RPM 方式

集群规划

操作系统：Rocky Linux 9

主机配置：2C 4G 50G 主机 x 3

主机名及 IP：

• 192.168.1.25 elk01

• 192.168.1.26 elk02

• 192.168.1.27 elk03

部署（3台主机分别执行）

安装

curl -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.17.5-x86_64.rpm

rpm -ivh elasticsearch-7.17.5-x86_64.rpm

修改配置

# 修改配置项
vim /etc/elasticsearch/elasticsearch.yml
# grep -Ev "^[[:space:]]*#|^$" /etc/elasticsearch/elasticsearch.yml
cluster.name: ELK-Cluster
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
discovery.seed_hosts: ["192.168.1.25","192.168.1.26","192.168.1.27"]
cluster.initial_master_nodes: ["192.168.1.25","192.168.1.26","192.168.1.27"]

启动

# systemctl daemon-reload
systemctl enable --now elasticsearch

验证

curl 192.168.1.25:9200
curl 192.168.1.26:9200
curl 192.168.1.27:9200

curl 192.168.1.25:9200/_cat/nodes
curl 192.168.1.25:9200/_cat/nodes?v

关掉 elk02 机器后（带 * 的为主节点）

为保证集群正常提供服务需要保证半数以上节点可用（脑裂机制）

查看API

curl 192.168.1.25:9200/_cat
=^.^=
/_cat/allocation
/_cat/shards
/_cat/shards/{index}
/_cat/master
/_cat/nodes
/_cat/tasks
/_cat/indices
/_cat/indices/{index}
/_cat/segments
/_cat/segments/{index}
/_cat/count
/_cat/count/{index}
/_cat/recovery
/_cat/recovery/{index}
/_cat/health
/_cat/pending_tasks
/_cat/aliases
/_cat/aliases/{alias}
/_cat/thread_pool
/_cat/thread_pool/{thread_pools}
/_cat/plugins
/_cat/fielddata
/_cat/fielddata/{fields}
/_cat/nodeattrs
/_cat/repositories
/_cat/snapshots/{repository}
/_cat/templates
/_cat/ml/anomaly_detectors
/_cat/ml/anomaly_detectors/{job_id}
/_cat/ml/trained_models
/_cat/ml/trained_models/{model_id}
/_cat/ml/datafeeds
/_cat/ml/datafeeds/{datafeed_id}
/_cat/ml/data_frame/analytics
/_cat/ml/data_frame/analytics/{id}
/_cat/transforms
/_cat/transforms/{transform_id}