Ubuntu二進制安裝ElasticSearch7.17.x版本集群

概述

本文主要講解如何二進制安裝Linux二進制集群

環境信息

主機名	IP地址	系統
ELK01	10.0.0.40	Ubuntu22.04
ELK02	10.0.0.41	Ubuntu22.04
ELK03	10.0.0.42	Ubuntu22.04

實操

安裝JDK（所有節點都需要安裝）

ElasticSearch是使用Java語言開發的，所以運行時依賴JDK

安裝JDK可以參考這篇文章：http://www.rzrgm.cn/huangSir-devops/p/18919758

ElasticSearch版本和Java版本對應關系，可以閱讀這篇文章：https://www.elastic.co/support/matrix#matrix_jvm

我們這里安裝ELasticSearch7.17.x版本的，我們安裝JDK11版本

# 下載
[root@master ~]# wget https://mirrors.huaweicloud.com/openjdk/11.0.2/openjdk-11.0.2_linux-x64_bin.tar.gz
[root@master ~]# ll openjdk-11.0.2_linux-x64_bin.tar.gz
-rw-r--r-- 1 root root 187513052 Jan 18  2019 openjdk-11.0.2_linux-x64_bin.tar.gz

# 解壓
[root@master ~]# tar -xvf openjdk-11.0.2_linux-x64_bin.tar.gz

# 創建軟連接
[root@master ~]# ln -s /root/jdk-11.0.2 /usr/local/jdk11
[root@master ~]# ll /usr/local/jdk11
lrwxrwxrwx 1 root root 16 Jun 14 21:09 /usr/local/jdk11 -> /root/jdk-11.0.2/

# 配置環境變量
[root@master ~]# vim /etc/profile
# 根據實際安裝路徑修改
export JAVA_HOME=/usr/local/jdk11/
export PATH=$JAVA_HOME/bin:$PATH
export CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar

# 加載環境變量
[root@master ~]# source /etc/profile

# 驗證
[root@master ~]# java -version
openjdk version "11.0.2" 2019-01-15
OpenJDK Runtime Environment 18.9 (build 11.0.2+9)
OpenJDK 64-Bit Server VM 18.9 (build 11.0.2+9, mixed mode)

配置主機名及添加hosts解析

ELK01節點設置

[root@master ~]# hostnamectl set-hostname ELK01
[root@master ~]# hostname
ELK01

ELK02節點設置

[root@master ~]# hostnamectl set-hostname ELK02
[root@master ~]# hostname
ELK02

ELK03節點設置

[root@master ~]# hostnamectl set-hostname ELK03
[root@master ~]# hostname
ELK03

三臺節點都添加hosts解析

[root@master ~]# vim /etc/hosts
10.0.0.40 ELK01
10.0.0.41 ELK02
10.0.0.42 ELK03

配置時間同步（所有節點都需配置）

[root@master ~]# ln -svf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
#下載ntpdate  工具
[root@master ~]# apt -y install ntpdate
[root@master ~]# ntpdate ntp.aliyun.com

[root@master ~]# echo "*/5 * * * * /usr/sbin/ntpdate ntp.aliyun.com" > /var/spool/cron/crontabs/root

系統配置（所有節點都需配置）

優化系統參數

[root@master ~]# vim /etc/sysctl.conf
# ES 需要大量文件描述符來處理索引和網絡連接，建議設置為較高值：
fs.file-max = 655360
# ES 使用 mmap 技術加載索引，需增大虛擬內存區域限制：
vm.max_map_count = 2147483642
# 禁用交換空間(swap分區)
vm.swappiness = 1
 
# 網絡參數優化
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 10
net.ipv4.tcp_max_syn_backlog = 4096
net.core.somaxconn = 4096
net.core.netdev_max_backlog = 16384
net.core.rmem_max = 262144
net.core.wmem_max = 262144
 
# 使參數生效
[root@master ~]# sysctl -p /etc/sysctl.conf
 
# 查詢參數，驗證是否生效
[root@master ~]# sysctl -q vm.max_map_count
vm.max_map_count = 2147483642

創建es存儲目錄

[root@master ~]# mkdir -p /data/elasticsearch/
[root@master ~]# mkdir -p /var/log/elasticsearch/

創建es用戶

[root@master ~]# useradd elasticsearch
[root@master ~]# id elasticsearch
uid=2002(elasticsearch) gid=2003(elasticsearch) groups=2003(elasticsearch)
 
# 授權
[root@master ~]# chown elasticsearch:elasticsearch -R /data/elasticsearch/
[root@master ~]# chown elasticsearch:elasticsearch -R /var/log/elasticsearch/

添加es用戶的限制

[root@master ~]# vim /etc/security/limits.conf
# 最大文件描述符數
elasticsearch hard nofile 655360
elasticsearch soft nofile 655360
# 最大進程數
elasticsearch hard nproc 8192
elasticsearch soft nproc 8192
# 鎖定內存限制
elasticsearch hard memlock unlimited
elasticsearch soft memlock unlimited

下載并配置ElasticSearch（所有節點操作）

官方下載地址：https://www.elastic.co/downloads/past-releases#elasticsearch

下載解壓ElasticSearch

# 下載ElasticSearch
[root@master ~]# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.17.26-linux-x86_64.tar.gz
[root@master ~]# ll elasticsearch-7.17.26-linux-x86_64.tar.gz
-rw-r--r-- 1 root root 325410598 Dec  3  2024 elasticsearch-7.17.26-linux-x86_64.tar.gz

