說明：這只是本人在家里組網(wǎng)搭建的集群，所以內(nèi)容排版可能比較隨意了，沒有耐心的同學直接跳過去看別的文章吧，我只是放在這里留作記錄方便以后翻閱

ELK 的坑實在太多了，自己在物理機(多臺)逐漸摸索的，安裝最新版本的記錄

為了好看可能我下面會出現(xiàn)多個這種的命令行文章來源地址http://www.zghlxwxcb.cn/news/detail-848397.html

命令行 mkdir -p /iscsi/elk/kibana/config
命令行 mkdir -p /iscsi/elk/kibana/data
命令行 mkdir -p /iscsi/elk/kibana/logs
# 可以使用 mkdir -p /iscsi/elk/kibana/{config,data,logs}代替在一個文件夾下創(chuàng)建多個目錄```

ELK安裝:
    版本: 8.9.0
    準備:
        更新apt: 
            命令行 apt-get update
            命令行 apt-get upgrade
            命令行 apt-get install unzip
        JDK安裝: 
            - 1查看JDK版本: 命令行 apt search openjdk
            - 2安裝JDK: 命令行 apt install openjdk-21-jdk -y  （找一個最高的來安裝） 
        創(chuàng)建ELK目錄: 
            命令行 mkdir -p /iscsi/elk   
            命令行 mkdir -p /iscsi/elk/elasticsearch
            命令行 mkdir -p /iscsi/elk/elasticsearch/data
            命令行 mkdir -p /iscsi/elk/elasticsearch/logs
            命令行 mkdir -p /iscsi/elk/elasticsearch/plugins
            命令行 mkdir -p /iscsi/elk/kibana
            命令行 mkdir -p /iscsi/elk/kibana/config
            命令行 mkdir -p /iscsi/elk/kibana/data
            命令行 mkdir -p /iscsi/elk/kibana/logs
            命令行 mkdir -p /iscsi/elk/logstash  
            命令行 mkdir -p /iscsi/elk/logstash/config
            命令行 mkdir -p /iscsi/elk/logstash/logs
            命令行 mkdir -p /iscsi/elk/logstash/pipeline
        文件夾提權:
            命令行 chmod 777 -R /iscsi/elk/*
        創(chuàng)建用戶和組:
            1查看用戶: 命令行 cat /etc/passwd
            2查看組: 命令行 cat /etc/group
            3修改原來uid為1000的用戶: 命令行 usermod -u 1001 tonywoo
            4新建elasticsearch 用戶: 命令行   useradd -u 1000 -g root elasticsearch     ??useradd -u 1000 -g tonywoo elasticsearch
            6新建組: 命令行 groupadd elasticsearch
            5修改elasticsearch 用戶密碼: 命令行 passwd elasticsearch
        設置目錄權限:
            1設置目錄擁有者: 命令行 chown -R elasticsearch:root /iscsi/elk/elasticsearch/
            2設置目錄擁有組: 命令行 chgrp -R 0 /iscsi/elk/elasticsearch
            3備注: /iscsi/elk/elasticsearch 下的子目錄的擁有者都要設置為 elasticsearch 這個用戶
        內(nèi)存設置:
            - 1查看用戶內(nèi)存權限: 命令行 sysctl -a|grep vm.max_map_count
            - 2設置用戶內(nèi)存權限: 命令行 vim /etc/sysctl.conf
            - 3禁止內(nèi)存與硬盤交換: vm.swappiness=1
            - 4配置最大映射數(shù)量: vm.max_map_count=262144
            - 5使配置生效: 退出vim，命令行 sysctl -p
        修改打開文件數(shù):
            - 1進入文件: 命令行 vim /etc/security/limits.conf
            - 2追加內(nèi)容:
                `
                    # elasticsearch是用戶，也可以使用*代替所有用戶）
                    elasticsearch soft nofile 65536
                    elasticsearch hard nofile 65536
                    #內(nèi)存鎖定交換
                    soft memlock unlimited
                    hard memlock unlimited
                  `
        查看docker網(wǎng)絡: 命令行 docker network list
    開始:
        新建docker-compose文件: 命令行 touch /iscsi/elk/docker-compose-elk.yml
        修改docker-compose文件如下: 
            `
                version: '3.7'
                services:
                elasticsearch:
                    image: elasticsearch:8.9.0
                    container_name: elasticsearch
                    hostname: elasticsearch
                    restart: "no"
                    volumes:
                        - /etc/localtime:/etc/localtime
                        #- /iscsi/elk/elasticsearch/data:/usr/share/elasticsearch/data:rw
                        #- /iscsi/elk/elasticsearch/config:/usr/share/elasticsearch/config:rw
                        #- /iscsi/elk/elasticsearch/logs:/usr/share/elasticsearch/logs:rw
                        #- /iscsi/elk/elasticsearch/plugins:/usr/share/elasticsearch/plugins:rw
                    environment:
                        - TZ="Asia/Shanghai"
                        - ES_JAVA_OPTS=-Xms512m -Xmx512m
                        - discovery.type=single-node
                    ports:
                        - "9200:9200"
                        - "9300:9300"
                    networks:
                        elastic:
                            ipv4_address: 172.99.0.2
                            aliases:
                                - elasticsearch
                kibana:
                    image: kibana:8.9.0
                    container_name: kibana
                    hostname: kibana
                    restart: "no"
                    volumes:
                        - /etc/localtime:/etc/localtime
                        #- /iscsi/elk/kibana/data:/usr/share/kibana/data:rw
                        #- /iscsi/elk/kibana/config:/usr/share/kibana/config:rw
                        #- /iscsi/elk/kibana/logs:/usr/share/kibana/logs:rw
                    ports:
                        - 5601:5601
                    depends_on:
                        - elasticsearch
                    networks:
                    elastic:
                        ipv4_address: 172.99.0.3
                        aliases:
                            - kibana
                        
