ElasticSearch ( 一 ) 安装启动

ElasticSearch 全局检索

Elasticsearch是一个基于Lucene的搜索服务器。它提供了一个分布式多用户能力的全文搜索引擎，基于RESTful web接口。

官网: https://www.elastic.co/cn/

1.ElasticSearch 安装启动

复制 到 /usr/local

解压

tar -zvxf elasticsearch-7.15.0.tar.gz

修改配置文件

vi elasticsearch-7.15.0/config/jvm.options

修改 占用的内存 将 Xms1g和Xmx1g 修改 成 Xms512m和Xmx512m

否则可能 会报

################################################################
## IMPORTANT: JVM heap size
################################################################
##
## The heap size is automatically configured by Elasticsearch
## based on the available memory in your system and the roles
## each node is configured to fulfill. If specifying heap is
## required, it should be done through a file in jvm.options.d,
## and the min and max should be set to the same value. For
## example, to set the heap to 4 GB, create a new file in the
## jvm.options.d directory containing these lines:
##
-Xms512m
-Xmx512m

vi elasticsearch-7.15.0/config/elasticsearch.yml

增加 network.host: 0.0.0.0，使其支持外网访问, 注意 : 与 0 之间有一个 空格。

# ---------------------------------- Network -----------------------------------
#
# By default Elasticsearch is only accessible on localhost. Set a different
# address here to expose this node on the network:
#
#network.host: 192.168.0.1
network.host: 0.0.0.0

进入到 bin 文件夹启动

cd elasticsearch-7.15.0/bin
./elasticsearch

会 报错

这说明 不能root 用户来 启动 elasticsearch

创建新的用户 并 切换到新用户, 授权后 再 启动

# 返回 local文件夹
[root@localhost bin]# cd /usr/local
# 创建新的用户  elastic
[root@localhost local]# useradd elastic
# 为 elastic 授权
[root@localhost local]# chown elastic elasticsearch-7.15.0 -R
# 切换到 elastic 用户
[root@localhost local]#  su elastic
# 进入 bin 文件夹
[elastic@localhost local]$ cd elasticsearch-7.15.0/bin 
# 启动
[elastic@localhost bin]$ ./elasticsearch

这样启动是 前台进程, 也可以启动为 后台进程

启动

./elasticsearch -d

通过 下面指令 测试 elastic 是否启动成功

curl -XGET "http://localhost:9200"

出现 下列信息 启动成功

[elastic@localhost bin]$ curl -XGET "http://localhost:9200"
{
  "name" : "localhost.localdomain",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "MRjih-fwRTSBNPfM97Gb4w",
  "version" : {
    "number" : "7.15.0",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "79d65f6e357953a5b3cbcc5e2c7c21073d89aa29",
    "build_date" : "2021-09-16T03:05:29.143308416Z",
    "build_snapshot" : false,
    "lucene_version" : "8.9.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

外网访问 可能 报错

 
ERROR: [3] bootstrap checks failed. You must address the points described in the following [3] lines before starting Elasticsearch.
bootstrap check failure [1] of [3]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
bootstrap check failure [2] of [3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
bootstrap check failure [3] of [3]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured
ERROR: Elasticsearch did not exit normally - check the logs at /usr/local/elasticsearch-7.15.0/logs/elasticsearch.log

ERROR: [3] bootstrap checks failed

[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

原因：无法创建本地文件问题,用户最大可创建文件数太小，

每个进程最大同时打开文件数太小，可通过下面2个命令查看当前数量

ulimit -Hn
ulimit -Sn

解决方案：切换到root用户，编辑limits.conf配置文件， 添加类似如下内容：

vi /etc/security/limits.conf

然后添加如下内容: 注意*不要去掉了

*               soft    nofile          65536
*               hard    nofile          65536

