一、下载elasticsearch

下载地址：https://www.elastic.co/cn/downloads/elasticsearch

wget "https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.5.4.tar.gz"
tar -zxf elasticsearch-6.5.4.tar.gz
mv elasticsearch-6.5.4 /usr/local/elasticsearch

修改/etc/rc.local文件，设置为开机启动，追加一下内容：

# Elasticsearch
runuser -l www -c "nohup /usr/local/elasticsearch/bin/elasticsearch > /dev/null 2>&1 &"

二、下载kibana

下载地址：https://www.elastic.co/cn/downloads/kibana

kibana版本需要和elasticsearch版本相同

wget "https://artifacts.elastic.co/downloads/kibana/kibana-6.5.4-linux-x86_64.tar.gz"
tar -zxf kibana-6.5.4-linux-x86_64.tar.gz
mv kibana-6.5.4-linux-x86_64 /usr/local/kibana

修改/etc/rc.local文件，设置为开机启动，追加一下内容：

# Kibana
nohup /usr/local/kibana/bin/kibana  > /dev/null 2>&1 &

三、安装IK中文分词器

IK版本需要和elasticsearch版本相同

下载地址：https://github.com/medcl/elasticsearch-analysis-ik/releases

wget "https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v6.5.4/elasticsearch-analysis-ik-6.5.4.zip"
mkdir /usr/local/elasticsearch/plugins/ik
cp elasticsearch-analysis-ik-6.5.4.zip /usr/local/elasticsearch/plugins/ik
cd /usr/local/elasticsearch/plugins/ik
unzip elasticsearch-analysis-ik-6.5.4.zip

ERROR: [5] bootstrap checks failed

[1]: max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536]

vim /etc/security/limits.conf

追加一下内容：

root soft nofile 65535
root hard nofile 65535
* soft nofile 65536
* hard nofile 65536

[2]: memory locking requested for elasticsearch process but memory is not locked

[3]: max number of threads [1024] for user [www] is too low, increase to at least [4096]

vim /etc/security/limits.d/90-nproc.conf

修改如下内容：

* soft nproc 1024

修改为：

* soft nproc 10240

[4]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

vim /etc/sysctl.conf

追加一下内容：

vm.max_map_count = 655360
sysctl -p

[5]: system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

原因：这是在因为Centos6不支持SecComp，而ES5.2.0默认bootstrap.system_call_filter为true进行检测，所以导致检测失败，失败后直接导致ES不能启动。

在elasticsearch.yml中配置bootstrap.system_call_filter为false，注意要在Memory下面:

bootstrap.memory_lock: false
bootstrap.system_call_filter: false

1、查询所有

POST http://ela.dev.epban.com/bbook/book/_search

{
    "query": {
        "match_all" :{}
    },
    "from": 1,
    "size": 1
}

2、条件查询

POST http://ela.dev.epban.com/bbook/book/_search

{
    "query": {
        "match" :{
            "name": "系统架构"
        }
    }
}

3、聚合查询

POST http://ela.dev.epban.com/bbook_book/index/_search

{
    "query": {
        "multi_match" :{
            "query": "编程语言",
            "fields": ["name", "category"]
        }
    }
}

4、创建索引

PUT http://elasticsearch.gramess.com/bbook_book

POST http://elasticsearch.gramess.com/bbook_book/index/_mapping

{
    "properties": {
        "name": {
            "type" : "text",
            "analyzer": "ik_max_word",
            "search_analyzer": "ik_max_word"
        },
        "category": {
            "type":"text",
            "analyzer": "ik_max_word",
            "search_analyzer": "ik_max_word"
        },
        "location": {
            "type": "keyword"
        },
        "date": {
            "type": "date",
            "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_millis"
        }
    }
}