1.环境准备
1.1 关闭防火墙/selinux
注：如果防火墙有要求，可以不关闭，进行策略调整
systemctl disable --now firewalld #永久关闭加关闭开机启动
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/sysconfig/selinux
#永久关闭
setenforce 0 #临时关闭
1.2 创建es用户和组
由于es禁用root启动，需要新建用户组给与es使用
groupadd es #建组
useradd es -g es #新建用户，添加指定组
1.3 修改打开文件数和进程数
echo "vm.max_map_count=262144" >>/etc/sysctl.conf
sysctl -p
cat /etc/security/limits.conf
* hard nofile 65536
* soft nofile 65536
* hard nproc 65535
* soft nproc 65535
cat /etc/security/limits.d/20-nproc.conf
* soft nproc 65535
* soft nofile 65535
* hard nofile 65535
*hard nproc 65535
2 安装jdk
安装jdk的方法有很多种，这边采用的是RPM方式，这样可以省去环境变量的配置
安装结束，确认版本信息
3 安装es
3.1 创建数据及日志目录
可以单独为es数据及日志创建一个挂载点，大小以自己实际数据量来决定
mkdir -p /data/elasticsearch781/{data,logs}
chown es:es -R /data/elasticsearch781/ #目录授权给es用户和组
3.2 下载es以及解压
上传elasticsearch-7.8.1-linux-x86_64.tar.gz（可以在es官网下载）到/usr/local
cd /usr/local #安装目录可以自定义
tar -xzvf elasticsearch-7.8.1-linux-x86_64.tar.gz #解压
chown es:es -R /usr/local/elasticsearch-7.8.1 #目录授权给es用户和组
ls /usr/local/elasticsearch-7.8.1 -lh
total 572K
drwxr-xr-x. 2 es es 4.0K Jul 22 2020 bin
drwxr-xr-x. 4 es es 267 Feb 15 10:32 config
drwxr-xr-x. 9 es es 107 Jul 22 2020 jdk
drwxr-xr-x. 3 es es 4.0K Jul 22 2020 lib
-rw-r--r--. 1 es es 14K Jul 22 2020 LICENSE.txt
drwxr-xr-x. 2 es es 4.0K Feb 11 01:00 logs
drwxr-xr-x. 47 es es 4.0K Jul 22 2020 modules
-rw-r--r--. 1 es es 532K Jul 22 2020 NOTICE.txt
drwxr-xr-x. 4 es es 30 Sep 16 2021 plugins
-rw-r--r--. 1 es es 8.0K Jul 22 2020 README.asciidoc
3.3 修改配置文件
配置文件修改
vi /usr/local/elasticsearch-7.8.1/config/elasticsearch.yml主要参数
cluster.name: 集群名称
node.name: 节点名称
path.data:数据路径
path.logs:日志路径
network.host: 主机地址
http.port: es访问端口
discovery.seed_hosts: 主机发现地址
cat /usr/local/elasticsearch-7.8.1/config/elasticsearch.yml | egrep -v "^$|#"
cluster.name: 781-cluster
node.name: 114-781
path.data: /data/elasticsearch781/data
path.repo: /data/elasticsearch781/repo
path.logs: /data/elasticsearch781/logs
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: [10.XXXXXXX] #此处IP打码
cluster.initial_master_nodes: [10.XXXXX] #此处IP打码
3.4 JVM调整
[root@localhost local]# cat /usr/local/elasticsearch-7.8.1/config/jvm.options | grep Xm
## -Xms4g
## -Xmx4g
# Xms represents the initial size of total heap space
# Xmx represents the maximum size of total heap space
-Xms10g
-Xmx10g # 最大最小内存保存一致，官方推荐主机内存的一版，但是不要超过32
3.6 编写启动文件
cat /usr/lib/systemd/system/es.service
[Unit]
Description=Elasticsearch
Documentation=http://www.elastic.co
Wants=network-online.target
After=network-online.target
[Service]
User=es
Group=es
ExecStart=/usr/local/elasticsearch-7.8.1/bin/elasticsearch
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=2s
StandardOutput=journal
StandardError=inherit
# Specifies the maximum file descriptor number that can be opened by this process
LimitNOFILE=65536
# Specifies the maximum number of processes
LimitNPROC=4096
