下载 & 解压

# can not run elasticsearch as root 

adduer elk
su elk
cd ~

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.13.0-linux-x86_64.tar.gz

wget https://artifacts.elastic.co/downloads/kibana/kibana-7.13.0-linux-x86_64.tar.gz



tar -zxvf elasticsearch-7.13.0-linux-x86_64.tar.gz
tar -zxvf  kibana-7.13.0-linux-x86_64.tar.gz

启动

elasticsearch-7.13.0/bin/elasticsearch -d
nohup  kibana-7.13.0-linux-x86_64/bin/kibana &

curl http://localhost:9300/
http://localhost:5601

开启远程访问端口

vi /home/elk/elasticsearch-7.13.0/config/elasticsearch.yml
network.host: 39.96.*.* # 注意阿里云内网IP
vi /home/elk/kibana-7.13.0-linux-x86_64/config/kibana.yml 
server.host: "0.0.0.0"


# 使用kill 进行重启

iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 9200 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 5601 -j ACCEPT

note: 阿里云记得开放安全端口

启动失败，检查没有通过，报错

[2018-05-18T17:44:59,658][INFO ][o.e.b.BootstrapChecks    ] [gFOuNlS] bound or publishing to a non-loopback address, enforcing bootstrap checks
ERROR: [2] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

[2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

[1]: max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536]

切换到root用户

编辑 /etc/security/limits.conf，追加以下内容；
* soft nofile 65536
* hard nofile 65536
此文件修改后需要重新登录用户，才会生效
[2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

编辑 /etc/sysctl.conf，追加以下内容：
vm.max_map_count=655360
保存后，执行：
sysctl -p

重新启动，成功。
bin/elasticsearch -d

总结

问题一大堆，如果是测试环境还是用docker 吧。