环境ES节点硬件：3个AWSm5.4xlarge（16个vCPU/64GB内存）Kibana硬件：1个AWSm5.large（2个vCPU/8GB内存）操作系统：Ubuntu20.04LTSElasticsearch7.9.3Kibana7.9.3机器图操作系统这里主要讲EBS挂载和XFS格式化，请参考官方文档：https://docs.amazonaws.cn/AWSEC2/latest/UserGuide/ebs-using-v...使用lsblk命令查看磁盘概览:32Gsystemdisk/300Gdatadisk,datadiskhasbeenmounted检查卷上是否有文件系统$sudofile-s/dev/nvme1n1/dev/nvme1n1:data#显示为data表示创建一个xfs文件没有文件系统的系统$sudomkfs-txfs/dev/nvme1n1#强制格式化$sudomkfs.xfs-f/dev/nvme0n1再次检查磁盘$sudofile-s/dev/nvme1n1/dev/nvme1n1:SGIXFS文件系统数据(blksz4096,inosz512,v2dirs)创建/data目录sudomkdir/data将新目录挂载到新卷上sudomount/dev/nvme1n1/data再次使用lsblk命令查看磁盘概览使用lsblk-f命令查看磁盘UUID编辑/etc/fstab添加如下条目UUID=dc1eecfc-0295-44ad-97fe-d55893312f68/dataxfsdefaults,nofail02重新挂载/data确认/etc/fstab是否配置正确sudoumount/datasudomount-arestartchecksudoinit6文件准备Elasticsearch,Kibana:https://www.elastic.co/cn/downloads/past-releasesIK插件:https://github.com/medcl/elasticsearch-analysis-ik/releases/tag/v7.9.3Elasticsearch安装官方文档：https://www.elastic.co/guide/en/elasticsearch/reference/7.9/d...文件查看$shasum-a512-celasticsearch-7.9.3-amd64.deb.sha512elasticsearch-7.9.3-amd64.deb:确定安装sudodpkg-ielasticsearch-7.9.3-amd64.debsetstartupsudo/bin/systemctldaemon-reloadsudo/bin/systemctlenableelasticsearch.servicegeneral设置node-1/node-2/node-3三个节点的通用设置，设置elasticsearch最大可以打开的文件数#修改systemctl编辑器：update-alternatives--configeditorsudosystemctleditelasticsearch添加以下内容(/etc/systemd/system/elasticsearch.service.d/override.conf)[Service]LimitMEMLOCK=infinityreloadsudosystemctldaemon-reload禁用交换文件：编辑/etc/fstab，注释掉所有包含swapvirtual的行memory(虚拟内存)vm.max_map_count在Ubuntu20.04上用deb包安装时已经自动配置，无需设置更多线程(Numberofthreads,ulimit)无需在systemd上单独设置jvmheapsize(/etc/elasticsearch/jvm.options)-Xms30g-Xmx30g创建目录并更改所有者sudomkdir-p/data/elasticsearch/data/data/elasticsearch/logsudochown-Relasticsearch:elasticsearch/data/elasticsearchedit/etc/elasticsearch/elasticsearch.yml文件#添加或修改cluster.name:esapipath.data:/data/elasticsearch/datapath.logs:/data/elasticsearch/loghttp.port:9200discovery.seed_hosts:["172.31.0.1","172.31.0.2","172.31.0.3"]cluster.initial_master_nodes:["node01","node02","node03"]node.roles:[master,data,ingest]个性化node01编辑/etc/elasticsearch/elasticsearch.yml文件#添加或修改node.name:node01network.host:172.31.0.1node02Edit/etc/elasticsearch/elasticsearch.yml文件#添加或修改node.name:node02network.host:172.31.0.2node03Edit/etc/elasticsearch/elasticsearch.ymlfile#添加或修改node.name:node03network.host:172.31.0.3网络问题ES节点之间的通信端口是9300，记得防火墙一定要放过下面的错误，找了很多原因。最后发现是AWSAMI的镜像模板也复制了数据服务，清空数据目录重启即可。{“错误”：{“根本原因”：[{“类型”：“master_not_discovered_exception”，“原因”：空}]，“类型”：“master_not_discovered_exception","reason":null},"status":503}查看已经联网成功的节点$curlhttp://172.31.8.192:9200/_cat/nodes172.31.0.205300.000.150.34dilmrt-node02172.31.0.315200.000.160.30dilmrt-node03172.31.0.115200.080.250.32dilmrt*node01plugininstall安装官方插件/usr/share/elasticsearch/bin/elasticsearch-plugininstallanalysis-icuinstall本地插件/usr/share/elasticsearch/bin/elasticsearch-plugininstallfile:///home/ubuntu/es_down/elasticsearch-analysis-ik-7.9.3.zip插件安装了哪些插件#/usr/share/elasticsearch/bin/elasticsearch-pluginlistanalysis-haoanalysis-ikanalysis-stconvert找到安装主目录settings.path.home，插件目录一般在安装主目录/pluginscurl127.0.0.1:9200/_nodes/settings?pretty=trueElasticsearch本身和插件的配置文件一般在/etc/elasticsearch目录下的IKtokenizer添加同义词添加远程字典Kibana安装官方文档：https://www.elastic.co/guide/en/kibana/7.9/deb.html#install-deb文件检查$shasum-a512-ckibana-7.9.3-amd64.deb.sha512kibana-7.9.3-amd64.deb：确定安装sudodpkg-ikibana-7.9.3-amd64.deb设置启动sudo/bin/systemctldaemon-reloadsudo/bin/systemctlenablekibana.servicesettings编辑/etc/kibana/kibana.yml文件#添加或修改server.port:5601server.host:"0.0.0.0"elasticsearch.hosts:["http://172.31.0.1:9200","http://172.31.0.2:9200","http://172.31.0.3:9200"】本文来自qbitsnap
