一、摘要
ElasticSearch 是一个开源的 分布式、RESTful 的 搜索和分析引擎 ，可以用来解决使用数据库进行模糊搜索时存在的性能问题，适用于所有类型的数据，包括文本、数字、地理空间、结构化和非结构化数据
ElasticSearch 使用 Java 语言开发，基于 Lucence 。ES 早期版本需要 JDK，在 7.X 版本后已经集成了 JDK，已无需第三方依赖。
- Lucene 是什么？
- Lucene 是一个 Java 语言编写的高性能、全功能的文本搜索引擎库，提供强大的索引和搜索功能，以及拼写检查、高亮显示和高级分析功能。
二、集群环境准备
| 地址 | 主机名称 | CPU | 内存 | 磁盘 | 角色说明 |
| 10.0.0.151 | elk151.edu.com | 2C | 4G | 50G+ | ES node |
| 10.0.0.152 | elk152.edu.com | 2C | 4G | 50G+ | ES node |
| 10.0.0.153 | elk153.edu.com | 2C | 4G | 50G+ | ES node |
（一）根据主机10.0.0.151配置10.0.0.152主机和10.0.0.153主机
参考文章：ElasticSearch 的单点部署环境搭建
（二）验证10.0.0.152主机和10.0.0.153主机环境配置成功
1.验证10.0.0.152主机配置成功
[root@elk152 ~]# systemctl restart elasticsearch.service
[root@elk152 ~]# ss -tnl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:22 *:*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 128 [::]:9300 [::]:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 100 [::1]:25 [::]:*
LISTEN 0 128 [::]:9200 [::]:*
[root@elk152 ~]#
2.验证10.0.0.153主机配置成功
[root@elk153 ~]# systemctl restart elasticsearch.service
[root@elk153 ~]# systemctl status elasticsearch.service
● elasticsearch.service - ElasticsearchLoaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; vendor preset: disabled)Active: active (running) since 一 2024-08-26 11:11:05 CST; 1min 45s agoDocs: https://www.elastic.coMain PID: 1931 (java)CGroup: /system.slice/elasticsearch.service├─1931 /usr/share/elasticsearch/jdk/bin/java -Xshare:auto -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=...└─2130 /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x86_64/bin/controller8月 26 11:10:40 elk153.oldboyedu.com systemd[1]: Starting Elasticsearch...
8月 26 11:11:05 elk153.oldboyedu.com systemd[1]: Started Elasticsearch.
[root@elk153 ~]# ss -tnl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:22 *:*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 128 [::]:9200 [::]:*
LISTEN 0 128 [::]:9300 [::]:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 100 [::1]:25 [::]:*
[root@elk153 ~]#
3.验证三台主机互访成功
[root@elk153 ~]# curl 10.0.0.153:9200
{"name" : "elk153.edu.com","cluster_name" : "elasticsearch","cluster_uuid" : "-MNtOCrjRaa-4zG0J-4Omg","version" : {"number" : "7.17.5","build_flavor" : "default","build_type" : "rpm","build_hash" : "8d61b4f7ddf931f219e3745f295ed2bbc50c8e84","build_date" : "2022-06-23T21:57:28.736740635Z","build_snapshot" : false,"lucene_version" : "8.11.1","minimum_wire_compatibility_version" : "6.8.0","minimum_index_compatibility_version" : "6.0.0-beta1"},"tagline" : "You Know, for Search"
}
[root@elk153 ~]#
[root@elk151 ~]# curl 10.0.0.152:9200
{"name" : "elk152.edu.com","cluster_name" : "elasticsearch","cluster_uuid" : "Zw1zXmO7RjubZ2G-C5Ks5A","version" : {"number" : "7.17.5","build_flavor" : "default","build_type" : "rpm","build_hash" : "8d61b4f7ddf931f219e3745f295ed2bbc50c8e84","build_date" : "2022-06-23T21:57:28.736740635Z","build_snapshot" : false,"lucene_version" : "8.11.1","minimum_wire_compatibility_version" : "6.8.0","minimum_index_compatibility_version" : "6.0.0-beta1"},"tagline" : "You Know, for Search"
}
[root@elk151 ~]#
三、开始配置集群环境
（一）elk151.edu.com做数据清空
[root@elk151 ~]# systemctl stop elasticsearch.service
[root@elk151 ~]# systemctl status elasticsearch.service
● elasticsearch.service - ElasticsearchLoaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; vendor preset: disabled)Active: inactive (dead)Docs: https://www.elastic.co8月 26 10:01:23 elk151.oldboyedu.com systemd[1]: Starting Elasticsearch...
