elk单节点 elasticsearch单节点配置

转载

智能开发先锋 2024-07-19 07:45:47

文章标签 elk单节点 elasticsearch jenkins 大数据 Elastic 文章分类 运维

’4、Elasticsearch 启动

4.1、直接启动（默认开启security）

4.1.1、不修改配置文件启动

首次启动 Elasticsearch 时，会自动进行以下安全配置：

1）、为传输层和 HTTP 层生成 TLS 证书和密钥；

2）、TLS 配置设置被写入 elasticsearch.yml（BEGIN SECURITY AUTO CONFIGURATION 模块）；

3）、为 elastic 用户生成密码。

4）、为 Kibana 生成一个注册令牌。

# 使用 elasticsearch 用户，进入bin目录执行
./elasticsearch -d

启动成功如下图：

elk单节点 elasticsearch单节点配置_大数据

验证服务状态，使用生成的密码登录（用户名：elastic，密码启动成功生成的）：

4.1.2、修改密码

忘记密码怎么办，使用重新生成或者自定义密码。

# 1、重新生成密码
./elasticsearch-reset-password -u elastic # 可以使用./elasticsearch-reset-password --help查看使用
# 2、自定义密码
./elasticsearch-reset-password --username elastic -i

elk单节点 elasticsearch单节点配置_大数据_02

4.1.3、Elasticsearch 启动后配置文件（elasticsearch.yml）变化

新增如下内容（这些内容是针对security自动添加的）：

#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------# 
# Enable security features
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12
# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
# Create a new cluster with the current node only
# Additional nodes can still join the cluster later
cluster.initial_master_nodes: ["node-3"]
# Allow HTTP API connections from anywhere
# Connections are encrypted and require user authentication
http.host: 0.0.0.0
# Allow other nodes to join the cluster from anywhere
# Connections are encrypted and mutually authenticated
#transport.host: 0.0.0.0
#----------------------- END SECURITY AUTO CONFIGURATION -------------------------

4.2、关闭security 启动

4.2.1、修改配置文件

修改elasticsearch.yml配置文件如下：

#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------
# Enable security features
xpack.security.enabled: false  # 将此处设置为false，即为关闭security
xpack.security.enrollment.enabled: true
# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12
# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
# Create a new cluster with the current node only
# Additional nodes can still join the cluster later
cluster.initial_master_nodes: ["node-3"]
# Allow HTTP API connections from anywhere
# Connections are encrypted and require user authentication
http.host: 0.0.0.0
# Allow other nodes to join the cluster from anywhere
# Connections are encrypted and mutually authenticated
#transport.host: 0.0.0.0
#----------------------- END SECURITY AUTO CONFIGURATION -------------------------

4.2.2、启动

# 使用 elasticsearch 用户，进入bin目录执行
./elasticsearch -d

直接访问不需要输入用户名，密码。

elk单节点 elasticsearch单节点配置_elk单节点_03

5、安装过程中出现的问题

5.1、未新创建用户启动Elasticsearch

使用root账户直接启动会报错，新建账户，并且给Elasticsearch目录赋新用户权限，再启动即可。

5.2、操作系统设置问题

启动Elasticsearch出现错误：

max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
bootstrap check failure [2] of [2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解决方式（使用root用户更改）：

# 1、修改操作系统文件描述符参数
vim /etc/security/limits.conf
# 添加下面内容
* soft nofile 65536
* hard nofile 65536
* soft nproc 4096
* hard nproc 4096
# 注：*后面有空格
# 2、修改vm.max_map_count
vim /etc/sysctl.conf
# 添加下面内容
vm.max_map_count=262144
# 检查是否保存
sysctl -p
# 3、重启服务器
reboot