Elasticsearch 设置密码，并配置 Kinaba 和 Filebeat

1、Elasticsearch 设置密码

 

• 1.1 没有设置密码，使用 curl localhost:9200 命令：
  

• 1.2 进入Elasticsearch 的安装目录，并进入config 文件夹。
  

• 1.3 使用 vim elasticsearch.yml 命令，修改config 文件夹下 elasticsearch.yml 文件。
   

• 1.4 在elasticsearch.yml文件的最后一行添加 xpack.security.enabled: true，开源版本默认是关闭的。
  

• 1.5 返回到 elasticsearch 的安装路径，然后使用命令 ./bin/elasticsearch -d 重新启动 ES (这一步非常重要,必须启动才能新增用户名和密码);
  

• 1.6.1 出现报错
  
  报错信息如下：

Future versions of Elasticsearch will require Java 11; your Java version from [/usr/local/soft/java/jdk1.8.0_271/jre] does not meet this requirement. Consider switching to a distribution of Elasticsearch with a bundled JDK. If you are already using a distribution with a bundled JDK, ensure the JAVA_HOME environment variable is not set.
Future versions of Elasticsearch will require Java 11; your Java version from [/usr/local/gk_self/soft/java/jdk1.8.0_271/jre] does not meet this requirement. Consider switching to a distribution of Elasticsearch with a bundled JDK. If you are already using a distribution with a bundled JDK, ensure the JAVA_HOME environment variable is not set.
[gkit@ecs-d809-0001 elasticsearch-7.11.2]$ uncaught exception in thread [main]
java.lang.IllegalStateException: failed to obtain node locks, tried [[/home/gkit/apps/elasticsearch-7.11.2/data]] with lock id [0]; maybe these locations are not writable or multiple nodes were started without increasing [node.max_local_storage_nodes] (was [1])?
	at org.elasticsearch.env.NodeEnvironment.<init>(NodeEnvironment.java:292)
	at org.elasticsearch.node.Node.<init>(Node.java:351)
	at org.elasticsearch.node.Node.<init>(Node.java:278)
	at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:216)
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:216)
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:387)
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159)
	at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150)
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:75)
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:116)
	at org.elasticsearch.cli.Command.main(Command.java:79)
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115)
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:81)
For complete error details, refer to the log at /home/apps/elasticsearch-7.11.2/logs/elasticsearch.log

• 1.6.2 解决：（杀死 elasticsearch 进程，然后重启elasticsearch ）
  
• 1.7 以交互的方式设置用户名和密码:(记住你所设置的密码)
  命令：./bin/elasticsearch-setup-passwords interactive
   
• 1.8.1 再次出现报错
  
  报错信息如下：

Future versions of Elasticsearch will require Java 11; your Java version from [/usr/local/gk_self/soft/java/jdk1.8.0_271/jre] does not meen with a bundled JDK, ensure the JAVA_HOME environment variable is not set.

Unexpected response code [500] from calling GET http://192.168.1.15:9200/_security/_authenticate?pretty
It doesn't look like the X-Pack security feature is enabled on this Elasticsearch node.
Please check if you have enabled X-Pack security in your elasticsearch.yml configuration file.

ERROR: X-Pack Security is disabled by configuration.

• 1.8.2 解决： 重新修改config 文件夹中的elasticsearch.yml 文件
  、
• 1.8.3 回到 elasticsearch 安装目录，重启服务。
   
• 1.9 再次使用 ./bin/elasticsearch-setup-passwords interactive 命令，设置密码。
  

Future versions of Elasticsearch will require Java 11; your Java version from [/usr/local/gk_self/soft/java/jdk1.8.0_271/jre] does not meet this requirement. Consider switching to a distribution of Elasticsearch with a bundled JDK. If you are already using a distribution with a bundled JDK, ensure the JAVA_HOME environment variable is not set.
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y


