elk官方下载地址:https://www.elastic.co/cn/downloads/
1、创建普通用户及用户组
groupadd elasticsearch
useradd elasticsearch -g elasticsearch
2、 修改系统参数
修改最大连接数,/etc/security/limits.conf中添加两行
* soft nofile 65536
* hard nofile 65536
* soft nproc 32000
* hard nproc 32000
* hard memlock unlimited
* soft memlock unlimited
3、调整虚拟内存vm.max_map_count大小
修改/etc/sysctl.conf文件,添加下面一行内容,使其生效
vm.max_map_count=262144
sysctl -p
tar xf elasticsearch-8.6.1-linux-x86_64.tar.gz
mv elasticsearch-8.6.1 elasticsearch
chown -R elasticsearch.elasticsearch elasticsearch
5、切换用户修改elasticsearch.yml文件,具体配置如下:
cluster.name: my-application
#配置es得集群名称,默认是elasticsearch,es会自动发现同一网段下得es,如果在同一网段下有多个集群,就可以用这个属性来区分不同得集群
node.name: node-1
#节点名称,默认随机指定一个name列表中得名字
node.attr.rack: r1
#节点部落属性
node.roles: [master,data]
node.attr.box_type: hot
#节点做冷热分离
node.attr.gateway: true
bootstrap.memory_lock: false
#机制使用内存交换功能,防止性能瓶颈
path.data: /app/elasticsearch/data
#数据存储路径
path.logs: /app/elasticsearch/logs
#日志存储路径
network.host: 0.0.0.0
#设置节点绑定地址(IPv4 或者 IPv6)
http.port: 9200
#设置http访问端口
http.cors.enabled: true
http.cors.allow-credentials: true
http.cors.allow-origin: "*"
#以上三个配置在使用head等插件监控集群信息,需要打开
#数据传输、节点连接端口
discovery.seed_hosts: ["192.168.53.123:9300", "192.168.53.203:9300"]
#集群发现
cluster.initial_master_nodes: ["node-1","node-2"]
#手动指定可以成为master得所有节点得name或者IP,这些配置将会在第一次选举中进行计算
xpack.security.enabled: false
6、服务启动
su - elasticsearch
cd /app/elasticsearch/bin
./elasticsearch
./elasticsearch -d #后台启动
7、服务验证
8、密码配置
1)签发证书
#切换用户
su - elasticsearch
# 签发ca证书 直接敲回车 不需要输入密码
bin/elasticsearch-certutil ca
# 用ca证书签发节点证书 敲三次回车
bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
# 将生成的证书文件移动到config/certs目录中
mv elastic-certificates.p12 config/certs
2)配置所有集群节点配置文件,启用x-pack安全组件,增加如下配置:
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12
3)重启集群中各节点
4)访问测试,看到提示需要密码
5)密码设置
PS:想要成功设置密码必须保证集群运行状态正常
在其中一个节点设置即可
./bin/elasticsearch-setup-passwords interactive
重置 elastic 用户密码
$ ./bin/elasticsearch-reset-password -u elastic
This tool will reset the password of the [elastic] user to an autogenerated value.
The password will be printed in the console.
Please confirm that you would like to continue [y/N]y
Password for the [elastic] user successfully reset.
New value: 9qlCiFxAK-VDJ7T9T8fY
$ curl -u elastic:9qlCiFxAK-VDJ7T9T8fY -XGET http://192.168.53.123:9200/_cat/nodes?v
ip heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name
192.168.53.203 59 93 0 0.05 0.07 0.06 dm * node-2
192.168.53.123 63 96 0 0.06 0.14 0.13 dm - node-1