elasticsearch 7.10.1集群搭建+验证

ip	node
10.0.54.121	node-1
10.0.54.122	node-2
10.0.54.123	node-3

elasticsearch下载地址
下载es对应ik分词

• 设置系统环境（三台服务器均需要操作，以node-1为例）
  设置主机名，并添加本地解析

[es@localhost elasticsearch-7.10.1]$ cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
10.0.54.121 node-1
10.0.54.122 node-2
10.0.54.123 node-3

• 修改服务器文件描述符

vim /etc/security/limits.conf

底部添加如下两项

* soft nofile 65535
* hard nofile 65535

修改max_map_count值

sysctl -w vm.max_map_count=655360
echo 'vm.max_map_count=655360' >> /etc/sysctl.conf 
sysctl -p

• 部署Elasticsearch7.10.1集群
  解压 elasticsearch-7.10.1-linux-x86_64.tar.gz

修改es配置文件

[es@localhost elasticsearch-7.10.1]$ cat config/elasticsearch.yml
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: elasticsearch-cluster
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /usr/local/sdb/elasticsearch-7.10.1/data
#
# Path to log files:
#
path.logs: /usr/local/sdb/elasticsearch-7.10.1/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 0.0.0.0
#
# Set a custom port for HTTP:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.seed_hosts: ["10.0.54.121", "10.0.54.131","10.0.54.211"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["node-1", "node-2","node-3"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
http.cors.enabled: true
http.cors.allow-origin: "*"

启动Elasticsearch（elasticsearch 默认root用户不能启动，需要java环境官方推荐jdk11）

[es@localhost elasticsearch-7.10.1]$ ./bin/elasticsearch -d
-d是后台启动，第一次启动可以不加-d看下启动日志

防火墙开放端口

[es@localhost elasticsearch-7.10.1]# firewall-cmd --permanent --add-port=9200/tcp #es服务端口
[es@localhost elasticsearch-7.10.1]# firewall-cmd --permanent --add-port=9300/tcp #集群通信端口
es@localhost elasticsearch-7.10.1]# firewall-cmd --reload

查看集群状态
浏览器访问：http://10.0.54.121:9200/_cluster/state

• 配置ES集群间 TLS 和 身份验证
  生产证书文件（仅集群中一台服务器生产即可，然后copy到另外两台服务器）

[es@localhost elasticsearch-7.10.1]# /usr/local/sdb/elasticsearch-7.10.1/bin/elasticsearch-certutil cert -out /usr/local/sdb/elasticsearch-7.10.1/config/elastic-certificates.p12 -pass ""
[es@localhost config]#  scp ./elastic-certificates.p12 root@node-2:/usr/local/sdb/elasticsearch-7.10.1/config/
[es@localhost config]#  scp ./elastic-certificates.p12 root@node-3:/usr/local/sdb/elasticsearch-7.10.1/config/

elastic-certificates.p12文件要放在elasticsearch-7.10.1/config目录下要不然启动会报错，同时此文件要有读写权限

• 修改配置文件

xpack.security.enabled: true
xpack.license.self_generated.type: basic
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /usr/local/sdb/elasticsearch-7.10.1/config/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/local/sdb/elasticsearch-7.10.1/config/elastic-certificates.p12
#在elasticsearch.yml里添加，添加完后重启三台elasticsearch

• 在集群中的任何一个节点上生成密码都可以，一个节点生成后会同步至集群

es@localhost elasticsearch-7.10.1]$ ./bin/elasticsearch-setup-passwords auto
future versions of Elasticsearch will require Java 11; your Java version from [/usr/local/sdb/jdk1.8.0_251/jre] does not meet this requirement
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.
The passwords will be randomly generated and printed to the console.
Please confirm that you would like to continue [y/N]y


Changed password for user apm_system
PASSWORD apm_system = yLYtbIiMRctM7qeRyjpR

Changed password for user kibana_system
PASSWORD kibana_system = jiCO0RTzbUOSUGgjpGpP

Changed password for user kibana
PASSWORD kibana = jiCO0RTzbUOSUGgjpGpP

Changed password for user logstash_system
PASSWORD logstash_system = RA1Ua66C1kcIRggferQC

Changed password for user beats_system
PASSWORD beats_system = lcmXb62EO4xSIfyzMpUZ

Changed password for user remote_monitoring_user
PASSWORD remote_monitoring_user = wymxeQ0qLcNoOLIOeVC0

Changed password for user elastic
PASSWORD elastic = 5AWMWliEXMmHNDC3ipmV

• 访问验证

[root@localhost ~]# curl -u elastic:5AWMWliEXMmHNDC3ipmV -XGET 'http://10.0.54.121:9200/_cat/nodes?v'
ip          heap.percent ram.percent cpu load_1m load_5m load_15m node.role  master name
10.0.54.121           34          26   2    0.01    0.12     0.13 cdhilmrstw *      node-1
10.0.54.122           25          26   2    0.02    0.16     0.13 cdhilmrstw -      node-3
10.0.54.123           26          26   1    0.04    0.14     0.12 cdhilmrstw -      node-2