一、安装

1、创建用户：

创建用户：useradd esuser
设置密码：passwd esuser

2、赋予权限：

chgrp -R esuser ./es
chown -R esuser ./es
chmod 777 es

3、编辑elasticsearch.yml

node.name: node-1 #配置当前es节点名称（默认是被注释的，并且默认有一个节点名）
cluster.name: my-application #默认是被注释的，并且默认有一个集群名

path.data: /home/es/data # 数据目录位置
path.logs: /home/es/logs # 日志目录位置
network.host: 0.0.0.0   #绑定的ip：默认只允许本机访问，修改为0.0.0.0后则可以远程访问
cluster.initial_master_nodes: ["node-1", "node-2"] #默认是被注释的 设置master节点列表 用逗号分隔

4、修改系统配置

vi /etc/security/limits.conf
添加  * soft nofile 65536
      * hard nofile 65536
vim /etc/sysctl.conf
添加  vm.max_map_count=655360
执行 sysctl -p

二、解决报错

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
解决：vim /etc/sysctl.conf
//在最后一行上加上
vm.max_map_count=262144
//保存退出,执行/sbin/sysctl -p 立即生效

三、设置密码

1、配置文件中添加

xpack.security.enabled: true
xpack.license.self_generated.type: basic
xpack.security.transport.ssl.enabled: true

2、执行

./bin/elasticsearch-setup-passwords interactive

3、账号：elastic

四、配置多数据目录

1、修改elasticsaerch.yml文件

path.data: /data/elasticsearch-7.16.3/data,/data1/esdata

2、给新添加的目录写入权限

chmod 777 /data1/esdata

五、ES设置

1、关闭只读状态

PUT _all/_settings
{
  "index.blocks.read_only_allow_delete": null
}

2、设置阀值

PUT _all/_settings
{
    "transient": {
       "cluster.routing.allocation.disk.watermark.low": "85%",
       "cluster.routing.allocation.disk.watermark.high": "90%",
       "cluster.info.update.interval": "1m"
    }
}

3、设置最大返回数

PUT _all/_settings
{
  "index.max_result_window": 20000000
}

六、es分布式：

1、安装好需要扩展的es节点

2、在主节点上配置证书：

cd /usr/share/elasticsearch/bin
./elasticsearch-certutil ca  # 默认回车，输入密码
./elasticsearch-certutil cert --ca elastic-stack-ca.p12  # 输入密码，默认回车，输入密码

3、将生成的elastic-certificates.p12、elastic-stack-ca.p12传送至其他节点

4、ES节点将密码添加至elasticsearch-keystore并传到其他节点(传到其他节点后每个节点都需要重新做赋权操作chown -R)

cd /usr/share/elasticsearch/bin
sudo ./elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
sudo ./elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password

5、配置elasticsearch.yml文件

cluster.name: elasticsearch
node.name: node-3
network.host: 0.0.0.0

http.port: 9200

discovery.seed_hosts: ["172.16.33.250:9300","172.16.33.251:9300"] 
cluster.initial_master_nodes: ["node-1","node-2", "node-3"]

transport.tcp.port: 9300
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /data/elasticsearch-7.16.3/config/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /data/elasticsearch-7.16.3/config/elastic-certificates.p12

xpack.monitoring.collection.cluster.stats.timeout: '30s'

6、启动需要扩展的es节点，保证正常，最后重启主节点es

详细可参考博客：ES分布式部署步骤-CSDN博客

七、ES分片设置

1、手动迁移

_cluster/settings  POST

{
  "commands": [
    {
      "move": {
        "index": "pack_record_index_201709",
        "shard": 2,
        "from_node": "node-125",
        "to_node": "node-3"
      }
    }
  ]
}

释义：
    index 索引名
    shard 分片序号
    from_node 来自哪个节点
    to_node  去哪个节点

2、自动迁移

从集群策略中排除掉该ip节点，es便会自动将该节点的分片移动到其他节点
{
  "transient": {
    "cluster.routing.allocation.exclude._ip": "172.16.33.250"
  }
}

取消集群策略中排除的ip
{
  "transient": {
    "cluster.routing.allocation.exclude._ip": null
  }
}

3、关闭分片自动转移

_cluster/settings   POST
{
"transient":{
   "cluster.routing.allocation.enable":"none"
 }
}

4、关闭自动转移后，开启分片自动转移

_cluster/settings   POST
{
"transient":{
   "cluster.routing.allocation.enable":"all"
 }
}

八、ES设置

ElasticSearch Index Settings_index.max_docvalue_fields_search-CSDN博客

九、自定义分词

{
    "settings":{
        "number_of_shards":"30",
        "number_of_replicas":"1",
        "analysis":{
            "analyzer":{
                "num_analyzer":{
                    "type":"pattern",
                    "pattern":"\\."
                },
                "ik":{
                    "tokenizer":"ik_max_word"
                }
            }
        }
    },
    "mappings":{
        "properties":{
            "databaseId":{
                "type":"integer"
            },
            "tableId":{
                "type":"integer"
            },
            "id":{
                "type":"text"
            },
            "title":{
                "type":"text"
            },
            "content":{
                "type":"text"
            },
            "author":{
                "type":"text",
                "analyzer": "num_analyzer"
            },
            "source":{
                "type":"text"
            },
            "abstracts":{
                "type":"text"
            },
            "createTime":{
                "type":"date",
                "format":"yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_millis"
            }
        }
    }
}