设备 应用部署 路径
1 | 192.168.1.54 | elasticsearch自带jdk、elasticsearch-7.10.2、opendistro相关插件、kibana | /data/apps
2 | 192.168.1.55 | elasticsearch自带jdk、elasticsearch-7.10.2、opendistro相关插件 | /data/apps
3 | 192.168.1.56 | elasticsearch自带jdk、elasticsearch-7.10.2、opendistro相关插件 | /data/apps
4 | 192.168.1.57 | elasticsearch自带jdk、elasticsearch-7.10.2、opendistro相关插件 | /data/apps
安装环境
centos 7.6
软件及插件
1.软件
elasticsearch-710.2-linux-x86_64.tar.gz
kibana-7.10.2-linux-x86_64.tar.gz
2.插件(可以按照官方对应版本信息进行安装：https://opendistro.github.io/for-elasticsearch-docs/docs/install/plugins/)
opendistro-security-1.13.1.0.zip #安全插件，用于审计和鉴权
elasticsearch-analysis-ik-7.10.2.zip #索引分词器
elasticsearch-sql-7.10.2.0.zip #sql 查询插件 （也可以私用opendistro_sql，两个插件不兼容，只能用其一）
安装步骤
添加es管理用户
groupadd elasticsearch && useradd -d /home/elasticsearch -m elasticsearch -g elasticsearch
创建应用目录
mkdir -p /data/apps
修改打开文件句柄
echo "* soft nofile 1000000" >> /etc/security/limits.conf echo "* hard nofile 1000000" >> /etc/security/limits.conf echo "* soft nproc 1000000" >> /etc/security/limits.conf echo "* hard nproc 1000000" >> /etc/security/limits.conf echo "* soft memlock unlimited" >> /etc/security/limits.conf echo "* hard memlock unlimited" >> /etc/security/limits.conf sed -i 's/4096/1000000/' /etc/security/limits.d/20-nproc.conf
内核参数设置
cat >> /etc/sysctl.conf << EOF net.ipv4.conf.all.send_redirects=0 net.ipv4.conf.default.send_redirects=0 net.ipv4.conf.all.accept_redirects=0 net.ipv4.conf.default.accept_redirects=0 net.ipv4.conf.all.secure_redirects=0 net.ipv4.conf.default.secure_redirects=0 net.ipv4.conf.all.rp_filter=1 net.ipv4.conf.default.rp_filter=1 net.ipv6.conf.all.accept_ra=0 net.ipv6.conf.default.accept_ra=0 net.ipv6.conf.all.accept_redirects=0 net.ipv6.conf.default.accept_redirects=0 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_tw_recycle = 1 net.ipv4.tcp_fin_timeout=10 net.ipv4.tcp_max_syn_backlog = 32768 net.ipv4.tcp_max_tw_buckets = 180000 net.ipv4.tcp_rmem = 4096 87380 4194304 net.ipv4.tcp_wmem = 4096 16384 4194304 net.core.wmem_default = 8388608 net.core.rmem_default = 8388608 net.core.rmem_max = 16777216 net.core.wmem_max = 16777216 net.core.netdev_max_backlog = 500000 fs.nr_open = 2500000 vm.zone_reclaim_mode = 0 vm.max_map_count = 655360 vm.swappiness=0 EOF #执行生效 sysctl -p
1.esasticsearch 的下载路径
Past Releases of Elastic Stack Software | Elastic（https://www.elastic.co/cn/downloads/past-releases#elasticsearch）
2kibana的下载地址
Past Releases of Elastic Stack Software | Elastic （https://www.elastic.co/cn/downloads/past-releases#kibana）
3.huawei 国内镜像源网站
华为开源镜像站_软件开发服务_华为云（https://mirrors.huaweicloud.com/）
在其中一个节点上下载
下载elasticsearch 和 kibana （此处的插件也可按照opendistro 官网 进行安装：https://opendistro.github.io/for-elasticsearch-docs/docs/install/plugins/）
wget -c -N https://d3g5vo6xdbdb9a.cloudfront.net/downloads/elasticsearch-plugins/opendistro-security/opendistro-security-1.13.1.0.zip wget -N https://d3g5vo6xdbdb9a.cloudfront.net/downloads/kibana-plugins/opendistro-security/opendistroSecurityKibana-1.13.0.1.zip wget -N https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-710.2-linux-x86_64.tar.gz wget -N https://artifacts.elastic.co/downloads/kibana/kibana-7.10.2-linux-x86_64.tar.gz wget -N https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.10.2/elasticsearch-analysis-ik-7.10.2.zip wget -N https://github.com/NLPchina/elasticsearch-sql/releases/download/7.10.2.0/elasticsearch-sql-7.10.2.0.zip