                logstash:
                    image: logstash:8.9.0
                    container_name: logstash
                    hostname: logstash
                    restart: "no"
                    volumes:
                        - /etc/localtime:/etc/localtime
                        #- /iscsi/elk/logstash/config:/usr/share/logstash/config:rw
                        #- /iscsi/elk/logstash/logs:/usr/share/logstash/logs:rw
                        #- /iscsi/elk/logstash/pipeline:/usr/share/logstash/pipeline:rw
                    ports:
                        - 5044:5044
                        - 9066:9066
                        - 21068:21068
                        - "5000:5000/tcp"
                        - "5000:5000/udp"      
                    depends_on:
                        - elasticsearch
                    networks:
                    elastic:
                        ipv4_address: 172.99.0.4
                        aliases:
                            - logstash   
                ##自定義網(wǎng)絡
            networks:
                elastic:
                    ipam:
                        driver: default
                        config:
                            - subnet: 172.99.0.0/16

            `
            上面帶有#號 的后面要解除
        首次啟動: /iscsi/elk下執(zhí)行 命令行 docker-compose -f docker-compose-elk.yml up -d
        復制容器內(nèi)目錄到宿主機:
            命令行 docker cp elasticsearch:/usr/share/elasticsearch/config /iscsi/elk/elasticsearch/
            命令行 docker cp kibana:/usr/share/kibana/config /iscsi/elk/kibana/
            命令行 docker cp logstash:/usr/share/logstash/config /iscsi/elk/logstash/
            命令行 docker cp logstash:/usr/share/logstash/pipeline /iscsi/elk/logstash/
            命令行 chmod 777 -R /iscsi/elk/kibana/*
            命令行 chmod 777 -R /iscsi/elk/logstash/*
            命令行 chown -R elasticsearch:root /iscsi/elk/elasticsearch/config/
            命令行 chown -R elasticsearch:root /iscsi/elk/elasticsearch/config/certs/
        修改elasticsearch的jvm文件:
            打開 /iscsi/elk/elasticsearch/config/jvm.options添加下面兩項
            命令行 vim /iscsi/elk/elasticsearch/config/jvm.options
            `
            -Xms512m
            -Xmx512m
            `
        修改logstash的jvm文件:
            打開 /iscsi/elk/logstash/config/jvm.options添加下面兩項
            命令行 vim /iscsi/elk/logstash/config/jvm.options 修改如下
            #-Xms1g 改為 -Xms512m
            #-Xmx1g 改為 -Xmx512m
        放開注釋: 放開docker-compose-elk.yml文件內(nèi)掛載數(shù)據(jù)卷的注釋
                命令行  cd /iscsi/elk
                命令行  docker-compose  -f docker-compose-elk.yml stop
                命令行  docker-compose  -f docker-compose-elk.yml rm
                命令行  docker-compose  -f docker-compose-elk.yml up -d
    配置SSL:
        設置目錄擁有者:
            命令行 chown -R elasticsearch:root /iscsi/elk/elasticsearch/config/*
            命令行 chown -R elasticsearch:root /iscsi/elk/elasticsearch/config/certs/*
        進入elasticsearch容器:
            命令行 docker exec -it elasticsearch /bin/bash
        生成elastic-stack-ca.p12文件:
            命令行 ./bin/elasticsearch-certutil ca
            需要在 `Enter password for elastic-stack-ca.p12:` 哪里設置密碼
        生成elastic-certificates.p12:
            命令行 ./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
