elk设置密码，elasticsearch设置密码

elasticsearch设置密码

1. 安装x-pack，因为6.6.1版本默认是已经安装的了，所以这一步可以跳过。
2. 用命令elasticsearch-setup-passwords interactive安装，报ERROR: X-Pack Security is not available.错
   
3. 查找资料发现是由于这个版本默认带的license是basic的，不支持security这类商业特性。 可以将license改为trial。elasticsearch.yml文件末尾增加如下代码。或者在kibana的Machine Learning开启 trial

xpack.security.enabled: true
xpack.ml.enabled: true
xpack.license.self_generated.type: trial

4. 重启elasticsearch，重新设置密码成功
   
5. 修改kibana.yml增加es验证，重启后kibana进入登录界面

elasticsearch.username: "elastic"
elasticsearch.password: "password"

6. 设置logstash密码，修改logst.yml

xpack.management.elasticsearch.username: elastic
xpack.management.elasticsearch.password: password
xpack.management.elasticsearch.url: ["http://elasticsearch:9200"]

修改*.conf文件，需要注意的是密码有符合一定要加""不然会报错，password => “password”

input {
    beats {
        port => "5044"
    }
}
 filter {
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
    }
    geoip {
        source => "clientip"
    }
}
output {
    elasticsearch {
        hosts => [ "elasticsearch:9200" ]
        user => elastic
        password => "password"
        index => "%{[fields][document_type]}-%{+YYYY.MM.dd}"
    }
}

7. 修改filebeat.yml，增加密码验证。然后重启

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /workspace/web/**/*.log
  tags: ["web-log"]
  fields:
    document_type: web-log
filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml
  # Set to true to enable config reloading
  reload.enabled: true
setup.dashboards.enabled: true
output.logstash:
    hosts: ["192.168.10.201:5044"]
    username: "elasitc"
    password: "password"
setup.kibana:
    host: "192.168.10.201:5601"
    username: "elastic"
    password: "password"

8. elasticsearch-head设置密码访问：编辑elasticsearch.yml，增加http.cors.allow-headers: Authorization；重启后浏览器输入http://192.168.10.201:9100/?auth_user=elastic&auth_password=password