单台机器搭建3节点ES集群，本文采用elasticsearch7.2做为安装版本，linux 为centos 。理由是7.2版本是目前（2020-02-29）ES认证工程师考试的版本。到官网下载ES7.2版本，

下载安装

下载地址：https://www.elastic.co/cn/downloads/past-releases/elasticsearch-7-2-0
另外，官网下载有时太慢，华为云提供了相关镜像下载，速度很快，国内的朋友可以直接在华为云下载，下载地址：https://mirrors.huaweicloud.com/elasticsearch/7.2.0/?C=M&O=D

新建用户

由于elasticsearch在linux环境上启动是不允许用root用户，所以新建一个用户：elasticsearch

4.[root@iZm5eex5q5d6ngkvvkkcfxZ bin]# adduser elasticsearch
5.[root@iZm5eex5q5d6ngkvvkkcfxZ bin]# passwd elasticsearch
6.Changing password for user elasticsearch.
7.New password: 
8.BAD PASSWORD: The password is shorter than 8 characters
9.Retype new password: 
10.passwd: all authentication tokens updated successfully.

上传解压

1）在linux服务器上新建文件夹，用于存放ES相关文件：elasticsearch-cluster
2）在elasticsearch-cluster目录下分别创建3个文件夹：elasticsearch1、elasticsearch2、elasticsearch3
3）上传安装包文件：elasticsearch-7.2.0-linux-x86_64.tar.gz 到3个子文件夹下
4）依次解码gz安装包：tar -zxvf elasticsearch-7.2.0-linux-x86_64.tar.gz

集群配置

以其中一个节点的配置为例，其他节点配置相同
1）修改配置文件：cd /usr/elasticsearch-cluster/elasticsearch1/elasticsearch-7.2.0/config

cd /usr/elasticsearch-cluster/elasticsearch1/elasticsearch-7.2.0/config
vi elasticsearch.yml

在文件的最下面添加以下配置：

# 集群名称
cluster.name: myelasticsearch
# 节点名称
node.name: node1
# ip地址,具体根据自己的情况填写
network.host: 172.31.xxx.xxx
# 服务端口号
http.port: 9201
# 集群间通信端口号
transport.tcp.port: 9301
# 设置集群自动发现机器ip集合
discovery.seed_hosts: ["172.31.xxx.xxx:9301", "172.31.xxx.xxx:9302","172.31.xxx.xxx:9303"]
cluster.initial_master_nodes: ["node1","node2","node3"]
node.master: true
network.publish_host: 172.31.xxx.xxx
network.bind_host: 172.31.xxx.xxx

保存退出即可
2）同样的方法修改node2节点配置，注意里面端口的变化：

#集群名称
cluster.name: myelasticsearch
#节点名称
node.name: node2
#ip
network.host: 172.31.xxx.xxx
#服务器端口
http.port: 9202
#集群间通信端口号
transport.tcp.port: 9302
#设置集群自动发现机器IP集合
discovery.seed_hosts: ["172.31.xxx.xxx:9301","172.31.xxx.xxx:9302","172.31.xxx.xxx:9303"]
cluster.initial_master_nodes: ["node1","node2","node3"]
network.publish_host: 172.31.xxx.xxx
network.bind_host: 172.31.xxx.xxx
node.master: true

3）节点node3配置，注意端口号变化：

#集群名称
cluster.name: myelasticsearch
#节点名称
node.name: node3
#ip
network.host: 172.31.xxx.xxx
#服务器端口
http.port: 9203
#集群间通信端口号
transport.tcp.port: 9303
#设置集群自动发现机器IP集合
discovery.seed_hosts: ["172.31.xxx.xxx:9301","172.31.xxx.xxx:9302","172.31.xxx.xxx:9303"]
cluster.initial_master_nodes: ["node1","node2","node3"]
network.publish_host: 172.31.xxx.xxx
network.bind_host: 172.31.xxx.xxx
node.master: true

注意事项：

1.集群名称cluster.name必须相同
2.IP地址要统一，不能有的用127.0.0.1，有的用内网IP地址，否则会报如下错误：
master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster

[2020-02-26T11:55:59,482][WARN ][o.e.c.c.ClusterFormationFailureHelper] [elasticsearch-node-1] master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster, and [cluster.initial_master_nodes] is empty on this node: have discovered []; discovery will continue using [127.0.0.1:9302] from hosts providers and [{elasticsearch-node-1}{DqmvFxBbTMyjt4telpYGyg}{5_HFiJBCReGEXLG5k3eWpg}{127.0.0.1}{127.0.0.1:9301}{ml.machine_memory=8201244672, xpack.installed=true, ml.max_open_jobs=20}] from last-known cluster state; node term 0, last-accepted version 0 in term 0

3.配置文件参数前面要有空格，

image.png

否则会出现以下错误：

image.png

4.linux文件数要增加，如下：

[2020-02-26T11:55:49,468][WARN ][o.e.b.BootstrapChecks    ] [elasticsearch-node-1] max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解决方法：
切换到root用户修改配置sysctl.conf

vi /etc/sysctl.conf 

添加下面配置：

vm.max_map_count=655360

并执行命令：

sysctl -p

然后，重新启动elasticsearch，即可启动成功。
5.启动必须以非root用户启动，咱们就用elasticsearch用户启动，否则会报如下错误：

[2020-02-29T12:47:05,825][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [node1] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root

集群启动与监控

启动

cd /usr/elasticsearch-cluster/elasticsearch3/elasticsearch-7.2.0/bin
./elasticsearch &

看到如下,started说明启动了，由于只起了一个节点，所以没有选主成功，继续起另外的机器就OK：

[2020-02-29T12:43:52,398][WARN ][o.e.n.Node               ] [node3] timed out while waiting for initial discovery state - timeout: 30s
[2020-02-29T12:43:52,407][INFO ][o.e.h.AbstractHttpServerTransport] [node3] publish_address {172.31.xxx.xxx:9203}, bound_addresses {172.31.xxx.xxx:9203}
[2020-02-29T12:43:52,408][INFO ][o.e.n.Node               ] [node3] started

停止，查询对应的进程，然后kill掉即可

ps -ef | grep Elasticsearch | grep -v grep | awk '{print $2}'

三台都启动成功后，查看集群状态(green代表健康)：

[elasticsearch@iZm5eex5q5d6ngkvvkkcfxZ bin]$ curl 172.31.xxx.xxx:9201/_cat/health
1582952647 05:04:07 myelasticsearch green 3 3 31 15 0 0 0 0 - 100.0%

至此集群搭建完成