ElasticSearch 的集群部署环境搭建

linuxMinx

墨衍会员 · AI 创作全网分发码龄15年

关注

原创最新推荐文章于 2026-06-13 10:54:35 发布 2.6k 阅读 AI 写同款· GEO 优化 ›

ELK之简介+Elasticsearch集群部署+索引管理 Logstash 作为日志搜集器，从数据源采集数据，并对数据进行过滤，格式化处理，然后交由 Elasticsearch 存储，Kibana 对日志进行可视化处理。阅读详情

一、摘要

ElasticSearch 是一个开源的 分布式、RESTful 的 搜索和分析引擎 ，可以用来解决使用数据库进行模糊搜索时存在的性能问题，适用于所有类型的数据，包括文本、数字、地理空间、结构化和非结构化数据

ElasticSearch 使用 Java 语言开发，基于 Lucence 。ES 早期版本需要 JDK，在 7.X 版本后已经集成了 JDK，已无需第三方依赖。

Lucene 是什么？
Lucene 是一个 Java 语言编写的高性能、全功能的文本搜索引擎库，提供强大的索引和搜索功能，以及拼写检查、高亮显示和高级分析功能。

二、集群环境准备

地址	主机名称	CPU	内存	磁盘	角色说明
10.0.0.151	elk151.edu.com	2C	4G	50G+	ES node
10.0.0.152	elk152.edu.com	2C	4G	50G+	ES node
10.0.0.153	elk153.edu.com	2C	4G	50G+	ES node

（一）根据主机10.0.0.151配置10.0.0.152主机和10.0.0.153主机

参考文章：ElasticSearch 的单点部署环境搭建

（二）验证10.0.0.152主机和10.0.0.153主机环境配置成功

1.验证10.0.0.152主机配置成功

[root@elk152 ~]# systemctl restart elasticsearch.service
[root@elk152 ~]# ss -tnl
State      Recv-Q Send-Q                           Local Address:Port                                          Peer Address:Port              
LISTEN     0      128                                          *:22                                                       *:*                  
LISTEN     0      100                                  127.0.0.1:25                                                       *:*                  
LISTEN     0      128                                       [::]:9300                                                  [::]:*                  
LISTEN     0      128                                       [::]:22                                                    [::]:*                  
LISTEN     0      100                                      [::1]:25                                                    [::]:*                  
LISTEN     0      128                                       [::]:9200                                                  [::]:*                  
[root@elk152 ~]#

2.验证10.0.0.153主机配置成功


[root@elk153 ~]# systemctl restart elasticsearch.service
[root@elk153 ~]# systemctl status elasticsearch.service
● elasticsearch.service - Elasticsearch
   Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; vendor preset: disabled)
   Active: active (running) since 一 2024-08-26 11:11:05 CST; 1min 45s ago
     Docs: https://www.elastic.co
 Main PID: 1931 (java)
   CGroup: /system.slice/elasticsearch.service
           ├─1931 /usr/share/elasticsearch/jdk/bin/java -Xshare:auto -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=...
           └─2130 /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x86_64/bin/controller

8月 26 11:10:40 elk153.oldboyedu.com systemd[1]: Starting Elasticsearch...
8月 26 11:11:05 elk153.oldboyedu.com systemd[1]: Started Elasticsearch.
[root@elk153 ~]# ss -tnl
State      Recv-Q Send-Q                           Local Address:Port                                          Peer Address:Port              
LISTEN     0      128                                          *:22                                                       *:*                  
LISTEN     0      100                                  127.0.0.1:25                                                       *:*                  
LISTEN     0      128                                       [::]:9200                                                  [::]:*                  
LISTEN     0      128                                       [::]:9300                                                  [::]:*                  
LISTEN     0      128                                       [::]:22                                                    [::]:*                  
LISTEN     0      100                                      [::1]:25                                                    [::]:*                  
[root@elk153 ~]#

3.验证三台主机互访成功

[root@elk153 ~]# curl 10.0.0.153:9200
{
  "name" : "elk153.edu.com",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "-MNtOCrjRaa-4zG0J-4Omg",
  "version" : {
    "number" : "7.17.5",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "8d61b4f7ddf931f219e3745f295ed2bbc50c8e84",
    "build_date" : "2022-06-23T21:57:28.736740635Z",
    "build_snapshot" : false,
    "lucene_version" : "8.11.1",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}
[root@elk153 ~]#

