下载安装就不说了，自行参考官网，很简单。

首先需要JAVA环境，安装JDK，然后安装

rpm -Uvh jdk-8u74-linux-x64.rpm[root@k4274v /home/elk]# java -versionjava version "1.8.0_74"Java(TM) SE Runtime Environment (build 1.8.0_74-b02)Java HotSpot(TM) 64-Bit Server VM (build 25.74-b02, mixed mode)

目录结构：/usr/local/elk

├── apache-maven-3.3.9 //安装分词插件要用到├── elasticsearch-2.3.5└── kibana-4.5.4-linux-x64

配置文件：elasticsearch.yml

# ======================== Elasticsearch Configuration =========================## NOTE: Elasticsearch comes with reasonable defaults for most settings.#       Before you set out to tweak and tune the configuration, make sure you#       understand what are you trying to accomplish and the consequences.## The primary way of configuring a node is via this file. This template lists# the most important settings you may want to configure for a production cluster.## Please see the documentation for further information on configuration options:# 
    
     ## ---------------------------------- Cluster -----------------------------------## Use a descriptive name for your cluster:# cluster.name: mycluster## ------------------------------------ Node ------------------------------------## Use a descriptive name for the node:# node.name: bjcc-${HOSTNAME} //bjcc机房-主机名## Add custom attributes to the node:## node.rack: r1## ----------------------------------- Paths ------------------------------------## Path to directory where to store the data (separate multiple locations by comma):## path.data: /path/to/data## Path to log files:## path.logs: /path/to/logs## snapshot repo path.repo: ["/usr/local/elk/snapshot"] //快照存储路径## Make sure that the `ES_HEAP_SIZE` environment variable is set to about half the memory# available on the system and that the owner of the process is allowed to use this limit.## Elasticsearch performs poorly when the system is swapping the memory.## ---------------------------------- Network -----------------------------------## Set the bind address to a specific IP (IPv4 or IPv6):# network.host: 10.20.20.202 //服务器的IP地址，通过ifconfig查看## Set a custom port for HTTP:# http.port: 9200## For more information, see the documentation at:# 
     
      ## --------------------------------- Discovery ----------------------------------## Pass an initial list of hosts to perform discovery when new node is started:# The default list of hosts is ["127.0.0.1", "[::1]"]# discovery.zen.ping.unicast.hosts: ["10.20.20.201", "10.20.20.203", "10.20.20.204"] //配置集群的IP地址## Prevent the "split brain" by configuring the majority of nodes (total number of nodes / 2 + 1):## discovery.zen.minimum_master_nodes: 3## For more information, see the documentation at:# 
      
       ## ---------------------------------- Gateway -----------------------------------## Block initial recovery after a full cluster restart until N nodes are started:## gateway.recover_after_nodes: 3## For more information, see the documentation at:# 
       
        ## ---------------------------------- Various -----------------------------------## Disable starting multiple nodes on a single system:# node.max_local_storage_nodes: 1## Require explicit names when deleting indices:## action.destructive_requires_name: true# 关闭自动创建索引，开启自动创建mapping action.auto_create_index: false index.mapper.dynamic: true
       
      
     
    

注意：ElasticSearch的配置文件，必须以一个空格开头，不然就报错，挺弱智的！

启动脚本：/etc/init.d/elasticsearch

官方提供的安全重启集群节点的方法

第一步：先暂停集群的shard自动均衡curl -s -XPUT http://$SERVER_IP:9200/_cluster/settings -d '{"transient" : {"cluster.routing.allocation.enable" : "none"}}' > /dev/null第二步：kill要升级的节点第三步：恢复集群的shard自动均衡curl -s -XPUT http://$SERVER_IP:9200/_cluster/settings -d '{"transient" : {"cluster.routing.allocation.enable" : "all"}}' > /dev/null

#!/bin/bash#chkconfig: 2345 55 24#description: elasticsearch service managerBASE='/usr/local/elk/elasticsearch-2.3.5'KIBBIN=$BASE'/bin/kibana'LOCK=$BASE'/elasticsearch.lock'SERVER_IP=`/sbin/ifconfig eth0|sed -n 2p|awk  '{ print $2 }'|awk -F : '{ print $2 }'`START() {    if [ -f $LOCK ];then        echo -e "elasticsearch is already \033[32mrunning\033[0m, do nothing."    else        echo -e "Starting elasticsearch service..."        cd  $BASE/bin        ./elasticsearch -d        touch $LOCK        sleep 10 #wait es to start        curl -s -XPUT http://$SERVER_IP:9200/_cluster/settings -d '{"transient" : {"cluster.routing.allocation.enable" : "all"}}' > /dev/null        echo -e "\n\033[32mdone\033[m"    fi}STOP() {    if [ ! -f $LOCK ];then        echo -e "elasticsearch is already stop, do nothing."    else        echo -e "Stop elasticsearch serivce"        rm -rf $LOCK        curl -s -XPUT http://$SERVER_IP:9200/_cluster/settings -d '{"transient" : {"cluster.routing.allocation.enable" : "none"}}' > /dev/null        ps -ef | grep elasticsearch | grep -v "grep" | awk '{print $2}' | xargs kill -s 9 >/dev/null        echo -e "\033[32mdone\033[m"    fi}STATUS() {        Port=$(netstat -tunl | grep ":9200")    if [ "$Port" != "" ] && [ -f $LOCK ];then        echo -e "elasticsearch is: \033[32mrunning\033[0m..."    else        echo -e "elasticsearch is: \033[31mstopped\033[0m..."    fi} case "$1" in  start)    START    ;;  stop)    STOP    ;;  status)    STATUS    ;;  restart)    STOP     sleep 2    START    ;;  *)    echo "Usage: /etc/init.d/elasticsearch (|start|stop|status|restart)"    ;;esac

启动服务：

chmod +x /etc/init.d/elasticsearchchkconfig elasticsearchservice elasticsearch start

安装插件

./bin/plugin install mobz/elasticsearch-head //head插件git clone https://github.com/medcl/elasticsearch-analysis-ik.git --depth=1 //IK分词插件./bin/plugin install lmenezes/elasticsearch-kopf/{branch|version}

配置Nginx

upstream es_cluster {    server 10.20.20.201:9200;    server 10.20.20.202:9200;    server 10.20.20.203:9200;    server 10.20.20.204:9200;    keepalive 15;}upstream kibana4 {    server 10.20.20.201:5601 fail_timeout=0;}server {    listen 8360;    server_name  es.xxx.com;    access_log   /data/nginx/logs/es.log;    error_log    /data/nginx/logs/es.error.log;    location ~ (/app/kibana|/bundles/|/kibana4|/status|/plugins|/api/status/|/elasticsearch|/app/sense) {        proxy_pass http://kibana4;        proxy_http_version 1.1;        proxy_set_header Host $host;        proxy_set_header Connection "Keep-Alive";        proxy_set_header Proxy-Connection "Keep-Alive";        rewrite /kibana4/(.*)$ /$1 break;    }    location / {        proxy_pass http://es_cluster;        proxy_set_header     X-Forwarded-For $proxy_add_x_forwarded_for;        proxy_set_header     Host            $host;    }}