注：* 代表Linux所有用户名称（比如 elastic）

需要保存、退出、重新登录才可生效。

[2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解决办法：编辑 /etc/sysctl.conf

vi /etc/sysctl.conf

追加以下内容：

vm.max_map_count=655360

保存后，执行：

sysctl -p

[3]: max number of threads [2048] for user [tongtech] is too low, increase to at least [4096]

错误原因：启动检查未通过, elasticsearch用户的最大线程数太低
解决办法：

vi /etc/security/limits.d/90-nproc.conf

将2048改为4096或更大

[4]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured

解决办法：

修改

vi elasticsearch-7.15.0/config/elasticsearch.yml

取消注释
cluster.initial_master_nodes: [“node-1”]

启动异常

OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.

改jvm.options文件配置/jvm.options，将对就jdk 版本的

-XX:+UseConcMarkSweepGC 改为 -XX:+UseG1GC

2.kibana 安装启动

安装启动

复制 到 /usr/local

解压

tar -zxvf kibana-7.15.0-linux-x86_64.tar.gz

修改配置文件

vi kibana-7.15.0-linux-x86_64/config/kibana.yml

server.port: 5601

server.host: "192.168.3.220"   # elasticSearch 所在ip

elasticsearch.hosts: ["http://192.168.3.220:9200"]   # 修改成 elasticSearch 所在ip

kibana.index: ".kibana"

# logging.dest: /opt/es/kibana-7.7.0-linux-x86_64/log/kibana.log   # 配置日志输出位置

i18n.locale: "zh-CN"  # 汉化,在最下面配置

为用户 授权

启动

# 为 elastic 授权
[root@localhost local]# chown elastic kibana-7.15.0-linux-x86_64 -R
# 切换到 elastic 用户
[root@localhost local]#  su elastic
# 进入 bin 文件夹
[elastic@localhost local]$ cd kibana-7.15.0-linux-x86_64/bin 
# 启动
[elastic@localhost bin]$ ./kibana &

1，警告

server log [06:55:25.594] [warning][reporting] Generating a random key for xpack.reporting.encryptionKey.

　　　　　　　　 To prevent pending reports from failing on restart, please set xpack.reporting.encryptionKey in kibana.yml

根据提示，在配置文件kibana.yml中添加【xpack.reporting.encryptionKey】属性：

xpack.reporting.encryptionKey: "encryptionKeyreporting12345678909876543210"

2，警告

server log [06:55:25.686] [warning][security] Generating a random key for xpack.security.encryptionKey.

　　 To prevent sessions from being invalidated on restart, please set xpack.security.encryptionKey in kibana.yml

根据提示，在配置文件kibana.yml中添加【xpack.security.encryptionKey】属性：

xpack.security.encryptionKey:  "encryptionKeysecurity12345678909876543210"

3，警告

  log   [06:48:39.909] [warning][config][encryptedSavedObjects][plugins] Generating a random key for xpack.encryptedSavedObjects.encryptionKey. To be able to decrypt encrypted saved objects attributes after restart, please set xpack.encryptedSavedObjects.encryptionKey in kibana.yml

根据提示，在配置文件kibana.yml中添加【xpack.security.encryptionKey】属性：

xpack.encryptedSavedObjects.encryptionKey: "encryptedSavedObjects12345678909876543210"

4***

 Could not create APM Agent configuration: Request Timeout after 30000ms

将 elasticsearch.yml 中这个注释放开

discovery.type: single-node

同时 cluster.initial_master_nodes: [“node-1”] 注释

#cluster.initial_master_nodes: ["node-1"]

[warning][config][plugins][security] Session cookies will be transmitted over insecure connections. This is not recommended.