# 解壓
[root@master ~]# tar -xvf elasticsearch-7.17.26-linux-x86_64.tar.gz

# 移動到/data目錄下
[root@master ~]# mv elasticsearch-7.17.26 /data/

# 授權
[root@master ~]# chown elasticsearch:elasticsearch -R /data/elasticsearch-7.17.26/

# 創建軟連接
[root@master ~]# ln -s /data/elasticsearch-7.17.26 /usr/local/es7
[root@master ~]# ll /usr/local/es7
lrwxrwxrwx 1 root root 27 Jun 14 21:50 /usr/local/es7 -> /data/elasticsearch-7.17.26/

修改配置文件

[root@master ~]# vim /usr/local/es7/config/elasticsearch.yml
cluster.name: es7
path.data: /data/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: ["ELK01", "ELK02", "ELK03"]
cluster.initial_master_nodes: ["ELK01", "ELK02", "ELK03"]

# 根據節點名稱來進行修改此字段
# node.name: ELK01
# node.name: ELK02
node.name: ELK03

啟動ElasticSearch集群（三個節點都執行）

創建systemd文件

[root@master ~]# vim /lib/systemd/system/es.service
[Unit]
Description=elasticsearch service
Documentation=http://www.rzrgm.cn/huangSir-devops
After=network.target auditd.service
 
[Service]
LimitMEMLOCK=infinity
User=elasticsearch
ExecStart=/usr/local/es7/bin/elasticsearch
TimeoutStopSec=0
TimeoutStartSec=0
 
[Install]
WantedBy=multi-user.target

加載systemd文件

[root@master ~]# systemctl daemon-reload

啟動es

[root@master ~]# systemctl start es
[root@master ~]# systemctl status es
● es.service - elasticsearch service
     Loaded: loaded (/lib/systemd/system/es.service; disabled; vendor preset: enabled)
     Active: active (running) since Sat 2025-06-14 21:51:19 CST; 34s ago
       Docs: http://www.rzrgm.cn/huangSir-devops
   Main PID: 1420 (java)
      Tasks: 43 (limit: 4519)
     Memory: 2.1G
        CPU: 54.474s
     CGroup: /system.slice/es.service
             ├─1420 /usr/local/es7/jdk/bin/java -Xshare:auto -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -D
file.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -XX:+ShowCodeDetailsInExceptionMessages -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.
maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Dlog4j2.formatMsgNoLookups=true -Djava.locale.providers=SPI,COMPAT
--add-opens=java.base/java.io=ALL-UNNAMED -Djava.security.manager=allow -XX:+UseG1GC -Djava.io.tmpdir=/tmp/elasticsearch-1928841724883000105 -XX:+HeapDumpOnOutOfMemoryError -XX:+ExitOnOutOfM
emoryError -XX:HeapDumpPath=data -XX:ErrorFile=logs/hs_err_pid%p.log "-Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m" -XX:+UnlockDiagnosticVMOpt
ions -XX:G1NumCollectionsKeepPinned=10000000 -Xms1937m -Xmx1937m -XX:MaxDirectMemorySize=1016070144 -XX:G1HeapRegionSize=4m -XX:InitiatingHeapOccupancyPercent=30 -XX:G1ReservePercent=15 -Des
.path.home=/usr/local/es7 -Des.path.conf=/usr/local/es7/config -Des.distribution.flavor=default -Des.distribution.type=tar -Des.bundled_jdk=true -cp "/usr/local/es7/lib/*" org.elasticsearch.
bootstrap.Elasticsearch
             └─1603 /usr/local/es7/modules/x-pack-ml/platform/linux-x86_64/bin/controller

Jun 14 21:51:47 ELK01 elasticsearch[1420]: [2025-06-14T21:51:47,200][INFO ][o.e.n.Node               ] [ELK01] starting ...
Jun 14 21:51:47 ELK01 elasticsearch[1420]: [2025-06-14T21:51:47,216][INFO ][o.e.x.s.c.f.PersistentCache] [ELK01] persistent cache index loaded
Jun 14 21:51:47 ELK01 elasticsearch[1420]: [2025-06-14T21:51:47,217][INFO ][o.e.x.d.l.DeprecationIndexingComponent] [ELK01] deprecation component started
Jun 14 21:51:47 ELK01 elasticsearch[1420]: [2025-06-14T21:51:47,374][INFO ][o.e.t.TransportService   ] [ELK01] publish_address {10.0.0.40:9300}, bound_addresses {[::]:9300}
Jun 14 21:51:47 ELK01 elasticsearch[1420]: [2025-06-14T21:51:47,391][INFO ][o.e.x.m.Monitoring       ] [ELK01] creating template [.monitoring-alerts-7] with version [7]
Jun 14 21:51:47 ELK01 elasticsearch[1420]: [2025-06-14T21:51:47,400][INFO ][o.e.x.m.Monitoring       ]

檢查集群節點

# 檢查集群節點
[root@master /var/log/elasticsearch]# curl 10.0.0.40:9200/_cat/nodes
10.0.0.40 22 97 12 0.41 0.38 0.26 cdfhilmrstw * ELK01
10.0.0.42  6 97 13 0.30 0.26 0.15 cdfhilmrstw - ELK03
10.0.0.41 21 97 12 0.23 0.19 0.11 cdfhilmrstw - ELK02

# 查看集群是否健康
[root@master /var/log/elasticsearch]# curl 10.0.0.40:9200/_cat/health?v
epoch      timestamp cluster status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1749909982 14:06:22  es7     green           3         3      4   2    0    0        0             0                  -                100.0%

記一下：下一次可以寫一下Docker和K8s搭建ES的集群