8月 26 10:02:09 elk151.oldboyedu.com systemd[1]: Started Elasticsearch.
8月 26 10:29:11 elk151.oldboyedu.com systemd[1]: Stopping Elasticsearch...
8月 26 10:29:11 elk151.oldboyedu.com systemd[1]: Stopped Elasticsearch.
8月 26 10:29:11 elk151.oldboyedu.com systemd[1]: Starting Elasticsearch...
8月 26 10:30:03 elk151.oldboyedu.com systemd[1]: Started Elasticsearch.
8月 26 11:17:11 elk151.oldboyedu.com systemd[1]: Stopping Elasticsearch...
8月 26 11:17:12 elk151.oldboyedu.com systemd[1]: Stopped Elasticsearch.
[root@elk151 ~]# rm -rf /var/lib/elasticsearch/* /var/log/elasticsearch/* /tmp/*
[root@elk151 ~]#
（二）修改elk151.edu.com 修改es的配置文件
[root@elk151 ~]# vim /etc/elasticsearch/elasticsearch.yml
# 指定ES集群的名称
cluster.name: oldboyedu-linux85
# ES服务监听对外暴露服务的地址
network.host: 0.0.0.0
# 指定ES集群的节点IP
discovery.seed_hosts: ["10.0.0.151","10.0.0.152","10.0.0.153"]
# 指定参与master选举的节点
cluster.initial_master_nodes: ["10.0.0.151","10.0.0.152","10.0.0.153"]1.查看配置信息
[root@elk151 ~]# yy /etc/elasticsearch/elasticsearch.yml
cluster.name: 151edu-linux85
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
discovery.seed_hosts: ["10.0.0.151","10.0.0.152","10.0.0.153"]
cluster.initial_master_nodes: ["10.0.0.151","10.0.0.152","10.0.0.153"]
[root@elk151 ~]#
（三）将配置文件分发到其他两个节点
scp /etc/elasticsearch/elasticsearch.yml 10.0.0.152:/etc/elasticsearch/elasticsearch.yml
scp /etc/elasticsearch/elasticsearch.yml 10.0.0.153:/etc/elasticsearch/elasticsearch.yml分发其他两个节点
[root@elk151 ~]# scp /etc/elasticsearch/elasticsearch.yml 10.0.0.153:/etc/elasticsearch/elasticsearch.yml
The authenticity of host '10.0.0.153 (10.0.0.153)' can't be established.
ECDSA key fingerprint is SHA256:hfSd0fZnZScoy7gV/0yseTwuTfpVlU24t3TDj5q1+nk.
ECDSA key fingerprint is MD5:c0:c6:a4:b5:f5:d3:15:25:e3:bc:2c:b9:a1:9d:a8:cd.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.0.153' (ECDSA) to the list of known hosts.
root@10.0.0.153's password:
elasticsearch.yml 100% 3701 2.1MB/s 00:00
[root@elk151 ~]# scp /etc/elasticsearch/elasticsearch.yml 10.0.0.152:/etc/elasticsearch/elasticsearch.yml
root@10.0.0.152's password:
elasticsearch.yml 100% 3701 2.1MB/s 00:00
[root@elk151 ~]#
另外两个节点查看一下
[root@elk152 ~]# yy /etc/elasticsearch/elasticsearch.yml
cluster.name: edu-linux85
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
discovery.seed_hosts: ["10.0.0.151","10.0.0.152","10.0.0.153"]
cluster.initial_master_nodes: ["10.0.0.151","10.0.0.152","10.0.0.153"]
[root@elk152 ~]#
（四）所有节点启动ES服务
1.主机10.0.0.151启动服务：
[root@elk151 ~]# systemctl enable --now elasticsearch
Created symlink from /etc/systemd/system/multi-user.target.wants/elasticsearch.service to /usr/lib/systemd/system/elasticsearch.service.