            `Enter password for CA(elastic-stack-ca.p12):`后輸入 elastic-stack-ca.p12設置的密碼
        復制文件到config文件夾:
            命令行 mv elastic-certificates.p12 config/certs/
            命令行 mv elastic-stack-ca.p12 ./config/                        
            備注 開放了docker-compose-elk.yml的注釋復制文件到config宿主機文件夾會同時改變；elastic-stack-ca.p12文件后續(xù)也需要用到
        設置文件擁有權:
            退出容器
            命令行 chmod 777  /iscsi/elk/elasticsearch/*
            命令行 chmod 777  /iscsi/elk/elasticsearch/config/*
            命令行 chmod 777  /iscsi/elk/elasticsearch/config/certs/*
            命令行 chown -R elasticsearch:root /iscsi/elk/elasticsearch/*
        設置elasticsearch.yml配置文件:
            命令行 vim /iscsi/elk/elasticsearch/config/elasticsearch.yml
            修改為如下
            `
                # Enable encryption and mutual authentication between cluster nodes
                xpack.security.transport.ssl:
                enabled: true
                verification_mode: certificate
                keystore.path: certs/elastic-certificates.p12
                truststore.path: certs/elastic-certificates.p12                        
            `
        修改密碼:
            如果certificate設置了密碼，需要執(zhí)行一下兩個命令
            退回到容器根目錄
            命令行 ./bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
            命令行 ./bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password
            備注 這個密碼就是 elastic-certificates.p12  文件設置的密碼
        重啟elasticsearch容器:
            docker restart elasticsearch
        配置elasticsearch和kibana開啟https訪問:
            進入elasticsearch容器:
                命令行 docker exec -it elasticsearch /bin/bash
            生成elasticsearch-ssl-http.zip:
                命令行 ./bin/elasticsearch-certutil http
                操作如下
                ## Elasticsearch HTTP Certificate Utility
                The 'http' command guides you through the process of generating certificates
                for use on the HTTP (Rest) interface for Elasticsearch.

                This tool will ask you a number of questions in order to generate the right
                set of files for your needs.

                ## Do you wish to generate a Certificate Signing Request (CSR)?

                A CSR is used when you want your certificate to be created by an existing
                Certificate Authority (CA) that you do not control (that is, you don't have
                access to the keys for that CA). 

                If you are in a corporate environment with a central security team, then you
                may have an existing Corporate CA that can generate your certificate for you.
                Infrastructure within your organisation may already be configured to trust this
                CA, so it may be easier for clients to connect to Elasticsearch if you use a
                CSR and send that request to the team that controls your CA.

                If you choose not to generate a CSR, this tool will generate a new certificate
                for you. That certificate will be signed by a CA under your control. This is a
                quick and easy way to secure your cluster with TLS, but you will need to
                configure all your clients to trust that custom CA.

