machine desc pro trace check pch stop disable oracle

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.4.0.rpm

tar xvf jdk-8u172-linux-x64.tar.gz -C /usr/local/

cat /etc/profile.d/java.sh

JAVA_HOME=/usr/local/jdk1.8.0_172
PATH=$JAVA_HOME/bin:$PATH

. /etc/profile.d/java.sh

echo $PATH
java -version
javac -version

@timestemp是logstash產生的，而不是beats產生的

can not run elasticsearch as root

useradd elasticsearch
su - elasticsearch

/data/software/elasticsearch-6.3.2/bin/elasticsearch

chown elasticsearch.elasticsearch /data/software/elasticsearch-6.3.2/ -R
chown elasticsearch.elasticsearch /data/elasticsearch/ -R

vim /etc/security/limits.conf

End of file

elasticsearch hard nofile 65536
elasticsearch soft nofile 65536

• soft memlock unlimited # 用supervisor啟動，必須設置為*，否則內存無法lock
• hard memlock unlimited # 用supervisor啟動，必須設置為*,否則內存無法lock

test

elasticsearch soft nproc 65535
elasticsearch hard nproc 65535

vi /etc/sysctl.conf
vm.max_map_count=655360

sysctl -p

[elasticsearch@elk1 ~]$ /data/software/elasticsearch-6.3.2/bin/elasticsearch

[2018-09-06T17:54:37,954][INFO ][o.e.n.Node ] [ip-192-168-56-71] initializing ...
[2018-09-06T17:54:38,023][INFO ][o.e.e.NodeEnvironment ] [ip-192-168-56-71] using [1] data paths, mounts [[/ (rootfs)]], net usable_space [92.5gb], net total_space [94.9gb], types [rootfs]
[2018-09-06T17:54:38,024][INFO ][o.e.e.NodeEnvironment ] [ip-192-168-56-71] heap size [1015.6mb], compressed ordinary object pointers [true]
[2018-09-06T17:54:38,025][INFO ][o.e.n.Node ] [ip-192-168-56-71] node name [ip-192-168-56-71], node ID [G1HgmzYsQuq3p3QzwC9OeQ]
[2018-09-06T17:54:38,025][INFO ][o.e.n.Node ] [ip-192-168-56-71] version[6.3.2], pid[4409], build[default/zip/053779d/2018-07-20T05:20:23.451332Z], OS[Linux/3.10.0-327.el7.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0_172/25.172-b11]
[2018-09-06T17:54:38,025][INFO ][o.e.n.Node ] [ip-192-168-56-71] JVM arguments [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.io.tmpdir=/tmp/elasticsearch.MS2IhAKM, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=data, -XX:ErrorFile=logs/hs_err_pid%p.log, -XX:+PrintGCDetails, -XX:+PrintGCDateStamps, -XX:+PrintTenuringDistribution, -XX:+PrintGCApplicationStoppedTime, -Xloggc:logs/gc.log, -XX:+UseGCLogFileRotation, -XX:NumberOfGCLogFiles=32, -XX:GCLogFileSize=64m, -Des.path.home=/data/software/elasticsearch-6.3.2, -Des.path.conf=/data/software/elasticsearch-6.3.2/config, -Des.distribution.flavor=default, -Des.distribution.type=zip]
[2018-09-06T17:54:41,373][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [aggs-matrix-stats]
[2018-09-06T17:54:41,373][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [analysis-common]
[2018-09-06T17:54:41,373][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [ingest-common]
[2018-09-06T17:54:41,373][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [lang-expression]
[2018-09-06T17:54:41,373][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [lang-mustache]
[2018-09-06T17:54:41,373][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [lang-painless]
[2018-09-06T17:54:41,373][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [mapper-extras]
[2018-09-06T17:54:41,373][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [parent-join]
[2018-09-06T17:54:41,374][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [percolator]
[2018-09-06T17:54:41,374][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [rank-eval]
[2018-09-06T17:54:41,374][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [reindex]
[2018-09-06T17:54:41,374][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [repository-url]
[2018-09-06T17:54:41,374][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [transport-netty4]
[2018-09-06T17:54:41,374][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [tribe]
[2018-09-06T17:54:41,374][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [x-pack-core]
[2018-09-06T17:54:41,374][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [x-pack-deprecation]
[2018-09-06T17:54:41,374][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [x-pack-graph]
[2018-09-06T17:54:41,374][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [x-pack-logstash]
[2018-09-06T17:54:41,374][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [x-pack-ml]
[2018-09-06T17:54:41,374][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [x-pack-monitoring]
[2018-09-06T17:54:41,375][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [x-pack-rollup]
[2018-09-06T17:54:41,375][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [x-pack-security]
[2018-09-06T17:54:41,375][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [x-pack-sql]
[2018-09-06T17:54:41,375][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [x-pack-upgrade]
[2018-09-06T17:54:41,375][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] loaded module [x-pack-watcher]
[2018-09-06T17:54:41,375][INFO ][o.e.p.PluginsService ] [ip-192-168-56-71] no plugins loaded
[2018-09-06T17:54:46,769][INFO ][o.e.x.s.a.s.FileRolesStore] [ip-192-168-56-71] parsed [0] roles from file [/data/software/elasticsearch-6.3.2/config/roles.yml]
[2018-09-06T17:54:47,565][INFO ][o.e.x.m.j.p.l.CppLogMessageHandler] [controller/4459] [Main.cc@109] controller (64 bit): Version 6.3.2 (Build 903094f295d249) Copyright (c) 2018 Elasticsearch BV
[2018-09-06T17:54:48,100][DEBUG][o.e.a.ActionModule ] Using REST wrapper from plugin org.elasticsearch.xpack.security.Security
[2018-09-06T17:54:48,480][INFO ][o.e.d.DiscoveryModule ] [ip-192-168-56-71] using discovery type [zen]
[2018-09-06T17:54:49,773][INFO ][o.e.n.Node ] [ip-192-168-56-71] initialized
[2018-09-06T17:54:49,773][INFO ][o.e.n.Node ] [ip-192-168-56-71] starting ...
[2018-09-06T17:54:50,082][INFO ][o.e.t.TransportService ] [ip-192-168-56-71] publish_address {192.168.56.71:9300}, bound_addresses {192.168.56.71:9300}
[2018-09-06T17:54:50,120][INFO ][o.e.b.BootstrapChecks ] [ip-192-168-56-71] bound or publishing to a non-loopback address, enforcing bootstrap checks
[2018-09-06T17:54:53,276][INFO ][o.e.c.s.MasterService ] [ip-192-168-56-71] zen-disco-elected-as-master ([0] nodes joined)[, ], reason: new_master {ip-192-168-56-71}{G1HgmzYsQuq3p3QzwC9OeQ}{XKaq507xRPiusakhR795pw}{192.168.56.71}{192.168.56.71:9300}{ml.machine_memory=1929408512, xpack.installed=true, ml.max_open_jobs=20, ml.enabled=true}
[2018-09-06T17:54:53,282][INFO ][o.e.c.s.ClusterApplierService] [ip-192-168-56-71] new_master {ip-192-168-56-71}{G1HgmzYsQuq3p3QzwC9OeQ}{XKaq507xRPiusakhR795pw}{192.168.56.71}{192.168.56.71:9300}{ml.machine_memory=1929408512, xpack.installed=true, ml.max_open_jobs=20, ml.enabled=true}, reason: apply cluster state (from master [master {ip-192-168-56-71}{G1HgmzYsQuq3p3QzwC9OeQ}{XKaq507xRPiusakhR795pw}{192.168.56.71}{192.168.56.71:9300}{ml.machine_memory=1929408512, xpack.installed=true, ml.max_open_jobs=20, ml.enabled=true} committed version [1] source [zen-disco-elected-as-master ([0] nodes joined)[, ]]])
[2018-09-06T17:54:53,382][INFO ][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [ip-192-168-56-71] publish_address {192.168.56.71:9200}, bound_addresses {192.168.56.71:9200}
[2018-09-06T17:54:53,383][INFO ][o.e.n.Node ] [ip-192-168-56-71] started
[2018-09-06T17:54:53,810][WARN ][o.e.x.s.a.s.m.NativeRoleMappingStore] [ip-192-168-56-71] Failed to clear cache for realms [[]]
[2018-09-06T17:54:53,858][INFO ][o.e.l.LicenseService ] [ip-192-168-56-71] license [5b82337e-9ce8-4f9d-bae7-a86d2065b81c] mode [basic] - valid
[2018-09-06T17:54:53,878][INFO ][o.e.g.GatewayService ] [ip-192-168-56-71] recovered [0] indices into cluster_state