[root@elk151 ~]# curl 10.0.0.152:9200
{
  "name" : "elk152.edu.com",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "Zw1zXmO7RjubZ2G-C5Ks5A",
  "version" : {
    "number" : "7.17.5",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "8d61b4f7ddf931f219e3745f295ed2bbc50c8e84",
    "build_date" : "2022-06-23T21:57:28.736740635Z",
    "build_snapshot" : false,
    "lucene_version" : "8.11.1",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}
[root@elk151 ~]#

三、开始配置集群环境

（一）elk151.edu.com做数据清空

[root@elk151 ~]# systemctl stop elasticsearch.service
[root@elk151 ~]# systemctl status elasticsearch.service
● elasticsearch.service - Elasticsearch
   Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; vendor preset: disabled)
   Active: inactive (dead)
     Docs: https://www.elastic.co

8月 26 10:01:23 elk151.oldboyedu.com systemd[1]: Starting Elasticsearch...
8月 26 10:02:09 elk151.oldboyedu.com systemd[1]: Started Elasticsearch.
8月 26 10:29:11 elk151.oldboyedu.com systemd[1]: Stopping Elasticsearch...
8月 26 10:29:11 elk151.oldboyedu.com systemd[1]: Stopped Elasticsearch.
8月 26 10:29:11 elk151.oldboyedu.com systemd[1]: Starting Elasticsearch...
8月 26 10:30:03 elk151.oldboyedu.com systemd[1]: Started Elasticsearch.
8月 26 11:17:11 elk151.oldboyedu.com systemd[1]: Stopping Elasticsearch...
8月 26 11:17:12 elk151.oldboyedu.com systemd[1]: Stopped Elasticsearch.
[root@elk151 ~]# rm -rf /var/lib/elasticsearch/* /var/log/elasticsearch/* /tmp/*
[root@elk151 ~]#

（二）修改elk151.edu.com 修改es的配置文件

[root@elk151 ~]# vim /etc/elasticsearch/elasticsearch.yml
# 指定ES集群的名称
cluster.name: oldboyedu-linux85
# ES服务监听对外暴露服务的地址
network.host: 0.0.0.0
# 指定ES集群的节点IP
discovery.seed_hosts: ["10.0.0.151","10.0.0.152","10.0.0.153"]
# 指定参与master选举的节点
cluster.initial_master_nodes: ["10.0.0.151","10.0.0.152","10.0.0.153"]

1.查看配置信息

[root@elk151 ~]# yy /etc/elasticsearch/elasticsearch.yml
cluster.name: 151edu-linux85
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
discovery.seed_hosts: ["10.0.0.151","10.0.0.152","10.0.0.153"]
cluster.initial_master_nodes: ["10.0.0.151","10.0.0.152","10.0.0.153"]
[root@elk151 ~]#

（三）将配置文件分发到其他两个节点

scp /etc/elasticsearch/elasticsearch.yml  10.0.0.152:/etc/elasticsearch/elasticsearch.yml
scp /etc/elasticsearch/elasticsearch.yml  10.0.0.153:/etc/elasticsearch/elasticsearch.yml

分发其他两个节点

[root@elk151 ~]#  scp /etc/elasticsearch/elasticsearch.yml  10.0.0.153:/etc/elasticsearch/elasticsearch.yml
The authenticity of host '10.0.0.153 (10.0.0.153)' can't be established.
ECDSA key fingerprint is SHA256:hfSd0fZnZScoy7gV/0yseTwuTfpVlU24t3TDj5q1+nk.
ECDSA key fingerprint is MD5:c0:c6:a4:b5:f5:d3:15:25:e3:bc:2c:b9:a1:9d:a8:cd.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.0.153' (ECDSA) to the list of known hosts.
root@10.0.0.153's password: 
elasticsearch.yml                                                                                             100% 3701     2.1MB/s   00:00    
[root@elk151 ~]# scp /etc/elasticsearch/elasticsearch.yml  10.0.0.152:/etc/elasticsearch/elasticsearch.yml
root@10.0.0.152's password: 
elasticsearch.yml                                                                                             100% 3701     2.1MB/s   00:00    
[root@elk151 ~]#

另外两个节点查看一下

[root@elk152 ~]# yy /etc/elasticsearch/elasticsearch.yml 
cluster.name: edu-linux85
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
discovery.seed_hosts: ["10.0.0.151","10.0.0.152","10.0.0.153"]
cluster.initial_master_nodes: ["10.0.0.151","10.0.0.152","10.0.0.153"]
[root@elk152 ~]#

（四）所有节点启动ES服务

1.主机10.0.0.151启动服务：

[root@elk151 ~]# systemctl enable --now elasticsearch 
Created symlink from /etc/systemd/system/multi-user.target.wants/elasticsearch.service to /usr/lib/systemd/system/elasticsearch.service.