Enter password for [elastic]: 
Reenter password for [elastic]: 
Passwords do not match.
Try again.
Enter password for [elastic]: 
Reenter password for [elastic]: 
Passwords do not match.
Try again.
Enter password for [elastic]: 
Reenter password for [elastic]: 
Enter password for [apm_system]: 
Reenter password for [apm_system]: 
Enter password for [kibana_system]: 
Reenter password for [kibana_system]: 
Enter password for [logstash_system]: 
Reenter password for [logstash_system]: 
Enter password for [beats_system]: 
Reenter password for [beats_system]: 
Enter password for [remote_monitoring_user]: 
Reenter password for [remote_monitoring_user]: 
Changed password for user [apm_system]
Changed password for user [kibana_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]

• 1.10.1 验证： 再次输入 curl localhost:9200 命令会报错：（由于请求没有设置账号密码）

{
	"error": {
		"root_cause": [{
			"type": "security_exception",
			"reason": "missing authentication credentials for REST request [/]",
			"header": {
				"WWW-Authenticate": "Basic realm=\"security\" charset=\"UTF-8\""
			}
		}],
		"type": "security_exception",
		"reason": "missing authentication credentials for REST request [/]",
		"header": {
			"WWW-Authenticate": "Basic realm=\"security\" charset=\"UTF-8\""
		}
	},
	"status": 401
}

• 1.10.2 再验证： 输入 curl localhost:9200 -u elastic:your_password 显示下面数据，即设置密码成功！
  

2、设置kibana 中的 elasticsearch 连接密码

 

2.1、配置 elasticsearch 密码

 

• 进入到 kibana 安装文件夹下的 config 文件夹下，在 kibana.yml 文件中添加以下两行代码。

elasticsearch.username: "your username"
elasticsearch.password: "your password"

2.2、启动kibana

 

• 后台启动 kibana 进入kibana 安装目录的bin文件夹，输入 nohup ./kibana & 命令.
  
• 等到日志输出，kibana启动后，输入 exit 命令 ,然后点击回车键即可。（或Ctrl + c）
   
• kibana 的日志在 bin目录下的 nohup.out 文件内.
   

3、设置 Filebeat 中的 elasticsearch 密码

 

3.1、配置 elasticsearch 密码

 

• 找到 Filebeat 的配置文件 filebeat.yml，在该文件中添加以下几行代码。

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["http://113.***.**.1*1:9200"] # elasticsearch 服务地址
  username: "elastic"   # elasticsearch 服务用户名
  password: "guokang@1234"  # elasticsearch 服务密码

3.2、重启 Filebeat服务

• a、使用 ps -ef | grep kibana 命令查看 kibana 进程号。
• b、使用 kill -9 进程号 命令杀死 kibana 进程。
• c、进入到 kibana 的安装目录下的 bin 文件夹下。
• d、使用 nohup ./filebeat -c /etc/filebeat/filebeat.yml -e > /dev/null 2>&1 & 命令后台启动kibana，该方式无日志。
• e、等到日志输出，kibana启动后，输入**exit**命令 ,然后点击回车键即可。

说明： /etc/filebeat/filebeat.yml 是本案例的 kibana 配置文件地址。

3.3、扩展说明 （Filebeat 后台启动的几种方式）

• 进入 Filebeat 安装路径下的 bin 文件夹

命令： cd /usr/apps/filebeat/bin

• 不记录 filebeat 日志信息的启动方式

nohup ./filebeat -e -c /etc/filebeat/filebeat.yml > /dev/null 2>&1 &
或
nohup ./filebeat -c /etc/filebeat/filebeat.yml -e > /dev/null 2>&1 &
Ctrl+d 命令退出.
或
nohup ./filebeat -c /etc/filebeat/filebeat.yml -e &
exit 命令退出.

• 记录filebeat 日志

./filebeat -e -c /etc/filebeat/filebeat.yml > filebeat.log &
Ctrl+d 命令退出.

• 停止 filebeat

ps -ef |grep filebeat 查找进程
kill -9 进程号 命令杀死进程

 
 
 
 
 
 
 
 
 
.