ES版本：6.2.4
集群环境：7台机器，每台部署一个master节点。其中3台部署2个hot节点，另外4台部署2个warm节点。共21个节点。
1. 挂盘
按实际情况分盘，一个机子上的2个data节点均分数据磁盘。
通过UUID挂盘，以防止以后换盘，盘符移动（这里拿3个盘举例）。
mkdir -p /data01a/esat
mkdir -p /data02b/esat
mkdir -p /data03c/esat blkid vi /etc/fstab
UUID="f78d2fb8-4b00-4f08-af69-07d533b54a85" /data01a ext4 defaults 0 3
UUID="3cd45d40-e51c-42ce-9b6b-8d2c315a8f9d" /data02b ext4 defaults 0 3
UUID="396e2e59-e92c-4813-a1f1-ed560731a361" /data03c ext4 defaults 0 3 mount -a
2. 创建用户，修改磁盘权限
groupadd esadmin
useradd -g esadmin esadmin
useradd -g esadmin esmaster
useradd -g esadmin esdata chown -R esadmin:esadmin /data01a
chown -R esadmin:esadmin /data02b
chown -R esadmin:esadmin /data03c chmod -R 771 /data*
3. 系统设置
vi /etc/security/limits.conf
@esadmin - nofile 655360
@esadmin - nproc 8192
@esadmin - memlock unlimited
@esadmin - as unlimited
@esadmin - fsize unlimited
vi /etc/sysctl.conf
vm.swappiness = 1
vm.max_map_count = 655300
sysctl -p
4.安装JDK8
rpm -i jdk-8u171-linux-x64.rpm
5. 安装ES
将ES安装文件拷贝到对应目录下。
安装master：
cd /home/esmaster
unzip elasticsearch-6.2.4.zip
修改配置：
vi elasticsearch-6.2.4/config/elasticsearch.yml
cluster.name: es-xx
node.name: master-at-xx
node.master: true
node.data: false
node.ingest: false
search.remote.connect: false bootstrap.memory_lock: true
bootstrap.system_call_filter: false network.host: xx.xx.xx.xx
http.port: 9200
transport.tcp.port: 9300
http.cors.enabled: true
http.cors.allow-origin: "*" discovery.zen.ping.unicast.hosts: ["xx.xx.xx.xx:9300", "xx.xx.xx.xx:9300", "xx.xx.xx.xx:9300", ...]
discovery.zen.minimum_master_nodes: 4
discovery.zen.fd.ping_interval: 10s
discovery.zen.fd.ping_timeout: 60s
discovery.zen.fd.ping_retries: 3 gateway.expected_master_nodes: 7
gateway.recover_after_time: 10m
gateway.recover_after_master_nodes: 4
安装ik分词器：
./elasticsearch-6.2.4/bin/elasticsearch-plugin install file:///home/esmaster/elasticsearch-analysis-ik-6.2.4.zip
chown -R esmaster:esadmin *
安装data：
cd /home/esdata
unzip elasticsearch-6.2.4.zip
修改配置：
vi elasticsearch-6.2.4/config/elasticsearch.yml
cluster.name: es-xx node.name: data-at-40 node.master: false
node.data: true
node.ingest: true
search.remote.connect: true
search.remote.node.attr: gateway node.attr.type: hot
node.attr.gateway: true path.data: ["/data01a/esat", "/data02b/esat", "/data03c/esat", ...] bootstrap.memory_lock: true
bootstrap.system_call_filter: false network.host: xx.xx.xx.xx
http.port: 9201
transport.tcp.port: 9301 http.cors.enabled: true
http.cors.allow-origin: "*"
discovery.zen.ping.unicast.hosts: ["xx.xx.xx.xx:9300", "xx.xx.xx.xx:9300", "xx.xx.xx.xx:9300", ...]
