官网下载软件
解压文件
tar -zxvf elasticsearch-5.6.1.tar.gz -C /usr
重要提示：因为 Elasticsearch 可以执行脚本文件，为了安全性，默认不允许通过 root 用户启动服务。我们需要新创建用户名和用户组启动服务
修改配置文件
1.默认情况下，Elasticsearch 只允许本机访问，如果需要远程访问，需要修改其配置文件
vim config/elasticsearch.yml
# 去掉 network.host 前边的注释，将它的值改成0.0.0.0
network.host: 0.0.0.0
2.启动报错：max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
#使用root命令行键入
ulimit -n 65536
3.启动报错：max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
vim /etc/sysctl.conf
#加入以下配置
vm.max_map_count=262144
保存，并执行 sysctl -p
4.启动时报错：max number of threads [3895] for user [elk] is too low, increase to at least [4096]
/etc/security/limits.d/20-nproc.conf
#修改后的配置文件
# Default limit for number of user's processes to prevent
# accidental fork bombs.
# See rhbz #432903 for reasoning.
* soft nproc 4096
* hard nproc 4096
root soft nproc unlimited
5.启动报错：max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536] max number of threads [1024] for user [lishang] likely too low, increase to at least [2048]
vi /etc/security/limits.conf
添加如下内容:
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096
启动服务
bin/elasticsearch 或 bin/elasticsearch -d # -d 表示后台启动
