下载 & 解压
# can not run elasticsearch as root
adduer elk
su elk
cd ~
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.13.0-linux-x86_64.tar.gz
wget https://artifacts.elastic.co/downloads/kibana/kibana-7.13.0-linux-x86_64.tar.gz
tar -zxvf elasticsearch-7.13.0-linux-x86_64.tar.gz
tar -zxvf kibana-7.13.0-linux-x86_64.tar.gz
启动
elasticsearch-7.13.0/bin/elasticsearch -d
nohup kibana-7.13.0-linux-x86_64/bin/kibana &
curl http://localhost:9300/
http://localhost:5601
开启远程访问端口
vi /home/elk/elasticsearch-7.13.0/config/elasticsearch.yml
network.host: 39.96.*.* # 注意阿里云内网IP
vi /home/elk/kibana-7.13.0-linux-x86_64/config/kibana.yml
server.host: "0.0.0.0"
# 使用kill 进行重启
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 9200 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 5601 -j ACCEPT
note: 阿里云记得开放安全端口
启动失败，检查没有通过，报错
[2018-05-18T17:44:59,658][INFO ][o.e.b.BootstrapChecks ] [gFOuNlS] bound or publishing to a non-loopback address, enforcing bootstrap checks
ERROR: [2] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
[2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[1]: max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536]
切换到root用户
编辑 /etc/security/limits.conf，追加以下内容；
* soft nofile 65536
* hard nofile 65536
此文件修改后需要重新登录用户，才会生效
[2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
编辑 /etc/sysctl.conf，追加以下内容：
vm.max_map_count=655360
保存后，执行：
sysctl -p
重新启动，成功。
bin/elasticsearch -d
总结
问题一大堆，如果是测试环境还是用docker 吧。
