ElasticSearch是一个用Java开发的基于Lucene的搜索服务器。它可以提供一个分布式多用户能力的全文搜索引擎，基于RESTfulweb接口。现阶段它主要为Apache许可条款下的开放源码发布，也是当前流行的企业级搜索引擎。Elasticsearch设计主要用于云计算中，ElasticSearch实时搜索，稳定，可靠，快速，安装使用方便的优点，很好的解决大数据查询缓慢问题。
基于我们是测试使用，我只需在一台上安装就可以了，首先 ElasticSearch是基于java来开发的，所以我们好安装java包。
ELK大家族软件安装链接https://www.elastic.co/downloads
前提需要：
1、java8的jdk环境
2、elasticsearch6.5（chrome谷歌浏览器自己可扩展的head插件）
ElasticSearch
[root@localhost elk]# tar -xavf elasticsearch-5.6.0
[root@localhost elk]# cd elasticsearch-5.6.0
[root@localhost elasticsearch-5.6.0]# vim config/elasticsearch.yml
修改以下几个部分
network.host: 192.168.6.63 #自己所安装的es的地址
http.port: 9200
bootstrap.seccomp: false
path.data: /tmp/elasticsearch/data
path.logs: /tmp/elasticsearch/logs
node.name: node-1
接下来我们启动看看(截图就没有了、会给相同的文字提示)注：以下为转载内容
错误一：
主要原因是已经有提示了：Caused by: java.lang.RuntimeException: can not run elasticsearch as root，说是不能在root用户下运行，接下来我们换个用户来运行
[root@node2 bin]# useradd dashuju
[root@node2 bin]# su - dashuju
[dashuju@node2 ~]$ cd /usr/local/src/elasticsearch-5.6.3/
错误二：
启动后我们发现了错误
[dashuju@node2 bin]$ ./elasticsearch
Exception in thread "main" 2017-11-12 12:17:55,776 main ERROR No log4j2 configuration file found. Using default configuration: logging only errors to the console. Set system property ‘log4j2.debug‘ to show Log4j2 internal initialization logging.
2017-11-12 12:17:56,319 main ERROR Could not register mbeans java.security.AccessControlException: access denied ("javax.management.MBeanTrustPermission" "register")
这也是根据问题原因去解决，解决方法如下：
[root@node2 ~]# yum install -y log4j* ###安装log4j包
[root@node2 ~]# chown dashuju:dashuju -R /usr/local/src/elasticsearch-5.6.3 ###给予elasticsearch权限
错误三：
继续启动：
[dashuju@node2 bin]$ ./elasticsearch
ERROR: [2] bootstrap checks failed ##还有错误，这个是要改文件数，这个因为太多我就不放图了。
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
[2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
我们改一下限制的文件数就可以了
[root@node1 src]# cat /etc/sysctl.conf
vm.max_map_count=655360
[root@node1 src]# cat /etc/security/limits.conf
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096
[root@node1 ~]# sysctl -p
vm.max_map_count = 655360
错误五：
启动的时候说bootstrap的错误，*了Google才看到的原因（https://discuss.elastic.co/t/java-lang-unsupportedoperationexception-on-starting-elasticsearch/64548/2）
在第一个回答的详细回复中看到的信息
[2017-12-12T05:55:17,231][WARN ][o.e.b.JNANatives ] unable to install syscall filter:
java.lang.UnsupportedOperationException: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in
at org.elasticsearch.bootstrap.SystemCallFilter.linuxImpl(SystemCallFilter.java:351) ~[elasticsearch-5.6.0.jar:5.6.0]
at org.elasticsearch.bootstrap.SystemCallFilter.init(SystemCallFilter.java:639) ~[elasticsearch-5.6.0.jar:5.6.0]
at org.elasticsearch.bootstrap.JNANatives.tryInstallSystemCallFilter(JNANatives.java:258) [elasticsearch-5.6.0.jar:5.6.0]
at org.elasticsearch.bootstrap.Natives.tryInstallSystemCallFilter(Natives.java:113) [elasticsearch-5.6.0.jar:5.6.0]
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:111) [elasticsearch-5.6.0.jar:5.6.0]
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:195) [elasticsearch-5.6.0.jar:5.6.0]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:342) [elasticsearch-5.6.0.jar:5.6.0]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:132) [elasticsearch-5.6.0.jar:5.6.0]
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:123) [elasticsearch-5.6.0.jar:5.6.0]
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:67) [elasticsearch-5.6.0.jar:5.6.0]
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:134) [elasticsearch-5.6.0.jar:5.6.0]
at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-5.6.0.jar:5.6.0]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:91) [elasticsearch-5.6.0.jar:5.6.0]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:84) [elasticsearch-5.6.0.jar:5.6.0]
解决方式是：
[root@localhost elasticsearch-5.6.0]# vim config/elasticsearch.yml
bootstrap.seccomp: false
注：###最好重启一下，然后执行一遍
[root@localhost elasticsearch-5.6.0]# reboot now #重启系统
[root@localhost elasticsearch-5.6.0]# ./bin/elasticsearch #启动elasticsearch
之后重启下机器后执行截图为：
head插件：
借鉴文章：