安装jdk （自行下载）
tar zxf /root/jdk-8u202-linux-x64.tar.gz -C /usr/local/ sed -i '/JAVA_HOME/d' /etc/profile cat >> /etc/profile <安装esasticsearch
#配置启动用户 groupadd elasticsearch && useradd -d /home/elasticsearch -m elasticsearch -g elasticsearch tar -zxvf /root/elasticsearch-710.2-linux-x86_64.tar.gz -C /data/apps/ chown -R elasticsearch:elasticsearch /data/apps/elasticsearch-710.2修改ES_HOME 启动调用 自身的jdk 修改配置文件 elasticsearch-7.10.2/bin/elasticsearch-env 让jdk 不受外部jdk环境的影响
# now set the path to java if [ ! -z "$JAVA_HOME" ]; then #java指向ES_HOME 下的jdk JAVA="$ES_HOME/jdk/bin/java" #注释掉系统环境jdk调用 #JAVA="$JAVA_HOME/bin/java" JAVA_TYPE="JAVA_HOME"修改java vm 在 elasticsearch-7.10.2/config/jvm.options文件中添加 启动项，根据实际内存定，jvm最大31G，超出会造成指针浪费
-Xms30g -Xmx30g -XX:MetaspaceSize=256m -XX:MaxMetaspaceSize=256m -XX:+AlwaysPreTouch -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:+ScavengeBeforeFullGC -XX:InitiatingHeapOccupancyPercent=35 -XX:G1ReservePercent=20安装插件（此处的插件也可按照opendistro 官网 进行安装：https://opendistro.github.io/for-elasticsearch-docs/docs/install/plugins/）
su - elasticsearch -c "cd /data/apps/elasticsearch-7.10.2/ && bin/elasticsearch-plugin install file:///root/opendistro-security-1.13.1.0.zip" su - elasticsearch -c "cd /data/apps/elasticsearch-7.10.2/ && bin/elasticsearch-plugin install file:///root/elasticsearch-analysis-ik-7.10.2.zip" su - elasticsearch -c "cd /data/apps/elasticsearch-7.10.2/ && bin/elasticsearch-plugin install file:///root/elasticsearch-sql-7.10.2.0.zip"自建证书签发
CA服务器根证书
root-ca.pem 证书管理证书
admin.pem 证书 admin-key.pem 私钥节点证书
node.pem 证书 node-key.pem 私钥手动签发证书和自动自动签发证书（两种自选）
手动签发
ca证书
#生成key openssl genrsa -out root-ca-key.pem 2048 #按照步填写参数 openssl req -new -x509 -sha256 -key root-ca-key.pem -out root-ca.pem -days 36500 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BJ Locality Name (eg, city) [Default City]: Organization Name (eg, company) [Default Company Ltd]: Organizational Unit Name (eg, section) []:ROOT Common Name (eg, your name or your server's hostname) []:ROOT Email Address []:管理员证书
#生成管理员证书步骤 openssl genrsa -out admin-key-temp.pem 2048 openssl pkcs8 -inform PEM -outform PEM -in admin-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out admin-key.pem #证书参数填写内容 openssl req -new -key admin-key.pem -out admin.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BJ Locality Name (eg, city) [Default City]: Organization Name (eg, company) [Default Company Ltd]: Organizational Unit Name (eg, section) []:ADMIN Common Name (eg, your name or your server's hostname) []:ADMIN Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: #生成证书 openssl x509 -req -in admin.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out admin.pem -days 36500节点证书
#制作节点证书（节点使用通用证书） openssl genrsa -out node-key-temp.pem 2048 openssl pkcs8 -inform PEM -outform PEM -in node-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out node-key.pem [root@localhost]# openssl req -new -key node-key.pem -out node.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BJ Locality Name (eg, city) [Default City]: Organization Name (eg, company) [Default Company Ltd]: Organizational Unit Name (eg, section) []:NODE Common Name (eg, your name or your server's hostname) []:NODE Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: #输出到证书 openssl x509 -req -in node.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out node.pem -days 36500提取证书信息
