centos8安装ELK

1.安装java

[root@fcentos8 ~]# install java-11-openjdk-devel

2.安装elasticsearch

[root@node1 ~]# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch #导入elasticsearch 密钥
注意：如果导入过程中出现如下错误，检查时间设置，例如时钟源是否同步

curl: (60) SSL certificate problem: certificate is not yet valid
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
error: https://artifacts.elastic.co/GPG-KEY-elasticsearch: import read failed(2).

[root@node1 ~]# vim /etc/yum.repos.d/elasticsearch.repo  //编写yum文件
[Elasticsearch]
name=Elasticsearch
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
[root@node1 ~]# yum makecache                             #更新仓库源
[root@node1 ~]# yum -y install elasticsearch              #安装elasticsearch



elasticsearch历史版本下载网址：https://elasticsearch.cn/download/

3. 编写主机host文件

集群中的每台设备都要配置此文件

[root@es1 ~]# vim /etc/hosts  #根据实际集群设备地址和主机名修改如下文件
192.168.1.41 es1
192.168.1.42 es2
192.168.1.43 es3
192.168.1.44 es4
192.168.1.45 es5

4. 修改elasticsearch配置文件

所有设备均要修改此文件
注意：elasticsearch文件，其中不同的只有23行有区别，要改成当前主机名

[root@node1 ~]# vim /etc/elasticsearch/elasticsearch.yml  #修改配置文件
cluster.name: my-elk     #17行--指定自己要设置的集群名字
node.name: node1         #23行--修改指定节点的名称，设置本机的主机名
network.host: 0.0.0.0    #56行--修改elasticsearch监听地址，0.0.0.0代表让所有主机都可访问
discovery.zen.ping.unicast.hosts: ["node1", "node2", "node3"]  #此行为新增行---指定集群的成员，不需要配置所有成员，三个成员即可，集群在启动时，其他节点会首先向这三个节点寻求通讯地址，所以，这里三个节点的Elasticsearch服务必须首先启动

5.启动服务

以下几部操作在每个节点都要进行操作

[root@node1 ~]# systemctl enable --now elasticsearch.service  #启动服务并设置开机自启
[root@node1 ~]# ss -tunl | grep -E "9200|9300"     #查看端口是否启动
tcp     LISTEN   0        0                      *:9200                *:*      
tcp     LISTEN   0        0                      *:9300                *:*      

[root@node1 ~]# curl http://node1:9200  #验证服务状态，如果返回一组 json 数据就是正常的
{
  "name" : "node1",
  "cluster_name" : "my-elk",
  "cluster_uuid" : "lgFLktDOSrqFXsRKlWkbRw",
  "version" : {
    "number" : "7.16.3",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "4e6e4eab2297e949ec994e688dad46290d018022",
    "build_date" : "2022-01-06T23:43:02.825887787Z",
    "build_snapshot" : false,
    "lucene_version" : "8.10.1",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

6. 验证集群

[root@node1 ~]# curl http://node1:9200/_cluster/health?pretty

  "cluster_name" : "my-elk",
  "status" : "green",         #集群状态绿色为正常
  "timed_out" : false,
  "number_of_nodes" : 5,      #集群节点数为5个
  "number_of_data_nodes" : 5, #集群的数据节点为5个
  "active_primary_shards" : 3,
  "active_shards" : 6,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}