# Specifies the maximum number of bytes of memory that may be locked into RAM
# Set to "infinity" if you use the 'bootstrap.memory_lock: true' option
# in elasticsearch.yml and 'MAX_LOCKED_MEMORY=unlimited' in /etc/sysconfig/elasticsearch
#LimitMEMLOCK=infinity
LimitMEMLOCK=infinity
# Disable timeout logic and wait until process is stopped
TimeoutStopSec=0
# SIGTERM signal is used to stop the Java process
KillSignal=SIGTERM
# Java process is never killed
SendSIGKILL=no
# When a JVM receives a SIGTERM signal it exits with code 143
SuccessExitStatus=143
[Install]
WantedBy=multi-user.target
systemctl daemon-reload
systemctl enable --now es
[root@localhost local]# systemctl status es
● es.service - Elasticsearch
Loaded: loaded (/usr/lib/systemd/system/es.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2022-09-13 17:38:11 CST; 5 months 2 days ago
Docs: http://www.elastic.co
Main PID: 825 (java)
CGroup: /system.slice/es.service
├─ 825 /usr/local/elasticsearch-7.8.1/jdk/bin/java -Xshare:auto -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=...
└─1323 /usr/local/elasticsearch-7.8.1/modules/x-pack-ml/platform/linux-x86_64/bin/controller
Feb 14 01:26:00 localhost.localdomain elasticsearch[825]: [2023-02-14T01:26:00,008][INFO ][o.e.x.m.a.TransportDeleteExpiredDataAction] [114-...ML data
Feb 14 01:26:00 localhost.localdomain elasticsearch[825]: [2023-02-14T01:26:00,008][INFO ][o.e.x.m.MlDailyMaintenanceService] [114-781] Succ...e tasks
Feb 14 09:30:00 localhost.localdomain elasticsearch[825]: [2023-02-14T09:30:00,001][INFO ][o.e.x.s.SnapshotRetentionTask] [114-781] starting...up task
Feb 14 09:30:00 localhost.localdomain elasticsearch[825]: [2023-02-14T09:30:00,002][INFO ][o.e.x.s.SnapshotRetentionTask] [114-781] there ar...omplete
Feb 15 01:26:00 localhost.localdomain elasticsearch[825]: [2023-02-15T01:26:00,000][INFO ][o.e.x.m.MlDailyMaintenanceService] [114-781] trig...e tasks
Feb 15 01:26:00 localhost.localdomain elasticsearch[825]: [2023-02-15T01:26:00,007][INFO ][o.e.x.m.a.TransportDeleteExpiredDataAction] [114-...ed data
Feb 15 01:26:00 localhost.localdomain elasticsearch[825]: [2023-02-15T01:26:00,008][INFO ][o.e.x.m.a.TransportDeleteExpiredDataAction] [114-...ML data
Feb 15 01:26:00 localhost.localdomain elasticsearch[825]: [2023-02-15T01:26:00,008][INFO ][o.e.x.m.MlDailyMaintenanceService] [114-781] Succ...e tasks
Feb 15 09:30:00 localhost.localdomain elasticsearch[825]: [2023-02-15T09:30:00,001][INFO ][o.e.x.s.SnapshotRetentionTask] [114-781] starting...up task
Feb 15 09:30:00 localhost.localdomain elasticsearch[825]: [2023-02-15T09:30:00,002][INFO ][o.e.x.s.SnapshotRetentionTask] [114-781] there ar...omplete
Hint: Some lines were ellipsized, use -l to show in full.
3.5 验证以及报错
curl 10.XXXX:9200
如果启动异常，可以用 tailf /var/log/messages 查看报错信息（由于权限未配置，引发的异常比较常见）。
本人技术有限，如果错误，麻烦指正。谢谢！
