ELK8.4安装配置错误记录

yangkei

已于 2022-09-26 17:01:48 修改

阅读量8.8k

点赞数 3

分类专栏： es 文章标签： elasticsearch 大数据搜索引擎 logstash

于 2022-09-13 17:18:17 首次发布

本文链接：https://blog.csdn.net/yangkei/article/details/126837326

版权

本文记录了ELK8.4安装配置过程中遇到的问题，包括kibana启动时kibana_system用户认证错误，解决方法是重置用户密码；logstash启动报错，原因是xpack配置冲突，解决方式是调整logstash.yml配置；logstash_admin_user密码重置失败，需通过Kibana创建用户和角色；Metricbeat连接拒绝问题，需修改kibana.yml中的主机地址；Metricbeat权限过大导致启动失败，调整文件权限为750；监控tomcat日志时，需要在Metricbeat中配置logstash.yml；最后，Filebeat启动错误，将filebeat.prospectors改为filebeat.inputs。

摘要由CSDN通过智能技术生成

1. kibana启动报错，kibana_system用户认证

[2022-09-06T19:47:01.491-04:00][ERROR][elasticsearch-service] Unable to retrieve version information from Elasticsearch nodes. security_exception: [security_exception] Reason: unable to authenticate user [kibana_system] for REST request [/_nodes?filter_path=nodes.*.version%2Cnodes.*.http.publish_address%2Cnodes.*.ip]

解决办法：设置kibana_system用户的密码。
[es@goya1 cert]$ elasticsearch-reset-password -u kibana_system -i
warning: ignoring JAVA_HOME=/app/elasticsearch/jdk; using bundled JDK
This tool will reset the password of the [kibana_system] user.
You will be prompted to enter the password.
Please confirm that you would like to continue [y/N]y
Enter password for [kibana_system]: changeit123
Re-enter password for [kibana_system]: changeit123
Password for the [kibana_system] user successfully reset.

修改,确认kibana.yml文件的配置部分：
# If your Elasticsearch is protected with basic authentication, these settings provide
# the username and password that the Kibana server uses to perform maintenance on the Kibana
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
# is proxied through the Kibana server.
elasticsearch.username: "kibana_system"
elasticsearch.password: "changeit123"

2. logstash 启动报错

[2022-09-13T22:41:21,452][ERROR][logstash.configmanagement.bootstrapcheck] There are config files (1) in the '/app/logstash/config/tomcat_log_es.conf' folder. Elasticsearch is configured as the config store so configs cannot be sourced via the command line with -f or via logstash.yml wi