elk集群开启xpack

本文没开启证书，大家可以按需设置

一、es集群配置

es集群
10.10.100.4
10.10.100.5
10.10.100.6

1、开启的配置如下（增加的配置参数）

# /etc/elasticsearch/elasticsearch.yml 
xpack.security.enabled: true

2、重启es集群（三台都要操作）

# systemctl   restart elasticsearch

3、创建认证用户（在其中一台es上操作即可，无需全部操作）

# /usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto

二、logstash服务配置

1、修改主配置文件，增加配置

# /etc/logstash/logstash.yml
xpack.monitoring.elasticsearch.hosts: ["http://10.10.100.4:9200", "http://10.10.100.5:9200","http://10.10.100.6:9200"]
xpack.monitoring.elasticsearch.username: "logstash_system"
xpack.monitoring.elasticsearch.password: "xxxxxxxx"

2、修改自定义配置文件，添加用户名和密码信息

# /etc/logstash/conf.d/logstash.conf
    user => "elastic"
    password => "xxxxxx"

3、重启服务即可

# systemctl    restart logstash

三、kibana服务的配置

1、修改配置文文件

# /etc/kibana/kibana.yml
elasticsearch.username: "kibana_system"
elasticsearch.password: "xxxxxxxxxxxxxxxxxxx"

2、重启服务即可

#  systemctl   restart   kibana

设置完毕之后

es-head和kibana的页面的登录账户都是elastic

TIP

1、
/usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto执行之后密码忘记了，再次执行会报错

如果是新平台的话（操作会删除历史数据，谨慎操作）

#!/bin/bash
systemctl   stop elasticsearch;  rm -rf /var/lib/elasticsearch/*; systemctl   start elasticsearch
如果是老平台（已经使用一段时间，有历史数据），建议用如下方式修改密码

curl -H "Content-Type:application/json" -XPOST -u elastic 'http://10.10.100.4:9200/_xpac
k/security/user/elastic/_password' -d '{ "password" : "123456" }'

2、kibana如果有类似报错

Mar  3 14:17:19 elk-kibana kibana[18347]: {"type":"log","@timestamp":"2021-03-03T06:17:19Z","tags":["error","elasticsearch","data"],"pid":18347,"message":"[ConnectionError]: write EPROTO 140025465014080:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:332:\n"}
是因为kibana连接es的时候用了https修改为http即可

elasticsearch.hosts: ["http://10.10.100.4:9200","http://10.10.100.5:9200","http://10.10.100.6:9200"]

3、logstash有如下报错

Mar 03 14:09:25 elk-logstash logstash[1762]: [2021-03-03T14:09:25,571][ERROR][logstash.licensechecker.licensereader] Unable to
Mar 03 14:09:55 elk-logstash logstash[1762]: [2021-03-03T14:09:55,572][ERROR][logstash.licensechecker.licensereader] Unable to
原因是
/etc/logstash/logstash.yml忘记添加认证信息