                ## 生成CSR 輸入n
                Generate a CSR? [y/N]n

                ## Do you have an existing Certificate Authority (CA) key-pair that you wish to use to sign your certificate?

                If you have an existing CA certificate and key, then you can use that CA to
                sign your new http certificate. This allows you to use the same CA across
                multiple Elasticsearch clusters which can make it easier to configure clients,
                and may be easier for you to manage.

                If you do not have an existing CA, one will be generated for you.

                ## 是否使用存在的ca 輸入y（在基礎配置時生成了）
                Use an existing CA? [y/N]y

                ## What is the path to your CA?

                Please enter the full pathname to the Certificate Authority that you wish to
                use for signing your new http certificate. This can be in PKCS#12 (.p12), JKS
                (.jks) or PEM (.crt, .key, .pem) format.
                ## 輸入ca文件的地址
                CA Path: /usr/share/elasticsearch/config/elastic-stack-ca.p12
                Reading a PKCS12 keystore requires a password.
                It is possible for the keystore's password to be blank,
                in which case you can simply press <ENTER> at the prompt
                ## 輸入文件設置的密碼
                Password for elastic-stack-ca.p12:

                ## How long should your certificates be valid?

                Every certificate has an expiry date. When the expiry date is reached clients
                will stop trusting your certificate and TLS connections will fail.

                Best practice suggests that you should either:
                (a) set this to a short duration (90 - 120 days) and have automatic processes
                to generate a new certificate before the old one expires, or
                (b) set it to a longer duration (3 - 5 years) and then perform a manual update
                a few months before it expires.

                You may enter the validity period in years (e.g. 3Y), months (e.g. 18M), or days (e.g. 90D)

                ## 設置過期時間
                For how long should your certificate be valid? [5y] 10y

                ## Do you wish to generate one certificate per node?

                If you have multiple nodes in your cluster, then you may choose to generate a
                separate certificate for each of these nodes. Each certificate will have its
                own private key, and will be issued for a specific hostname or IP address.

                Alternatively, you may wish to generate a single certificate that is valid
                across all the hostnames or addresses in your cluster.

                If all of your nodes will be accessed through a single domain
                (e.g. node01.es.example.com, node02.es.example.com, etc) then you may find it
                simpler to generate one certificate with a wildcard hostname (*.es.example.com)
                and use that across all of your nodes.

                However, if you do not have a common domain name, and you expect to add
                additional nodes to your cluster in the future, then you should generate a
                certificate per node so that you can more easily generate new certificates when
                you provision new nodes.

                ## 是否為每一個節(jié)點生成證書 輸入n
                Generate a certificate per node? [y/N]n

                ## Which hostnames will be used to connect to your nodes?

                These hostnames will be added as "DNS" names in the "Subject Alternative Name"
                (SAN) field in your certificate.

                You should list every hostname and variant that people will use to connect to
                your cluster over http.
                Do not list IP addresses here, you will be asked to enter them later.

                If you wish to use a wildcard certificate (for example *.es.example.com) you
                can enter that here.

                ## 節(jié)點的hostname,設置為elasticsearch，敲兩次回車
                Enter all the hostnames that you need, one per line.
                When you are done, press <ENTER> once more to move on to the next step.

                elasticsearch

                You entered the following hostnames.

                - elasticsearch

                ## 配置是否正確
                Is this correct [Y/n]y

                ## Which IP addresses will be used to connect to your nodes?

                If your clients will ever connect to your nodes by numeric IP address, then you
                can list these as valid IP "Subject Alternative Name" (SAN) fields in your
                certificate.

                If you do not have fixed IP addresses, or not wish to support direct IP access
                to your cluster then you can just press <ENTER> to skip this step.

                ## 節(jié)點的ip(可以在宿主機通過命令docker inspect elasticsearch查看),設置為172.99.0.2，敲兩次回車
                Enter all the IP addresses that you need, one per line.
                When you are done, press <ENTER> once more to move on to the next step.

                172.99.0.2

                You entered the following IP addresses.