是说明kibana访问没有使用https的方式 Kibana没有配置SSL导致的。

- ES操作

# 先在配置文件中开启这两个
xpack.security.enabled: true
# xpack.security.transport.ssl.enabled: true # 这个先不开启的

# 然后重启es集群

# 设置默认的角色密码
bin/elasticsearch-setup-passwords interactive

# 创建keystore文件
# bin/elasticsearch-keystore create # config文件夹下有的话这一步就不用再执行了

# 生成CA证书，一直回车
bin/elasticsearch-certutil ca (CA证书：elastic-stack-ca.p12)

# 生成节点使用的证书，一直回车
bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12  (节点证书：elastic-certificates.p12)

# 创建证书保存目录，并移动到config文件下
mkdir -p config/certs
mv elastic-certificates.p12 config/certs

# 集群身份认证与用户鉴权
xpack.security.enabled: true # 若设置过则不用再设置了

# 集群内部安全通信
xpack.security.transport.ssl.enabled: true # 若设置过则不用再设置了
xpack.security.transport.ssl.verification_mode: certificate # 证书验证级别
xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12 # 节点证书路径
xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12

# 集群与外部间的安全通信
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: certs/elastic-certificates.p12
xpack.security.http.ssl.truststore.path: certs/elastic-certificates.p12

# 重启es集群
# 注意查看日志，留意节点访问证书权限

- kibana操作

# es上操作
# 从es节点拷贝节点证书到kibana根目录下
cp /usr/local/elasticsearch-7.5.0/config/certs/elastic-certificates.p12 /usr/local/kibana-7.5.0-linux-x86_64/

# kibana上操作
# 生成连接es的https的证书
# elastic-certificates.p12为上一步节点证书(注意这个证书权限),elastic-ca.pem为生成的供kibana使用的证书
openssl pkcs12 -in elastic-certificates.p12 -cacerts -nokeys -out elastic-ca.pem

# 创建证书保存目录，并移动到config文件下
mkdir -p config/certs
mv elastic-certificates.p12 elastic-ca.pem config/certs

# kibana配置连接ES的https
elasticsearch.hosts: ["https://192.168.80.10:9200"]
elasticsearch.ssl.certificateAuthorities: ["/usr/local/kibana-7.5.0-linux-x86_64/config/certs/elastic-ca.pem"]
elasticsearch.ssl.verificationMode: certificate # 证书验证级别

# kibana配置连接ES,使用用户名和密码
elasticsearch.username: "kibana"
elasticsearch.password: "changeme"

# 使用https方式访问kibana
# es上操作
bin/elasticsearch-certutil ca --pem (elastic-stack-ca.zip)
unzip elastic-stack-ca.zip
# 得到ca.crt和ca.key
   creating: ca/
  inflating: ca/ca.crt
  inflating: ca/ca.key

# 从es节点拷贝上一步生成的证书到kibana证书目录下
cp /usr/local/elasticsearch-7.5.0/ca/* /usr/local/kibana-7.5.0-linux-x86_64/config/certs/
# 非必须:修改证书权限

# kibana上操作
# 开启，并设置证书(注意证书路径写法)
server.ssl.enabled: true
server.ssl.certificate: config/certs/ca.crt
server.ssl.key: config/certs/ca.key

es配置文件

cluster.name: my-application
node.name: node0
path.data: node0_data
network.host: 192.168.80.10
http.port: 9200
discovery.seed_hosts: ["192.168.80.10"]
cluster.initial_master_nodes: ["192.168.80.10"]

xpack.security.enabled: true

xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: certs/elastic-certificates.p12
xpack.security.http.ssl.truststore.path: certs/elastic-certificates.p12

xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12

kibana配置文件

server.port: 5601
server.host: "192.168.80.10"
elasticsearch.hosts: ["https://192.168.80.10:9200"]

elasticsearch.username: "kibana"
elasticsearch.password: "changeme"

server.ssl.enabled: true
server.ssl.certificate: config/certs/ca.crt
server.ssl.key: config/certs/ca.key

elasticsearch.ssl.certificateAuthorities: ["/usr/local/kibana-7.5.0-linux-x86_64/config/certs/elastic-ca.pem"]
elasticsearch.ssl.verificationMode: certificate