Elasticsearch 设置密码,并配置 Kinaba 和 Filebeat
1、Elasticsearch 设置密码
-
1.1 没有设置密码,使用
curl localhost:9200
命令:
-
1.2 进入Elasticsearch 的安装目录,并进入config 文件夹。
-
1.3 使用
vim elasticsearch.yml
命令,修改config 文件夹下 elasticsearch.yml 文件。
-
1.4 在elasticsearch.yml文件的最后一行添加
xpack.security.enabled: true
,开源版本默认是关闭的。
-
1.5 返回到 elasticsearch 的安装路径,然后使用命令
./bin/elasticsearch -d
重新启动 ES (这一步非常重要,必须启动才能新增用户名和密码);
-
1.6.1 出现报错
报错信息如下:
Future versions of Elasticsearch will require Java 11; your Java version from [/usr/local/soft/java/jdk1.8.0_271/jre] does not meet this requirement. Consider switching to a distribution of Elasticsearch with a bundled JDK. If you are already using a distribution with a bundled JDK, ensure the JAVA_HOME environment variable is not set.
Future versions of Elasticsearch will require Java 11; your Java version from [/usr/local/gk_self/soft/java/jdk1.8.0_271/jre] does not meet this requirement. Consider switching to a distribution of Elasticsearch with a bundled JDK. If you are already using a distribution with a bundled JDK, ensure the JAVA_HOME environment variable is not set.
[gkit@ecs-d809-0001 elasticsearch-7.11.2]$ uncaught exception in thread [main]
java.lang.IllegalStateException: failed to obtain node locks, tried [[/home/gkit/apps/elasticsearch-7.11.2/data]] with lock id [0]; maybe these locations are not writable or multiple nodes were started without increasing [node.max_local_storage_nodes] (was [1])?
at org.elasticsearch.env.NodeEnvironment.<init>(NodeEnvironment.java:292)
at org.elasticsearch.node.Node.<init>(Node.java:351)
at org.elasticsearch.node.Node.<init>(Node.java:278)
at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:216)
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:216)
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:387)
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159)
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150)
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:75)
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:116)
at org.elasticsearch.cli.Command.main(Command.java:79)
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115)
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:81)
For complete error details, refer to the log at /home/apps/elasticsearch-7.11.2/logs/elasticsearch.log
- 1.6.2 解决:(杀死 elasticsearch 进程,然后重启elasticsearch )
- 1.7 以交互的方式设置用户名和密码:(记住你所设置的密码)
命令:./bin/elasticsearch-setup-passwords interactive
- 1.8.1 再次出现报错
报错信息如下:
Future versions of Elasticsearch will require Java 11; your Java version from [/usr/local/gk_self/soft/java/jdk1.8.0_271/jre] does not meen with a bundled JDK, ensure the JAVA_HOME environment variable is not set.
Unexpected response code [500] from calling GET http://192.168.1.15:9200/_security/_authenticate?pretty
It doesn't look like the X-Pack security feature is enabled on this Elasticsearch node.
Please check if you have enabled X-Pack security in your elasticsearch.yml configuration file.
ERROR: X-Pack Security is disabled by configuration.
- 1.8.2 解决: 重新修改config 文件夹中的elasticsearch.yml 文件
、
- 1.8.3 回到 elasticsearch 安装目录,重启服务。
- 1.9 再次使用
./bin/elasticsearch-setup-passwords interactive
命令,设置密码。
Future versions of Elasticsearch will require Java 11; your Java version from [/usr/local/gk_self/soft/java/jdk1.8.0_271/jre] does not meet this requirement. Consider switching to a distribution of Elasticsearch with a bundled JDK. If you are already using a distribution with a bundled JDK, ensure the JAVA_HOME environment variable is not set.
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y
Enter password for [elastic]:
Reenter password for [elastic]:
Passwords do not match.
Try again.
Enter password for [elastic]:
Reenter password for [elastic]:
Passwords do not match.
Try again.
Enter password for [elastic]:
Reenter password for [elastic]:
Enter password for [apm_system]:
Reenter password for [apm_system]:
Enter password for [kibana_system]:
Reenter password for [kibana_system]:
Enter password for [logstash_system]:
Reenter password for [logstash_system]:
Enter password for [beats_system]:
Reenter password for [beats_system]:
Enter password for [remote_monitoring_user]:
Reenter password for [remote_monitoring_user]:
Changed password for user [apm_system]
Changed password for user [kibana_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]
- 1.10.1 验证: 再次输入
curl localhost:9200
命令会报错:(由于请求没有设置账号密码)
{
"error": {
"root_cause": [{
"type": "security_exception",
"reason": "missing authentication credentials for REST request [/]",
"header": {
"WWW-Authenticate": "Basic realm=\"security\" charset=\"UTF-8\""
}
}],
"type": "security_exception",
"reason": "missing authentication credentials for REST request [/]",
"header": {
"WWW-Authenticate": "Basic realm=\"security\" charset=\"UTF-8\""
}
},
"status": 401
}
- 1.10.2 再验证: 输入
curl localhost:9200 -u elastic:your_password
显示下面数据,即设置密码成功!
2、设置kibana 中的 elasticsearch 连接密码
2.1、配置 elasticsearch 密码
- 进入到 kibana 安装文件夹下的 config 文件夹下,在 kibana.yml 文件中添加以下两行代码。
elasticsearch.username: "your username"
elasticsearch.password: "your password"
2.2、启动kibana
- 后台启动 kibana 进入kibana 安装目录的bin文件夹,输入
nohup ./kibana &
命令.
- 等到日志输出,kibana启动后,输入
exit
命令 ,然后点击回车键即可。(或Ctrl + c)
- kibana 的日志在 bin目录下的 nohup.out 文件内.
3、设置 Filebeat 中的 elasticsearch 密码
3.1、配置 elasticsearch 密码
- 找到 Filebeat 的配置文件 filebeat.yml,在该文件中添加以下几行代码。
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["http://113.***.**.1*1:9200"] # elasticsearch 服务地址
username: "elastic" # elasticsearch 服务用户名
password: "guokang@1234" # elasticsearch 服务密码
3.2、重启 Filebeat服务
- a、使用
ps -ef | grep kibana
命令查看 kibana 进程号。 - b、使用
kill -9 进程号
命令杀死 kibana 进程。 - c、进入到 kibana 的安装目录下的 bin 文件夹下。
- d、使用
nohup ./filebeat -c /etc/filebeat/filebeat.yml -e > /dev/null 2>&1 &
命令后台启动kibana,该方式无日志。 - e、等到日志输出,kibana启动后,输入**
exit
**命令 ,然后点击回车键即可。
说明: /etc/filebeat/filebeat.yml 是本案例的 kibana 配置文件地址。
3.3、扩展说明 (Filebeat 后台启动的几种方式)
- 进入 Filebeat 安装路径下的 bin 文件夹
命令: cd /usr/apps/filebeat/bin
- 不记录 filebeat 日志信息的启动方式
nohup ./filebeat -e -c /etc/filebeat/filebeat.yml > /dev/null 2>&1 &
或
nohup ./filebeat -c /etc/filebeat/filebeat.yml -e > /dev/null 2>&1 &
Ctrl+d
命令退出.
或
nohup ./filebeat -c /etc/filebeat/filebeat.yml -e &
exit
命令退出.
- 记录filebeat 日志
./filebeat -e -c /etc/filebeat/filebeat.yml > filebeat.log &
Ctrl+d
命令退出.
- 停止 filebeat
ps -ef |grep filebeat
查找进程
kill -9 进程号
命令杀死进程
.