Elasticsearch8.1.0 集群搭建（linux）
一、传统模式
1.下载elasticsearch
Download Elasticsearch | Elastic
最新版的elasticsearch，最好jdk选用17
2.linux配置es用户
tar -xzvf elasticsearch-8.1.0-linux-x86_64.tar.gz
groupadd es
useradd es -g es
passwd es : 123456
chown -R es:es elasticsearch-8.1.0
su es
3.配置证书
切换到elasticseach 目录 执行：
bin/elasticsearch-certutil ca
节点生成证书和私钥：
bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
将证书（elastic-certificates.p12）拷贝到elasticsearch的每个节点下面config/certs目录下，初始化没有，需要自己创建
如果在创建证书的过程中加了密码，需要将你的密码加入到你的elasticsearch keystore中去
bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password
配置elasticsearch.yml文件:
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: certs/elastic-certificates.p12
truststore.path: certs/elastic-certificates.p12
5.给认证的集群生成用户名密码
bin/elasticsearch-setup-passwords interactive
Changed password for user [apm_system]
Changed password for user [kibana_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]
- elastic 账号：拥有 superuser 角色，是内置的超级用户。
- kibana 账号：拥有 kibana_system 角色，用户 kibana 用来连接 elasticsearch 并与之通信。Kibana 服务器以该用户身份提交请求以访问集群监视 API 和 .kibana 索引。不能访问 index。
- logstash_system 账号：拥有 logstash_system 角色。用户 Logstash 在 Elasticsearch 中存储监控信息时使用。
- beats_system账号：拥有 beats_system 角色。用户 Beats 在 Elasticsearch 中存储监控信息时使用。
重置密码: bin /elasticsearch-reset-password -uelastic
二、令牌方式
1.下载elasticsearch 解压
2.根目录执行 bin/elasticsearch
3.获取初始化信息
Elasticsearch security features have been automatically configured!
Authentication is enabled and cluster connections are encrypted.
Password for the elastic user (reset with`bin/elasticsearch-reset-password -u elastic`):
Mby=9J8eTZGJETgEj*a-
HTTP CA certificate SHA-256 fingerprint:
95cf401e6cea0395de4587c5eb9467df5103169acc8ab404e08ea74407b133b72
Configure Kibana to use this cluster:
Run Kibana and click the configuration link in the terminal when Kibana starts.
Copy the following enrollment token and paste it into Kibana in your browser (valid for the next 30 minutes):
eyJ2ZXIiOiI4LjEuMCIsImFkciI6WyIxNzIuMTguMTMwLjIxOjkyMDAiXSwiZmdyIjoiOTVjZjQwMWU2Y2VhMDM5NWRlNDU4N2M1ZWI5NDY3ZGY1MTAzMTY5YWNjOGFiNDA0ZTA4ZWE3NDQwN2IxMzNiNyIsImtleSI6IjBxaWhfWDhCNTRGWHhzVHRHTUxvOm5yRWo0Tm5IVE51VkxKaDR4MzVnY2cifQ==
Configure other nodes to join this cluster:
On this node:
Create an enrollment token with `bin/elasticsearch-create-enrollment-token -s node`.
Uncomment the transport.host setting at the end of config/elasticsearch.yml.
Restart Elasticsearch.
On other nodes:
Start Elasticsearch with `bin/elasticsearch --enrollment-token `, using the enrollment token that you generated.
4.加入节点
在elasticsearch.yml中 打开transport.host: [_local_, _site_]
执行 bin/elasticsearch-create-enrollment-token -s node 获取节点令牌
配置要加入的节点，执行bin/elasticsearch -d --enrollment-token