搜索引擎ElasticSearch8.X+SpringBoot3.X最佳实践elk/es：从零到生产级，一篇打通全链路

bashcat >> /etc/security/limits.conf <<EOF
* soft nofile 65536
* hard nofile 65536
* soft nproc 65536
* hard nproc 65536
* soft memlock unlimited
* hard memlock unlimited
EOF

bashecho "vm.max_map_count = 262144" >> /etc/sysctl.conf
sysctl -p
# 验证
cat /proc/sys/vm/max_map_count   # 输出 262144 即成功

bashswapoff -a
# 永久禁用：注释掉 /etc/fstab 中的 swap 行

bashsysctl -w net.ipv4.tcp_retries2=5

bashuseradd elasticsearch
passwd elasticsearch

bashcd /data
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.13.2-linux-x86_64.tar.gz
tar -zxvf elasticsearch-8.13.2-linux-x86_64.tar.gz
chown -R elasticsearch:elasticsearch /data/elasticsearch-8.13.2

yaml# ==================== 集群身份 ====================
cluster.name: es-cluster
node.name: es-node1

# ==================== 路径 ====================
path.data: /data/elasticsearch-8.13.2/data
path.logs: /data/elasticsearch-8.13.2/logs

# ==================== 网络 ====================
network.host: 192.168.184.151
http.port: 9200
transport.port: 9300

# ==================== 集群发现 ====================
discovery.seed_hosts: ["192.168.184.151:9300", "192.168.184.152:9300", "192.168.184.153:9300"]
cluster.initial_master_nodes: ["es-node1", "es-node2", "es-node3"]

# ==================== 内存锁定 ====================
bootstrap.memory_lock: true

# ==================== 跨域（Kibana 需要） ====================
http.cors.enabled: true
http.cors.allow-origin: "*"
http.cors.allow-headers: Authorization,X-Requested-With,Content-Type,Content-Length

# ==================== 安全（生产必开，测试可关） ====================
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /data/elasticsearch-8.13.2/config/certificates/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /data/elasticsearch-8.13.2/config/certificates/elastic-certificates.p12

bashcd /data/elasticsearch-8.13.2

# 生成 CA 证书（有效期 10 年）
./bin/elasticsearch-certutil ca --days 3650 --pem --out ca.zip
unzip ca.zip

# 生成节点间通信证书
./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --days 3650 --pem --out node-certs.zip
unzip node-certs.zip

# 将证书复制到 config 目录
mkdir -p config/certificates
mv ca/ca.crt config/certificates/
mv ca/ca.key config/certificates/
mv node-certs/*.crt config/certificates/
mv node-certs/*.key config/certificates/

bashvim config/jvm.options

# 生产环境建议 4G，测试环境 1G 够用
-Xms1g
-Xmx1g

bash# 切换到 ES 专用用户
su - elasticsearch

# 后台启动（nohup 防止会话断开）
nohup /data/elasticsearch-8.13.2/bin/elasticsearch >/dev/null 2>&1 &

bash./bin/elasticsearch-setup-passwords interactive

bashcurl -u "elastic:你的密码" http://192.168.184.151:9200/_cat/nodes

192.168.184.151 36 98 2 0.16 0.11 0.13 cdfhilmrstw - es-node1
192.168.184.152 66 91 6 0.03 0.10 0.13 cdfhilmrstw - es-node2
192.168.184.153 38 98 7 0.09 0.14 0.16 cdfhilmrstw * es-node3

bashcurl -u "elastic:你的密码" http://192.168.184.151:9200/_cat/health

1692270404 11:06:44 es-cluster green 3 3 3213 1653 0 0 0 0 - 100.0%

用户查询 "AI 大模型"
        │
        ▼
┌─────────────────────────────────┐
│  Broker（协调节点）接收查询       │
│  ↓ 查询并行分发到所有分片          │
│  ┌──────┐ ┌──────┐ ┌──────┐    │
│  │分片1 │ │分片2 │ │分片3 │ ... │  ← 并行检索！
│  │Node1 │ │Node1 │ │Node2 │    │
│  └──┬───┘ └──┬───┘ └──┬───┘    │
│     └────────┼────────┘         │
│              ▼                   │
│     结果汇总 → 排序 → 返回用户     │
└─────────────────────────────────┘

yaml# application.yml
spring:
  elasticsearch:
    uris: http://192.168.184.151:9200
    username: elastic
    password: 你的密码
    index:
      auto-create: false  # 生产关掉自动建索引

java@Document(indexName = "products")
public class Product {
    @Id
    private String id;
    private String name;
    @Field(type = FieldType.Text, analyzer = "ik_max_word")
    private String description;
    private Double price;
}