[root@localhost]# openssl x509 -subject -nameopt RFC2253 -noout -in root-ca.pem subject= CN=ROOT,OU=ROOT,O=Default Company Ltd,L=Default City,ST=BJ,C=CN [root@localhos]# openssl x509 -subject -nameopt RFC2253 -noout -in admin.pem subject= CN=ADMIN,OU=ADMIN,O=Default Company Ltd,L=Default City,ST=BJ,C=CN [root@localhos]# openssl x509 -subject -nameopt RFC2253 -noout -in node.pem subject= CN=NODE,OU=NODE,O=Default Company Ltd,L=Default City,ST=BJ,C=CN自动签发命令
#制作ca证书 #生成key openssl genrsa -out root-ca-key.pem 2048 #生成证书，直接指定-subj openssl req -new -x509 -sha256 -key root-ca-key.pem -subj "/C=CN/ST=BJ/L=Default City/O=Default Company Ltd/OU=ROOT/CN=ROOT" -out root-ca.pem -days 36500 #制作管理证书 openssl genrsa -out admin-key-temp.pem 2048 openssl pkcs8 -inform PEM -outform PEM -in admin-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out admin-key.pem openssl req -new -key admin-key.pem -subj "/C=CN/ST=BJ/L=Default City/O=Default Company Ltd/OU=ADMIN/CN=ADMIN" -out admin.csr openssl x509 -req -in admin.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out admin.pem -days 36500 #制作节点证书 openssl genrsa -out node-key-temp.pem 2048 openssl pkcs8 -inform PEM -outform PEM -in node-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out node-key.pem openssl req -new -key admin-key.pem -subj "/C=CN/ST=BJ/L=Default City/O=Default Company Ltd/OU=NODE/CN=NODE" -out node.csr openssl x509 -req -in node.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out node.pem -days 36500将证书文件放到conf目录下并修改权限
cp *.pem /data/apps/elasticsearch-7.10.2/config/ chown elasticsearch:elasticsearch /data/apps/elasticsearch-7.10.2/configthread_pool.write.size: ${cpu_num}/g" ${NODE_CONF} sed -i "s/thread_pool.search.size.*/thread_pool.search.size: ${cpu_num}/g" ${NODE_CONF}根据不同角色执行上边的脚本
sh conf.sh -t master sh conf.sh -t client sh conf.sh启动集群所有节点上执行
su - elasticsearch -c "cd /data/apps/elasticsearch-6.2.3/ && bin/elasticsearch -d"初始化集群（此处如果报 9300 端口ssl 访问错误，可以先忽略，不影响后面使用）
cd /data/apps/elasticsearch-7.10.2/plugins/opendistro_security/tools sh securityadmin.sh --diagnose -cd ../securityconfig/ -icl -nhnv -cacert ../../../config/root-ca.pem -cert ../../../config/admin.pem -key ../../../config/admin-key.pem安装kibana 与 kibana 配置修改
cd /data/kibana-7.1.1-linux-x86_64 cat > config/kibana.yml <> kibana.log & es 启动报错处理：
修改配置文件：config/elasticsearch.yml 必须修改的：
cluster.name: es-test-cluster
node.master: true
node.data: true
network.host: 0.0.0.0 (配置其他网段也可以访问)
node.name: stress-test001 (和你的主机名一样，hostname查看)
cluster.initial_master_nodes: [“stress-test001”]
http.cors.enabled: true
http.cors.allow-origin: “*”
1.如果不配置cluster.initial_master_nodes会报错：bootstrap check failure [1] of [1]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured参考链接：
https://blog.csdn.net/bxfcxl/article/details/119761742
https://baijiahao.baidu.com/s?id=1717599190220426031&wfr=spider&for=pc
https://blog.csdn.net/qq_31547771/article/details/102783056?spm=1001.2101.3001.6661.1&utm_medium=distribute.pc_relevant_t0.none-task-blog-2defaultCTRLISTdefault-1-102783056-blog-92590556.pc_relevant_multi_platform_whitelistv1&depth_1-utm_source=distribute.pc_relevant_t0.none-task-blog-2defaultCTRLISTdefault-1-102783056-blog-92590556.pc_relevant_multi_platform_whitelistv1&utm_relevant_index=1
