一、 为添加Elasticsearch添加账号
adduser elastic
chown -R elastic:elastic /usr/share/elasticsearch/
二、 es启动时可能出现如下问题
原因：linux中elasticsearch最大文件打开数太小，需要我们修改到对应的数值
错误1
max file descriptors [4096] for elasticsearch process is too low, increase to at
解决：
修改/etc/security/limits.conf文件，添加或修改如下行：
* hard nofile 65536
* soft nofile 65536
错误2
max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
修改 /etc/sysctl.conf 文件,添加如下行：
vm.max_map_count=262144
修改好了以后，运行/sbin/sysctl -p
重启以后，再启动es即可，就可以通过主机ip访问。
三、调整内存大小
编辑elasticsearch/config/jvm.options
-Xms2g
-Xmx2g
四、head插件设置
- 不限制访问IP
编辑head/Gruntfile.js
connect: {
server: {
options: {
port: 9100,
hostname: '*', #此处设置
base: '.',
keepalive: true
}
}
}
- 修改head连接es的地址
编辑head/_site/app.js，修改localhost为es服务器IP
this.base_uri = this.config.base_uri || this.prefs.get("app-base_uri") || "http://localhost:9200";
五、添加认证
- 安装x-pack
bin/elasticsearch-plugin install x-pack
- 设置验证密码
进入elasticsearch/bin/x-pack
./setup-passwords interactive
会对elasticsearch、logstash、kibana分别设置登录密码（默认es用户名为elastic，logstash用户名为logstash_system，kibana用户名为kibana）
elasticsearch/bin/x-pack$ ./setup-passwords interactive
Initiating the setup of passwords for reserved users elastic,kibana,logstash_system.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]yes
Did not understand answer 'yes'
Please confirm that you would like to continue [y/N]y
Enter password for [elastic]:
Reenter password for [elastic]:
Enter password for [kibana]:
Reenter password for [kibana]:
Enter password for [logstash_system]:
Reenter password for [logstash_system]:
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [elastic]
- 设置elasticsearch配置文件
编辑 elasticsearch/config/elasticsearch.yml
http.cors.enabled: true
http.cors.allow-origin: '*'
http.cors.allow-headers: Authorization,X-Requested-With,Content-Length,Content-Type
- head访问方式
http://localhost:9100/?base_uri=http://localhost:9200&auth_user=elastic&auth_password=password
- 命令行使用
curl -u elastic:blackey -XPUT http://10.2.197.69:9200/baidu -H 'Content-Type: application/json' -d '{}'
六、kibana添加认证
- 安装x-pack,文件有200多兆，很慢，耐心等待
./bin/kibana-plugin install x-pack
- 配置kibana配置文件
修改如下配置信息
注意：用户名和密码必须与之前x-pack设置的kibana账号密码一致
server.host: "0.0.0.0"
elasticsearch.url: "http://10.2.97.169:9200" #10.2.97.169为es服务器IP地址
elasticsearch.username: "kibana" # 用户名
elasticsearch.password: "password" # 密码
- 开启kibana
./bin/kibana 正常启动
./bin/kibana & 后台启动
- 登录kibana
浏览器打开http://10.2.97.169:5601/
输入步骤2中的账号密码即可
如果想对之前用elastic账号导入的数据库操作，请使用elastic(用户名)、password（密码）登录
11.png
2.png
设置角色权限与添加用户
curl -u elastic:password -XPOST http://10.2.97.169:9200/_xpack/security/role/events_admin -H 'Content-Type: application/json' -d '{
"indices" : [
{
"names" : [ "events*" ],
"privileges" : [ "all" ]
},
{
"names" : [ ".kibana*" ],
"privileges" : [ "manage", "read", "index" ]
}
]
}'
curl -u elastic:password -XPOST http://10.2.97.169:9200/_xpack/security/user/jack -H 'Content-Type: application/json' -d '{
"password" : "123456",
"full_name" : "test",
"email" : "test@163.com",
"roles" : [ "events_admin" ]
}'
- x-pack license过期
启动ElasticSearch时提示:
[2017-06-20T09:54:43,462][ERROR][o.e.x.s.a.f.SecurityActionFilter] [_gHqs1e] blocking [cluster:monitor/stats] operation due to expired license. Cluster health, cluster stats and indices stats
operations are blocked on license expiration. All data operations (read and write) continue to work.
If you have a new license, please update it. Otherwise, please reach out to your support contact.
直接影响的后果是kibana web页无法�访问
是因为证书过期了,需要注册申请一个license.
申请地址: https://register.elastic.co/marvel_register
注册后将以email的方式发送，通过链接下载license json文件.
根据文档提示请求api并指定新的证书
$ curl -XPUT -u elastic:changeme 'http://192.168.2.110:9200/_xpack/license?acknowledge=true' -H "Content-Type: application/json" -d @hakim-zhao-705a2a54-84d9-4ea8-b4ca-23b9d75b4ead-v5.json
{"acknowledged":true,"license_status":"valid"}
查看最新证书状态:
$ curl --user elastic:changeme 'http://192.168.2.110:9200/_xpack/license'
{
"license" : {
"status" : "active",
"uid" : "5-84d9-4ea8-b4ca-23b9d75b4ead",
"type" : "basic",
"issue_date" : "2017-06-20T00:00:00.000Z",
"issue_date_in_millis" : 1497916800000,
"expiry_date" : "2018-06-20T23:59:59.999Z",
"expiry_date_in_millis" : 1529539199999,
"max_nodes" : 100,
"issued_to" : "hakim zhao (none)",
"issuer" : "Web Form",
"start_date_in_millis" : 1497916800000
}
}
可以看到证书是自生效起有1年的使用期。。