discovery.zen.minimum_master_nodes: 4
discovery.zen.fd.ping_interval: 10s
discovery.zen.fd.ping_timeout: 60s
discovery.zen.fd.ping_retries: 3 gateway.expected_master_nodes: 7
gateway.recover_after_time: 10m
gateway.recover_after_master_nodes: 4
上面是hot节点的配置（node.attr.type: hot），warm节点类似。
安装ik分词器：
./elasticsearch-6.2.4/bin/elasticsearch-plugin install file:///home/esdata/elasticsearch-analysis-ik-6.2.4.zip
chown -R esdata:esadmin *
修改JVM配置文件
vi /home/esmaster/elasticsearch-6.2.4/config/jvm.options
master 修改jvm.options -Xms10g -Xmx10g
vi /home/esdata/elasticsearch-6.2.4/config/jvm.options
data 修改jvm.options -Xms31g -Xmx31g
6 启动
./bin/elasticsearch -p pid -d
7. 启动监控工具head和Bigdesk
unzip es_tools.zip
cd es_tools
nohup python -m SimpleHTTPServer 9080 &
8. 设置索引模板
put _template/app_template
{
"order": 0,
"index_patterns": [ "app_*" ],
"settings": {
"index": {
"unassigned": {
"node_left": {
"delayed_timeout": "10m"
}
},
"routing": {
"allocation": {
"include": {"type": "hot"}
}
},
"refresh_interval": "5s",
"number_of_shards": "1",
"number_of_replicas": "1"
}
},
"mappings": {
"_doc": {
"date_detection": false,
"properties": {
"timestamp": {
"format": "yyyy-MM-dd HH:mm:ss:SSS||yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss||dateOptionalTime",
"type": "date"
},
"@timestamp": {
"format": "yyyy-MM-dd HH:mm:ss:SSS||yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss||dateOptionalTime",
"type": "date"
},
"attimestamp": {
"format": "yyyy-MM-dd HH:mm:ss:SSS||yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd HH:mm:ss||dateOptionalTime",
"type": "date"
},
"ip": {
"type": "ip"
},
"message": {
"search_analyzer": "ik_max_word",
"analyzer": "ik_max_word",
"type": "text"
}
},
"dynamic_templates": [
{
"strings_not_analyzed": {
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
}
]
}
}
}
以上设置所有以“app_”命名的索引的template，默认分配到hot节点。
9.迁移索引
动态修改某个索引到warm节点。如设置"app_index"这个索引到warm节点：
PUT app_index/_settings
{
"index": {
"routing": {
"allocation": {
"include": {"type": "warm"}
}
}
}
}
大于2T的磁盘分区挂载（小于2T的用fdisk）：
[root@168-11-225-68 ~]# mkdir /data
[root@168-11-225-68 ~]# fdisk -l
[root@168-11-225-68 ~]# parted /dev/sdb
(parted) mklabel gpt
(parted) mkpart sdb1 0% 100%
(parted) print
[root@168-11-225-68 ~]# mkfs.ext4 /dev/sdb1
[root@168-11-225-68 ~]# mount /dev/sdb1 /data
[root@168-11-225-68 ~]# df -h
使用配置文件（/etc/fstab）挂盘：
[root@168-11-225-68 ~]# blkid
/dev/sdb1: UUID="e84421b0-bdf3-448c-8561-bf48adced7b3" TYPE="ext4" PARTLABEL="sdb1" PARTUUID="3f9d3296-b613-4224-ab43-33f29110e586"
/dev/sda1: UUID="3ba0d7b0-a6f8-4523-b979-72ba4f691fe3" TYPE="xfs"
/dev/sda2: UUID="M1sg44-aylU-Uxpu-VS01-10Wd-dbvl-2jRVoj" TYPE="LVM2_member"
/dev/mapper/centos-root: UUID="fe151667-8045-429e-94df-d898d90cd060" TYPE="xfs"
/dev/mapper/centos-swap: UUID="29c15603-bb2f-432f-8185-12cc77514269" TYPE="swap"
[root@168-11-225-68 ~]# vi /etc/fstab
UUID="e84421b0-bdf3-448c-8561-bf48adced7b3" /app ext4 defaults 0 0
[root@168-11-225-68 ~]# mount -a
[root@168-11-225-68 ~]# df -h
参考：
https://www.elastic.co/cn/blog/hot-warm-architecture-in-elasticsearch-5-x
https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-cluster.html
https://www.elastic.co/guide/en/elasticsearch/reference/6.2/modules-cross-cluster-search.html
https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html