unzip setuptools-38.5.1.zip
python setup.py install
easy_install pip
pip install supervisor

mkdir /etc/supervisor/conf.d/ -p

vim /etc/supervisor/supervisord.conf

[unix_http_server]
file=/var/run/supervisor.sock ; (the path to the socket file)
chmod=0700 ; sockef file mode (default 0700)

[supervisord]
logfile=/var/log/supervisor/supervisord.log ; (main log file;default $CWD/supervisord.log)
pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
childlogdir=/var/log/supervisor ; (‘AUTO‘ child log dir, default $TEMP)
logfile_maxbytes=500MB
logfile_backups=10
loglevel=info ; (log level;default info; others: debug,warn,trace)
nodaemon=false ; (start in foreground if true;default false)
minfds=655350 ; (min. avail startup file descriptors;default 1024)
minprocs=65535 ; (min. avail process descriptors;default 200)

[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

[supervisorctl]
serverurl=unix:///var/run/supervisor.sock ; use a unix:// URL for a unix socket

[include]
files = /etc/supervisor/conf.d/*.conf

mkdir /var/log/supervisor/
mkdir /data/supervisord/logs -p

supervisord -c /etc/supervisor/supervisord.conf
supervisorctl -c /etc/supervisor/supervisord.conf shutdown

[program:elasticsearch]
directory = /data/software/elasticsearch-6.3.2
command = /data/software/elasticsearch-6.3.2/bin/elasticsearch
autostart = true
startsecs = 10
autorestart = true
startretries = 3
user = elasticsearch
stdout_logfile_maxbytes = 4096MB
stdout_logfile_backups = 10
stdout_logfile = /data/supervisord/logs/elasticsearch.log
redirect_stderr=true

如果用supervisor啟動，需要重啟操作系統，不然會一直報無法鎖住內存

ELK 6.3.2 安裝