elastic  20697 20695  0 13:40 pts/3    00:00:00 bash
elastic  21252     1 93 13:41 pts/3    00:00:30 /usr/local/elasticsearch-8.6.1/jdk/bin/java -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -Djava.security.manager=allow -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Dlog4j2.formatMsgNoLookups=true -Djava.locale.providers=SPI,COMPAT --add-opens=java.base/java.io=ALL-UNNAMED -XX:+UseG1GC -Djava.io.tmpdir=/tmp/elasticsearch-16881426132015000451 -XX:+HeapDumpOnOutOfMemoryError -XX:+ExitOnOutOfMemoryError -XX:HeapDumpPath=data -XX:ErrorFile=logs/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m -Xms999m -Xmx999m -XX:MaxDirectMemorySize=524288000 -XX:G1HeapRegionSize=4m -XX:InitiatingHeapOccupancyPercent=30 -XX:G1ReservePercent=15 -Des.distribution.type=tar --module-path /usr/local/elasticsearch-8.6.1/lib --add-modules=jdk.net -m org.elasticsearch.server/org.elasticsearch.bootstrap.Elasticsearch
elastic  21280 21252  0 13:41 pts/3    00:00:00 /usr/local/elasticsearch-8.6.1/modules/x-pack-ml/platform/linux-x86_64/bin/controller
elastic  21434 20697  0 13:42 pts/3    00:00:00 ps -ef
elastic  21435 20697  0 13:42 pts/3    00:00:00 grep --color=auto elastic
[elastic@VM-0-12-centos elasticsearch-8.6.1]$ java -version
java version "17.0.6" 2023-01-17 LTS
Java(TM) SE Runtime Environment (build 17.0.6+9-LTS-190)
Java HotSpot(TM) 64-Bit Server VM (build 17.0.6+9-LTS-190, mixed mode, sharing)
[elastic@VM-0-12-centos elasticsearch-8.6.1]$ 

---

二、Windows 安裝

1、下載安裝包

下載后解壓：

2、啟動(dòng) Elasticsearch

⑴、正常啟動(dòng)流程

由于 Elasticsearch 默認(rèn)開(kāi)啟安全認(rèn)證所以無(wú)法直接通過(guò)端口訪問(wèn)成功，先修改 config 目錄下的配置文件elasticsearch.yml，把這兩處改為 false。：

進(jìn)入 bin 目錄下，雙擊 elasticsearch.bat 文件啟動(dòng) ES，訪問(wèn) http://localhost:9200/：

⑵、啟動(dòng)過(guò)程遇到的問(wèn)題

①、同Linux 默認(rèn)開(kāi)啟安全認(rèn)證，啟動(dòng)后無(wú)法直接訪問(wèn)

和Linux 一樣啟動(dòng)后無(wú)法訪問(wèn)，進(jìn)入logs/ 查看 elasticsearch.log 日志文件信息看到提示 received plaintext http traffic on an https channel，所以找到原因了：同上，默認(rèn)開(kāi)啟了安全認(rèn)證，不允許直接訪問(wèn)。

解決辦法：修改配置文件 elasticsearch.yml，把這兩處改為 false。

再次啟動(dòng)，訪問(wèn)9200端口成功：