- 注: 由于是測(cè)試,搭建的環(huán)境就在一臺(tái)機(jī)器上(操作系統(tǒng)是 CentOS 7)
配置 Elasticsearch
Elasticsearch 的配置文件是 elasticsearch/elasticsearch.yml
- 集群的名稱
配置集群的名稱,所有的node節(jié)點(diǎn)集群名稱要一致
# Use a descriptive name for your cluster:
#
cluster.name: my-application
- 節(jié)點(diǎn)的名稱
配置每個(gè)節(jié)點(diǎn)的名稱,節(jié)點(diǎn)的名稱要在集群中唯一
# Use a descriptive name for the node:
#
node.name: node-1
- 索引文件的存儲(chǔ)位置
默認(rèn)是在當(dāng)前目錄下的data目錄,可以自行修改
# Path to directory where to store the data (separate multiple locations by comma):
#
#path.data: /path/to/data
- 日志文件的存儲(chǔ)位置
默認(rèn)是在當(dāng)前目錄下的logs目錄,可以自行修改
# Path to log files:
#
#path.logs: /path/to/logs
- Elasticsearch 運(yùn)行綁定的 Host，默認(rèn)是無(wú)法公開訪問(wèn)的，如果設(shè)置為 0.0.0.0 就可以公開訪問(wèn)
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 0.0.0.0
- HTTP訪問(wèn)端口,默認(rèn)是9200
http.port: 9200
- transport 端口,默認(rèn)是9300(transport用于集群內(nèi)節(jié)點(diǎn)之間的內(nèi)部通信)
transport.port: 9300
- discovery.seed_hosts 配置集群的主機(jī)和端口地址
discovery.seed_hosts: ["127.0.0.1:9300","127.0.0.1:9301","127.0.0.1:9302"]
- cluster.initial_master_nodes(第一次啟動(dòng)全新的Elasticsearch集群時(shí)，會(huì)出現(xiàn)一個(gè)集群引導(dǎo)步驟，該步驟確定在第一次選舉中計(jì)票的主要合格節(jié)點(diǎn)集,這些節(jié)點(diǎn)的投票應(yīng)在第一次選舉中計(jì)算)
cluster.initial_master_nodes: ["node-1", "node-2","node-3"]
- 該節(jié)點(diǎn)是否有資格成為主節(jié)點(diǎn)
node.master: true
- 是否是數(shù)據(jù)節(jié)點(diǎn)
node.data: true
- 防止集群發(fā)生“腦裂”，即一個(gè)集群分裂成多個(gè)，通常需要配置集群最少主節(jié)點(diǎn)數(shù)目,通常為 (可成為主節(jié)點(diǎn)的主機(jī)數(shù)目 / 2) + 1,我有3個(gè)節(jié)點(diǎn)有資格成為主節(jié)點(diǎn),那么結(jié)果就是 2
discovery.zen.minimum_master_nodes: 2
開啟安全認(rèn)證(注意在生成證書時(shí),集群是在沒有密碼的狀態(tài)下生成的)
- 進(jìn)入bin目錄,執(zhí)行下面的命令,為Elasticsearch 節(jié)點(diǎn)生成私鑰和 X.509 證書(注: 進(jìn)入任意一個(gè)node節(jié)點(diǎn)下,然后將生成的文件拷貝到所有的node節(jié)點(diǎn)下)
// 生成CA證書,執(zhí)行命令后,系統(tǒng)還會(huì)提示你輸入密碼,可以直接留空
elasticsearch-certutil ca
//生成證書和私鑰,系統(tǒng)還會(huì)提示你輸入密碼，你可以輸入證書和密鑰的密碼，也可以留空
elasticsearch-certutil cert --ca elastic-stack-ca.p12
- 執(zhí)行后,你會(huì)在,es目錄下看到對(duì)應(yīng)的兩個(gè)文件
在所有node節(jié)點(diǎn)下,在 config目錄中創(chuàng)建 certs 文件夾
將elastic-certificates.p12 文件拷貝到certs 目錄下(注:是所有的node節(jié)點(diǎn)對(duì)應(yīng)的/config/certs)
- 設(shè)置開啟安全認(rèn)證
# 設(shè)置密碼,對(duì)外訪問(wèn)安全認(rèn)證
xpack.security.enabled: true
xpack.license.self_generated.type: basic
- 開啟集團(tuán)內(nèi)部通信認(rèn)證
#開啟集群內(nèi)部通信安全認(rèn)證
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12
- 啟動(dòng)所有ES節(jié)點(diǎn)
# es啟動(dòng)命令(進(jìn)入bin目錄下)
# 前臺(tái)啟動(dòng)
./elasticsearch
#后臺(tái)啟動(dòng)
./elasticsearch -d
- 需要在其中一個(gè)節(jié)點(diǎn)進(jìn)行密碼的設(shè)置(設(shè)置一個(gè)即可)
elasticsearch-setup-passwords interactive
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y
Enter password for [elastic]:
Reenter password for [elastic]:
Enter password for [apm_system]:
Reenter password for [apm_system]:
Enter password for [kibana]:
Reenter password for [kibana]:
Enter password for [logstash_system]:
Reenter password for [logstash_system]:
Enter password for [beats_system]:
Reenter password for [beats_system]:
Enter password for [remote_monitoring_user]:
Reenter password for [remote_monitoring_user]:
Changed password for user [apm_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]
kibana配置
- 進(jìn)入config目錄下,修改kibana.yml文件
# 添加es對(duì)應(yīng)的kibana用戶名和密碼
elasticsearch.username: "kibana"
elasticsearch.password: "密碼"
- kabana 中文配置,同樣位于kibana.yml文件
# Specifies locale to be used for all localizable strings, dates and number formats.
# Supported languages are the following: English - en , by default , Chinese - zh-CN .
i18n.locale: "zh-CN"
啟動(dòng)kibana
- 進(jìn)入bin目錄下
#前臺(tái)運(yùn)行
./kibana
#后臺(tái)運(yùn)行
nohup ../bin/kibana &
-
最后,可以通過(guò)kibana 看到如下界面
-
安全認(rèn)證
文章來(lái)源：http://www.zghlxwxcb.cn/news/detail-412495.html -
集群設(shè)置
文章來(lái)源地址http://www.zghlxwxcb.cn/news/detail-412495.html
到了這里，關(guān)于ElasticSearch7.3.0 集群搭建及配置安全認(rèn)證的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