2.主机10.0.0.152启动服务
[root@elk151 ~]# systemctl enable --now elasticsearch
Created symlink from /etc/systemd/system/multi-user.target.wants/elasticsearch.service to /usr/lib/systemd/system/elasticsearch.service.
3.主机10.0.0.152启动服务
[root@elk151 ~]# systemctl enable --now elasticsearch
Created symlink from /etc/systemd/system/multi-user.target.wants/elasticsearch.service to /usr/lib/systemd/system/elasticsearch.service.
（五）验证ES集群节点是否正常工作
1.验证ES集群配置成功的标志之一
[root@elk151 ~]# curl 10.0.0.151:9200
{"name" : "elk151.edu.com","cluster_name" : "edu-linux85","cluster_uuid" : "lIXyWpnSQPO4s12VVk3alw", #ES集群配置成功UUID一样"version" : {[root@elk151 ~]# curl 10.0.0.152:9200
{"name" : "elk152.edu.com","cluster_name" : "edu-linux85","cluster_uuid" : "lIXyWpnSQPO4s12VVk3alw",#ES集群配置成功UUID一样"version" : {[root@elk151 ~]# curl 10.0.0.153:9200
{"name" : "elk153.edu.com","cluster_name" : "edu-linux85","cluster_uuid" : "lIXyWpnSQPO4s12VVk3alw",#ES集群配置成功UUID一样"version" : {
2.验证ES集群配置成功的标志之二
[root@elk151 ~]# curl 10.0.0.153:9200/_cat/nodes
10.0.0.153 9 91 22 0.46 0.33 0.18 cdfhilmrstw - elk153.edu.com
10.0.0.152 15 70 25 0.39 0.29 0.19 cdfhilmrstw - elk152.edu.com
10.0.0.151 15 72 26 0.43 0.27 0.18 cdfhilmrstw * elk151.edu.com
[root@elk151 ~]#
3.查看集群日志~oldboyedu-linux85.log
[root@elk151 ~]# ll /var/log/elasticsearch/
total 3076
-rw-r--r-- 1 elasticsearch elasticsearch 62051 8月 26 11:40 gc.log
-rw-r--r-- 1 elasticsearch elasticsearch 2096 8月 26 11:36 gc.log.00
-rw-r--r-- 1 elasticsearch elasticsearch 0 8月 26 11:36 oldboyedu-linux85_audit.json
-rw-r--r-- 1 elasticsearch elasticsearch 0 8月 26 11:36 oldboyedu-linux85_deprecation.json
-rw-r--r-- 1 elasticsearch elasticsearch 0 8月 26 11:36 oldboyedu-linux85_deprecation.log
-rw-r--r-- 1 elasticsearch elasticsearch 0 8月 26 11:36 oldboyedu-linux85_index_indexing_slowlog.json
-rw-r--r-- 1 elasticsearch elasticsearch 0 8月 26 11:36 oldboyedu-linux85_index_indexing_slowlog.log
-rw-r--r-- 1 elasticsearch elasticsearch 0 8月 26 11:36 oldboyedu-linux85_index_search_slowlog.json
-rw-r--r-- 1 elasticsearch elasticsearch 0 8月 26 11:36 oldboyedu-linux85_index_search_slowlog.log
-rw-r--r-- 1 elasticsearch elasticsearch 889606 8月 26 11:40 oldboyedu-linux85.log
-rw-r--r-- 1 elasticsearch elasticsearch 988433 8月 26 11:40 oldboyedu-linux85_server.json
[root@elk151 ~]#
（六）如何集群配置完后发现不成功：uuid不一样或没有多个nodes节点
1.重复步骤三、四
重复的同时注意几点：
1、关闭三个集群服务：systemctl stop elasticsearch.service
2、删除三个集群服务日志、临时文件；rm -rf /var/lib/elasticsearch/* /var/log/elasticsearch/* /tmp/*
3、10.0.0.151主机重新分发配置：
scp /etc/elasticsearch/elasticsearch.yml 10.0.0.152:/etc/elasticsearch/elasticsearch.yml scp /etc/elasticsearch/elasticsearch.yml 10.0.0.153:/etc/elasticsearch/elasticsearch.yml
4、同时启动三台机器：systemctl enable --now elasticsearch
