因为业务上的需要，我准备试用一下ElasticSearch，但是安装过程也不是很顺利。

环境：Ubuntu16.04 64bit

遇到的问题

1.can not run elasticsearch as root

这个解决办法也简单，新增一个用户，然后分配权限即可

groupadd elasticgroup #添加用户组
useradd elasticuser -g elasticgroup -d /home/elasticuser #添加用户到组里
mv /root/elasticsearch-6.5.4 /home/elasticuser/elasticsearch #把elasticsearch文件夹移到用户目录下
su elasticuser #切换用户为刚才创建的用户
/home/elasticuser/elasticsearch/bin/elasticsearch #启动

2.启动之后也还是报错：max file descriptors [65535] for elasticsearch process is too low … Native controller process has stopped – no new native processes can be started

编辑 /etc/sysctl.conf 文件，添加 fs.file-max=655350 ，然后运行 sysctl -p 即可

3.解决中文分词的插件

在 https://github.com/medcl/elasticsearch-analysis-ik/releases 找到对应ES的版本的链接，复制zip包的链接，然后运行：./bin/elasticsearch-plugin install zip包链接，安装好重启ES即可

接下来尝试用docker-compose部署elasticsearch+fluentd+kibana（截止2018-12-27最新版本）

1.docker-compose.yml

version: '3'
services:
  web:
    image: nginx:latest
    ports:
      - "8081:80"
    links:
      - fluentd
    logging:
      driver: "fluentd"
      options:
        fluentd-address: localhost:24224
    container_name: web

  fluentd:
    build: ./fluentd
    volumes:
      - ./fluentd/conf:/fluentd/etc
    links:
      - "elasticsearch"
    ports:
      - "24224:24224"
      - "24224:24224/udp"
    container_name: fluentd

  elasticsearch:
    build: ./elasticsearch
    expose:
      - 9200
    ports:
      - "9200:9200"
    container_name: elasticsearch

  kibana:
    image: kibana:6.5.4
    links:
      - "elasticsearch"
    ports:
      - "5601:5601"
    container_name: kibana

2.fluentd/conf/fluentd.conf

<source>
  @type forward
  port 24224
  bind 0.0.0.0
</source>
<match *.**>
  @type copy
  <store>
    @type elasticsearch
    host elasticsearch
    port 9200
    logstash_format true
    logstash_prefix fluentd
    logstash_dateformat %Y%m%d
    include_tag_key true
    type_name access_log
    tag_key @log_name
    flush_interval 1s
  </store>
  <store>
    @type stdout
  </store>
</match>

3.fluentd/Dockerfile

FROM fluent/fluentd:v1.3.2-1.0
RUN sudo gem install fluent-plugin-elasticsearch

4.elasticsearch/Dockerfile

FROM elasticsearch:6.5.4

RUN ./bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v6.5.4/elasticsearch-analysis-ik-6.5.4.zip --batch

5.最后 docker-compose up -d 启动即可