                - 172.99.0.2
                ## 配置是否正確
                Is this correct [Y/n]y

                ## Other certificate options

                The generated certificate will have the following additional configuration
                values. These values have been selected based on a combination of the
                information you have provided above and secure defaults. You should not need to
                change these values unless you have specific requirements.

                Key Name: elasticsearch
                Subject DN: CN=elasticsearch
                Key Size: 2048

                ## 是否更改任意項
                Do you wish to change any of these options? [y/N]n

                ## What password do you want for your private key(s)?

                Your private key(s) will be stored in a PKCS#12 keystore file named "http.p12".
                This type of keystore is always password protected, but it is possible to use a
                blank password.

                If you wish to use a blank password, simply press <enter> at the prompt below.
                ## 輸入生成文件的密碼（可不設置，設置需要在后面進行配置）
                Provide a password for the "http.p12" file:  [<ENTER> for none]
                ## 再次輸入生成文件的密碼
                Repeat password to confirm: 

                ## Where should we save the generated files?

                A number of files will be generated including your private key(s),
                public certificate(s), and sample configuration options for Elastic Stack products.

                These files will be included in a single zip archive.

                ## 生成壓縮文件的地址和名稱，直接敲回車即可
                What filename should be used for the output zip file? [/usr/share/elasticsearch/elasticsearch-ssl-http.zip] 
        移動elasticsearch-ssl-http.zip壓縮包:
            命令行 mv elasticsearch-ssl-http.zip ./config/ 
        解壓文件:
            退出容器
            命令行 unzip /iscsi/elk/elasticsearch/config/elasticsearch-ssl-http.zip
            解壓后會在原目錄下新增兩個目錄分別是 elasticsearch 和 kibana
            命令行 mv /iscsi/elk/elasticsearch/config/elasticsearch/http.p12 /iscsi/elk/elasticsearch/config/certs/
        復制elasticsearch-ca.pem到kibana的config文件夾內(nèi):
            命令行 cp /iscsi/elk/elasticsearch/config/kibana/elasticsearch-ca.pem /iscsi/elk/kibana/config/
        刪除文件夾:
            命令行 rm -rf /iscsi/elk/elasticsearch/certs/kibana
        文件提權:
            命令行 chmod 777 /iscsi/elk/elasticsearch/config/certs/http.p12 
        設置http密碼:
            命令行 docker exec -it elasticsearch /bin/bash
            命令行 ./bin/elasticsearch-keystore add xpack.security.http.ssl.keystore.secure_password
            退出容器
        重啟elasticsearch容器:                    
            命令行 docker restart elasticsearch
        設置elastic用戶的密碼:
            進入容器: 命令行 docker exec -it elasticsearch /bin/bash
            設置密碼: ./bin/elasticsearch-reset-password -u elastic -i
        設置kibana_system密碼:
            命令行 ./bin/elasticsearch-reset-password -u kibana_system -i
        生成kibana用https訪問的公鑰和私鑰:
            命令行 ./bin/elasticsearch-certutil csr -name kibana-server
            備注 生成csr-bundle.zip文件夾
        復制csr-bundle.zip到kibana:
            退出容器
            命令行 docker cp elasticsearch:/usr/share/elasticsearch/csr-bundle.zip /iscsi/elk/kibana/
        解壓csr-bundle.zip:
            命令行 cd /iscsi/elk/kibana/
            命令行 unzip /iscsi/elk/kibana/csr-bundle.zip
            備注 解壓后會生成 kibana-server 文件夾
        移動文件到kibana的配置目錄:
            命令行 mv /iscsi/elk/kibana/kibana-server/* /iscsi/elk/kibana/config/
            命令行 rm -rf /iscsi/elk/kibana/kibana-server
        生成kibana-server.crt文件:
            命令行 cd /iscsi/elk/kibana/config
            命令行 openssl  x509 -req -days 3650 -in kibana-server.csr -signkey kibana-server.key -out kibana-server.crt
        文件提權:
            命令行 chmod 777 elasticsearch-ca.pem kibana-server.csr kibana-server.key kibana-server.crt
        修改kibana.yml文件:
            命令行 vim /iscsi/elk/kibana/config/kibana.yml
            最終文件為
            `
                #
                # ** THIS IS AN AUTO-GENERATED FILE **
                #

