本篇文章主要介绍 Elasticsearch 7.6.2 版本的单节点安装、启动及测试步骤，供初学者参考。测试系统为 CentOS 6.9，JDK 版本为 1.8.0_172。
第一步：下载安装包并上传到测试服务器
下载地址为官网地址：https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.6.2-linux-x86_64.tar.gz。
下载后上传到测试服务器，这里上传到路径：/opt/es下。
第二步：解压安装包
# tar -zxvf elasticsearch-7.6.2-linux-x86_64.tar.gz
第三步：启动 ES 服务
# cd elasticsearch-7.6.2
# ./bin/elasticsearch
报错信息如下：
[2018-07-31T04:25:46,553][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [test242] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:174) ~[elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161) ~[elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) ~[elasticsearch-cli-7.6.2.jar:7.6.2]
at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126) ~[elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-7.6.2.jar:7.6.2]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:105) ~[elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:172) ~[elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.6.2.jar:7.6.2]
... 6 more
可以看到错误原因为：不能用 root 运行 Elasticsearch！！！
那为什么不能用 root 账号运行呢？这是出于系统安全考虑设置的条件。由于 es 可以接收用户输入的脚本并且执行，为了系统安全考虑，es5 之后的都不能使用添加启动参数或者修改配置文件等方法启动了，不允许使用 root 用户启动 es，建议创建一个单独的用户用来运行。
第四步：创建单独系统用户
# adduser elastic
# passwd elastic
第五步：修改目录权限
对于第二步解压缩的包，目录权限目前是 root，需要修改为 elastic。
# cd /opt/es/
# chown -R elastic elasticsearch-7.6.2
# chgrp -R elastic elasticsearch-7.6.2
第六步：切换用户并启动服务
切换新建的用户 elastic，并在此启动 es 服务。
# su elastic
$ cd elasticsearch-7.6.2
$ ./bin/elasticsearch
如果出现如下错误：
[2018-07-31T05:14:58,860][WARN ][o.e.b.JNANatives ] [test242] unable to install syscall filter:
java.lang.UnsupportedOperationException: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed
at org.elasticsearch.bootstrap.SystemCallFilter.linuxImpl(SystemCallFilter.java:342) ~[elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.SystemCallFilter.init(SystemCallFilter.java:617) ~[elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.JNANatives.tryInstallSystemCallFilter(JNANatives.java:260) [elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Natives.tryInstallSystemCallFilter(Natives.java:113) [elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:110) [elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:172) [elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) [elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) [elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161) [elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) [elasticsearch-cli-7.6.2.jar:7.6.2]
at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126) [elasticsearch-7.6.2.jar:7.6.2]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) [elasticsearch-7.6.2.jar:7.6.2]原因是：Centos6 不支持 SecComp，而 ES 默认 bootstrap.system_call_filter 为 true 进行检测，导致检测失败，失败后直接导致ES 不能启动。E3.5 版本以上，直接禁用这个插件即可。
解决方式：修改 elasticsearch.yml。
$ vi config/elasticsearch.yml
添加如下配置：
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
bootstrap.system_call_filter: false
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#再次启动服务，可以看到又出现一些错误导致启动不了，详细如下：
[4] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
[2]: max number of threads [1024] for user [elastic] is too low, increase to at least [4096]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[4]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must
be configured
【1】错误原因是：每个进程最大同时打开文件数太小。可通过下面以下命令查看当前数量：
[root@test242 logs]# ulimit -Hn
4096
[root@test242 logs]# ulimit -Sn
1024
[root@test242 logs]#
解决方法：修改 /etc/security/limits.conf 文件，增加配置：
* soft nofile 65535
* hard nofile 65535用户退出后重新登录生效。
[root@test242 ~]# ulimit -Hn
65535
[root@test242 ~]# ulimit -Sn
65535
[root@test242 ~]#
【2】错误原因是：最大线程个数太低。可通过下面以下命令查看当前数量：
[root@test242 ~]# ulimit -Hu
3838
[root@test242 ~]# ulimit -Su
3838
[root@test242 ~]#
解决方法：修改 /etc/security/limits.conf 文件，增加配置：
* soft nproc 4096
* hard nproc 4096修改 vi /etc/security/limits.d/90-nproc.conf 文件：
* soft nproc 4096
root soft nproc unlimited用户退出后重新登录生效。
[root@test242 ~]# ulimit -Hu
4096
[root@test242 ~]# ulimit -Su
4096
[root@test242 ~]#
【3】错误原因是：JVM 线程数限制数量太低，需要调高。
解决方法：修改 /etc/sysctl.conf 文件，增加配置 vm.max_map_count=262144
执行命令 sysctl -p 使之配置生效。
[root@test242 ~]# sysctl -p
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
vm.max_map_count = 262144
【4】错误原因是：没有指定初始化节点。
解决方法：修改 es 的配置文件 elasticsearch-7.6.2/config/elasticsearch.yml，把 #cluster.initial_master_nodes: ["node-1", "node-2"] 去掉注释后，只保留 node-1。修改后配置如下：
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["node-1"]
#
# For more information, consult the discovery and cluster formation module documentation.
#注销系统用户，重新登录后再次启动 ES：
可以看到服务启动成功了，通过浏览器访问 http://192.168.220.242:9200/ 进行测试，结果页面提示 ERR_CONNECTION_REFUSED：
原因是没有指定 es 网络配置，需要修改 Elasticsearch 的配置文件 elasticsearch.yml，详细如下：
$ vi config/elasticsearch.yml
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 192.168.220.242
#
# Set a custom port for HTTP:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#再次重启服务，通过浏览器访问 http://192.168.220.242:9200/ 进行测试，如果出现如下页面结果，说明服务部署成功并启动成功了。
目前启动时前台启动方式，如果要后台启动服务，启动时添加 -d 参数即可。
后台启动：$ ./bin/elasticsearch -d
查看进程：$ ps -ef |grep java
进程信息如下：
[elastic@test242 elasticsearch-7.6.2]$ ps -ef |grep java
elastic 3944 1 25 11:04 pts/0 00:00:40 /opt/es/elasticsearch-7.6.2/jdk/bin/java -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.locale.providers=COMPAT -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.io.tmpdir=/tmp/elasticsearch-17990411953466674273 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=data -XX:ErrorFile=logs/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m -XX:MaxDirectMemorySize=536870912 -Des.path.home=/opt/es/elasticsearch-7.6.2 -Des.path.conf=/opt/es/elasticsearch-7.6.2/config -Des.distribution.flavor=default -Des.distribution.type=tar -Des.bundled_jdk=true -cp /opt/es/elasticsearch-7.6.2/lib/* org.elasticsearch.bootstrap.Elasticsearch -d
elastic 4023 3170 0 11:07 pts/0 00:00:00 grep java
[elastic@test242 elasticsearch-7.6.2]$