es集群安装及优化

es主节点
192.168.23.100
es节点
192.168.23.101
192.168.23.102

1.安装主节点

1.去官网下载es的yum包
官网下载地址 https://www.elastic.co/cn/downloads/elasticsearch
根据自己的需要下载对应的包

2.下载好之后把所有的包都传到从节点上，安装

[root@localhost ~]# ansible all -m copy -a 'src=/root/elasticsearch-8.11.3-x86_64.rpm dest=/root/elasticsearch-8.11.3-x86_64.rpm'
192.168.23.102 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "checksum": "64c9029f99fa4beeabae1a36d1a88b8bf44982cf", 
    "dest": "/root/elasticsearch-8.11.3-x86_64.rpm", 
    "gid": 0, 
    "group": "root", 
    "md5sum": "d4b85a836646cd0b8c1d87848bf2e77c", 
    "mode": "0644", 
    "owner": "root", 
    "size": 630669510, 
    "src": "/root/.ansible/tmp/ansible-tmp-1704551077.26-16135-196050427416681/source", 
    "state": "file", 
    "uid": 0
}
192.168.23.101 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "checksum": "64c9029f99fa4beeabae1a36d1a88b8bf44982cf", 
    "dest": "/root/elasticsearch-8.11.3-x86_64.rpm", 
    "gid": 0, 
    "group": "root", 
    "md5sum": "d4b85a836646cd0b8c1d87848bf2e77c", 
    "mode": "0644", 
    "owner": "root", 
    "size": 630669510, 
    "src": "/root/.ansible/tmp/ansible-tmp-1704551077.26-16133-148347610662829/source", 
    "state": "file", 
    "uid": 0
}
[root@localhost ~]# ansible all -m shell -a 'ls /root/'
192.168.23.102 | CHANGED | rc=0 >>
anaconda-ks.cfg
elasticsearch-8.11.3-x86_64.rpm
192.168.23.101 | CHANGED | rc=0 >>
anaconda-ks.cfg
elasticsearch-8.11.3-x86_64.rpm


[root@localhost ~]# ansible all -m shell -a 'yum localinstall /root/elasticsearch-8.11.3-x86_64.rpm -y'
[WARNING]: Consider using the yum module rather than running 'yum'.  If you need to use command because yum is insufficient you can add 'warn: false' to this command task or set 'command_warnings=False' in
ansible.cfg to get rid of this message.
192.168.23.101 | CHANGED | rc=0 >>
Loaded plugins: fastestmirror
Examining /root/elasticsearch-8.11.3-x86_64.rpm: elasticsearch-8.11.3-1.x86_64
Marking /root/elasticsearch-8.11.3-x86_64.rpm to be installed
Resolving Dependencies
--> Running transaction check
---> Package elasticsearch.x86_64 0:8.11.3-1 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package          Arch      Version       Repository                       Size
================================================================================
Installing:
 elasticsearch    x86_64    8.11.3-1      /elasticsearch-8.11.3-x86_64    1.2 G

Transaction Summary
================================================================================
Install  1 Package

Total size: 1.2 G

3.更改主配置文件

[root@localhost ~]# grep -Ev "^#|^$" /etc/elasticsearch/elasticsearch.yml 
cluster.name: ELK cluster            #集群名字，每个节点一样    
node.name: {{ ansible_hostname }}    #每个机器的主机名
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0              # 通讯地址，设置为本机ip或者0.0.0.0，让所有机器都可以访问
discovery.seed_hosts: ["192.168.23.100", "192.168.23.101","192.168.23.102"] #每个节点相同
cluster.initial_master_nodes: ["192.168.23.100"]  #此为选举主节点，如果写一个就默认那一个是主节点，如果写多个，让他们自己去竞争那个是节点
xpack.security.enabled: false   #关闭安全认证
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
http.host: 0.0.0.0

4.写yml吧配置文件传送到 其他节点

[root@es ~]# cat 1.yml 
---
[root@es ~]# cat 1.yml 
[root@es ~]# cat 1.yml 
---
- name: copy es
  hosts: xp
  tasks:
    - name: copy es
      template:
        src: /etc/elasticsearch/elasticsearch.yml
        dest: /etc/elasticsearch/elasticsearch.yml
      notify: restart es
    - name: restart es
      service:
        name: elasticsearch
        enabled: yes
  handlers:
    - name: restart es
      service:
        name: elasticsearch
        state: restarted    

5.运行playbook

[root@es ~]# ansible-playbook 1.yml 

PLAY [copy es] ***************************************************************************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************************************************************************
ok: [192.168.23.101]
ok: [192.168.23.102]

TASK [copy es] ***************************************************************************************************************************************************************************************************
ok: [192.168.23.102]
ok: [192.168.23.101]

TASK [restart es] ************************************************************************************************************************************************************************************************
changed: [192.168.23.102]
changed: [192.168.23.101]

PLAY RECAP *******************************************************************************************************************************************************************************************************
192.168.23.101             : ok=3    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
192.168.23.102             : ok=3    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

此时在访问主节点上的9200端口

内存优化

[root@es ~]# egrep '## -Xm' /etc/elasticsearch/jvm.options
## -Xms4g
## -Xmx4g

#推荐使用物理机的一半，es的heap最大内存不超过30g，26g是最安全的

范例
[root@es ~]# egrep '-Xm' /etc/elasticsearch/jvm.options
-Xms30g
-Xmx30g