ELK 环境搭建之 elasticsearch

下载&解压

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.5.4.tar.gz
tar zxvf elasticsearch-6.5.4.tar.gz
​

创建用户

由于安装原因，elsearch 不允许使用 root 用户运行，所以必须创建一个用户

groupadd elsearch
useradd elsearch -g elsearch -p elasticsearch
chown -R elsearch:elsearch elasticsearch-6.5.4
cd elasticsearch-6.5.4
sudo -u elsearch ./bin/elasticsearch
​

安装中文分词插件

./bin/elasticsearch-plugin install  https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v6.5.4/elasticsearch-analysis-ik-6.5.4.zip
​

离线 安装插件

wget https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v6.5.4/elasticsearch-analysis-ik-6.5.4.zip
./bin/elasticsearch-plugin install file:/root/elk/elasticsearch-analysis-ik-6.5.4.zip
​

常见错误

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

修改/etc/sysctl.conf 文件，增加配置 vm.max_map_count=262144

vi /etc/sysctl.conf
sysctl -p
​

max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

修改/etc/security/limits.conf 文件，增加配置，用户退出后重新登录生效

*     soft    nofile          65536
*     hard    nofile          65536
​

测试

curl -H "Content-Type:application/json" -X PUT 'localhost:9200/accounts' -d '
{
  "mappings": {
    "person": {
      "properties": {
        "user": {
          "type": "text",
          "analyzer": "ik_max_word",
          "search_analyzer": "ik_max_word"
        },
        "title": {
          "type": "text",
          "analyzer": "ik_max_word",
          "search_analyzer": "ik_max_word"
        },
        "desc": {
          "type": "text",
          "analyzer": "ik_max_word",
          "search_analyzer": "ik_max_word"
        }
      }
    }
  }
}'
​

不指定_id 新增

curl -H "Content-Type:application/json" -X POST 'localhost:9200/accounts/person' -d '
{
  "user": "李四",
  "title": "工程师",
  "desc": "系统管理"
}'
​

指定_id 添加记录

	curl -H "Content-Type:application/json" -X PUT 'localhost:9200/accounts/person/1' -d '
{
  "user": "张三",
  "title": "工程师",
  "desc": "数据库管理"
}'
​

修改

curl -H "Content-Type:application/json" -X PUT 'localhost:9200/accounts/person/1' -d '
{
    "user" : "张三",
    "title" : "工程师",
    "desc" : "数据库管理，软件开发"
}'
​

返回所有

curl 'localhost:9200/accounts/person/_search'
​

查询一条

curl 'localhost:9200/accounts/person/1?pretty=true'
​

删除记录

curl -X DELETE 'localhost:9200/accounts/person/1'
​

全文搜索

curl -H "Content-Type:application/json" 'localhost:9200/accounts/person/_search'  -d '
{
  "query" : { "match" : { "desc" : "软件" }},
 
}’
​

条数

curl -H "Content-Type:application/json" 'localhost:9200/accounts/person/_search'  -d '
{
  "query" : { "match" : { "desc" : "软件" }},
"size": 1000
}’
​

偏移

curl -H "Content-Type:application/json" 'localhost:9200/accounts/person/_search'  -d '
{
  "query" : { "match" : { "desc" : "软件" }},
"size": 1000,
"from":1
}'
​

or

curl -H "Content-Type:application/json" 'localhost:9200/accounts/person/_search'  -d '
{
  "query" : { "match" : { "desc" : "软件 系统" }}
}'
​

and

curl -H "Content-Type:application/json" 'localhost:9200/accounts/person/_search'  -d '
{
  "query": {
    "bool": {
      "must": [
        { "match": { "desc": "软件" } },
        { "match": { "desc": "系统" } }
      ]
    }
  }
}'
​