                # Default Kibana configuration for docker target
                server.host: "0.0.0.0"
                server.shutdownTimeout: "5s"
                elasticsearch.hosts: [ "https:/172.99.0.2:9200" ]
                monitoring.ui.container.elasticsearch.enabled: true
                elasticsearch.ssl.certificateAuthorities: ["/usr/share/kibana/config/elasticsearch-ca.pem"]
                elasticsearch.username: "kibana_system"
                elasticsearch.password: "tonglian@126.com"

                server.ssl.certificate: "/usr/share/kibana/config/kibana-server.crt"
                server.ssl.key: "/usr/share/kibana/config/kibana-server.key"
                server.ssl.enabled: true
                # 設置中文訪問
                i18n.locale: "zh-CN"                        
            `
        重啟kiban:
            命令行 docker restart kibana
        配置logstash:
            設置logstash_system密碼:
                命令行 docker exec -it elasticsearch /bin/bash
                命令行 ./bin/elasticsearch-reset-password -u logstash_system -i
            生成logstash.pem文件:
                退出容器
                命令行 openssl pkcs12 -in elasticsearch/config/certs/elastic-certificates.p12 -cacerts -nokeys -chain  -out logstash.pem
            移動logstash.pem文件到logstash配置文件目錄下:
                命令行 mv /iscsi/elk/elasticsearch/config/certs/logstash.pem /iscsi/elk/logstash/config/
            提權l(xiāng)ogstash.pem:
                命令行 chmod 777 /iscsi/elk/logstash/config/logstash.pem
            配置logstash.yml文件:
                命令行 vim /iscsi/elk/logstash/config/logstash.yml
                最終文件
                `
                    http.host: "0.0.0.0"
                    xpack.monitoring.elasticsearch.hosts: [ "https://172.99.0.2:9200" ]
                    #你的ca.pem 的所在路徑
                    xpack.monitoring.elasticsearch.ssl.certificate_authority: "/usr/share/logstash/config/logstash.pem"
                    xpack.monitoring.elasticsearch.ssl.verification_mode: certificate
                    # 探嗅 es節(jié)點，設置為 false
                    xpack.monitoring.elasticsearch.sniffing: false
                    xpack.monitoring.elasticsearch.username: "logstash_system"
                    xpack.monitoring.elasticsearch.password: "tonglian@126.com"                            
                `
            配置logstash.conf文件:
                命令行 vim /iscsi/elk/logstash/pipeline/logstash.conf
                最終文件
                `
                    input {
                        tcp {
                            port => 21068
                            codec => json_lines
                        }
                    }

                    output {
                        elasticsearch {
                            hosts => ["https://172.99.0.2:9200"]
                            index => "tonywoo-%{+YYYY.MM.dd}"
                            user => "elastic"
                            password => "tonglian@126.com"
                            ssl_enabled => true
                            ssl_certificate_authorities => ["/usr/share/logstash/config/logstash.pem"]
                        }
                    }                            
                `
            重啟logstash:
                docker restart logstash
        設置自動啟動:
        `
            cat > /etc/systemd/system/docker-compose-elk.service << EOF

            [Unit]
            Description=Docker Compose Application Service
            Requires=docker.service
            After=docker.service

            [Service]
            Type=oneshot
            RemainAfterExit=yes
            WorkingDirectory=/iscsi/elk/
            ExecStart=/iscsi/elk/docker-compose -f docker-compose-elk.yml up -d
            ExecStop=/iscsi/elk/docker-compose -f docker-compose-elk.yml up down
            TimeoutStartSec=0

            [Install]
            WantedBy=multi-user.target                        
        `
        回車
        命令行 ctrl+d

到了這里，關于Elasticsearch 8.x ELK 搭建并配置 SSL的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關文章，希望大家以后多多支持TOY模板網(wǎng)！