2.主机10.0.0.152启动服务

[root@elk151 ~]# systemctl enable --now elasticsearch 
Created symlink from /etc/systemd/system/multi-user.target.wants/elasticsearch.service to /usr/lib/systemd/system/elasticsearch.service.

3.主机10.0.0.152启动服务

[root@elk151 ~]# systemctl enable --now elasticsearch 
Created symlink from /etc/systemd/system/multi-user.target.wants/elasticsearch.service to /usr/lib/systemd/system/elasticsearch.service.

（五）验证ES集群节点是否正常工作

1.验证ES集群配置成功的标志之一

[root@elk151 ~]# curl 10.0.0.151:9200
{
  "name" : "elk151.edu.com",
  "cluster_name" : "edu-linux85",
  "cluster_uuid" : "lIXyWpnSQPO4s12VVk3alw", #ES集群配置成功UUID一样
  "version" : {


[root@elk151 ~]# curl 10.0.0.152:9200
{
  "name" : "elk152.edu.com",
  "cluster_name" : "edu-linux85",
  "cluster_uuid" : "lIXyWpnSQPO4s12VVk3alw",#ES集群配置成功UUID一样
  "version" : {



[root@elk151 ~]# curl 10.0.0.153:9200
{
  "name" : "elk153.edu.com",
  "cluster_name" : "edu-linux85",
  "cluster_uuid" : "lIXyWpnSQPO4s12VVk3alw",#ES集群配置成功UUID一样
  "version" : {

2.验证ES集群配置成功的标志之二

[root@elk151 ~]# curl  10.0.0.153:9200/_cat/nodes
10.0.0.153  9 91 22 0.46 0.33 0.18 cdfhilmrstw - elk153.edu.com
10.0.0.152 15 70 25 0.39 0.29 0.19 cdfhilmrstw - elk152.edu.com
10.0.0.151 15 72 26 0.43 0.27 0.18 cdfhilmrstw * elk151.edu.com
[root@elk151 ~]#

3.查看集群日志~oldboyedu-linux85.log

[root@elk151 ~]# ll /var/log/elasticsearch/
total 3076
-rw-r--r-- 1 elasticsearch elasticsearch  62051 8月  26 11:40 gc.log
-rw-r--r-- 1 elasticsearch elasticsearch   2096 8月  26 11:36 gc.log.00
-rw-r--r-- 1 elasticsearch elasticsearch      0 8月  26 11:36 oldboyedu-linux85_audit.json
-rw-r--r-- 1 elasticsearch elasticsearch      0 8月  26 11:36 oldboyedu-linux85_deprecation.json
-rw-r--r-- 1 elasticsearch elasticsearch      0 8月  26 11:36 oldboyedu-linux85_deprecation.log
-rw-r--r-- 1 elasticsearch elasticsearch      0 8月  26 11:36 oldboyedu-linux85_index_indexing_slowlog.json
-rw-r--r-- 1 elasticsearch elasticsearch      0 8月  26 11:36 oldboyedu-linux85_index_indexing_slowlog.log
-rw-r--r-- 1 elasticsearch elasticsearch      0 8月  26 11:36 oldboyedu-linux85_index_search_slowlog.json
-rw-r--r-- 1 elasticsearch elasticsearch      0 8月  26 11:36 oldboyedu-linux85_index_search_slowlog.log
-rw-r--r-- 1 elasticsearch elasticsearch 889606 8月  26 11:40 oldboyedu-linux85.log
-rw-r--r-- 1 elasticsearch elasticsearch 988433 8月  26 11:40 oldboyedu-linux85_server.json
[root@elk151 ~]#

（六）如何集群配置完后发现不成功：uuid不一样或没有多个nodes节点

1.重复步骤三、四

重复的同时注意几点：

1、关闭三个集群服务：systemctl stop elasticsearch.service

2、删除三个集群服务日志、临时文件；rm -rf /var/lib/elasticsearch/* /var/log/elasticsearch/* /tmp/*

3、10.0.0.151主机重新分发配置：

scp /etc/elasticsearch/elasticsearch.yml 10.0.0.152:/etc/elasticsearch/elasticsearch.yml scp /etc/elasticsearch/elasticsearch.yml 10.0.0.153:/etc/elasticsearch/elasticsearch.yml

4、同时启动三台机器：systemctl enable --now elasticsearch