10.4.2.101 8C16G64G data-hot client centos8 16C48G(JVM24G) 10.4.2.102 8C16G64G data-hot client centos8 16C48G(JVM24G) 10.4.2.103 8C16G64G data-hot client centos8 16C48G(JVM24G) 10.4.2.104 8C16G64G data-warm centos8 16C48G(JVM24G) 10.4.2.105 8C16G64G data-warm centos8 16C48G(JVM24G) 10.4.2.106 8C16G64G data-warm centos8 16C48G(JVM24G) 10.4.2.107 8C16G64G master centos8 8C16G(JVM8G) 临时data 10.4.2.108 8C16G64G master centos8 8C16G(JVM8G) 10.4.2.109 8C16G64G master centos8 8C16G(JVM8G)一、基础配置----10.4.2.101-106 基础配置-略
关闭selinux 关闭防火墙自启修改主机名
hostnamectl set-hostname elasticsearch-secure101 hostnamectl set-hostname elasticsearch-secure102 hostnamectl set-hostname elasticsearch-secure103基础配置优化
修改/etc/security/limits.conf，做以下配置，*表示所有用户，也可以指定用户elastic
~]# vi /etc/security/limits.conf * soft nproc 65536 * hard nproc 65536 * soft nofile 65536 * hard nofile 65536
退出bash，重新bash，然后命令 ulimit -Hn 即显示 65536
~]# ulimit -Hn 65536
2、
~]# echo "vm.max_map_count=262144" >>/etc/sysctl.conf ~]# sysctl -p安装基本工具
yum -y install vim net-tools时间同步
~]# yum -y install chrony ~]# systemctl restart chronyd二、添加yum，安装软件，添加阿里云的yum即可
添加dns，然后 ~]# rm -rf /etc/yum.repos.d/* ~]# echo "nameserver 119.29.29.29" >/etc/resolv.conf 华为源 ~]# curl -o /etc/yum.repos.d/CentOS-Base.repo https://repo.huaweicloud.com/repository/conf/CentOS-8-reg.repo [root@localhost yum.repos.d]# ls bak CentOS-Base.repo 阿里源 ~]# curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-vault-8.5.2111.repo ~]# vi /etc/yum.repos.d/Centos-Linux-PowerTools.repo [powertools] name=CentOS Linux $releasever - PowerTools #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=PowerTools&infra=$infra baseurl=https://mirrors.aliyun.com/centos-vault/8.5.2111/PowerTools/x86_64/os/ #baseurl=https://mirrors.tuna.tsinghua.edu.cn/$contentdir/$releasever/PowerTools/$basearch/os/ gpgcheck=1 enabled=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial 配置elasticsearch源
~]# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch ~]# vi /etc/yum.repos.d/elasticsearch.repo [elasticsearch] name=Elasticsearch repository for 8.x packages baseurl=https://artifacts.elastic.co/packages/8.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch enabled=0 autorefresh=1 type=rpm-md sudo yum install --enablerepo=elasticsearch elasticsearch三、创建数据目录，三台 master
~]# mkdir -p /data/elasticsearch ~]# chown elasticsearch:elasticsearch /data/elasticsearch四、正式配置---master
~]# cd /etc/elasticsearch/ ]# ll total 48 drwxr-x--- 2 root elasticsearch 62 Jun 12 03:23 certs -rw-rw---- 1 root elasticsearch 536 Jun 12 03:23 elasticsearch.keystore -rw-rw---- 1 root elasticsearch 1042 May 25 23:52 elasticsearch-plugins.example.yml -rw-rw---- 1 root elasticsearch 4244 Jun 12 03:23 elasticsearch.yml -rw-rw---- 1 root elasticsearch 3046 May 25 23:52 jvm.options drwxr-s--- 2 root elasticsearch 6 May 25 23:54 jvm.options.d -rw-rw---- 1 root elasticsearch 16644 May 25 23:52 log4j2.properties -rw-rw---- 1 root elasticsearch 473 May 25 23:52 role_mapping.yml -rw-rw---- 1 root elasticsearch 197 May 25 23:52 roles.yml -rw-rw---- 1 root elasticsearch 0 May 25 23:52 users -rw-rw---- 1 root elasticsearch 0 May 25 23:52 users_roles
配置jvm内存为内存的一半24G
~]# vi jvm.options -Xms24g -Xmx24g
配置配置文件
]# cat elasticsearch.yml # ======================== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with reasonable defaults for most settings. # Before you set out to tweak and tune the configuration, make sure you # understand what are you trying to accomplish and the consequences. # # The primary way of configuring a node is via this file. This template lists # the most important settings you may want to configure for a production cluster. # # Please consult the documentation for further information on configuration options: # https://www.elastic.co/guide/en/elasticsearch/reference/index.html # # ---------------------------------- Cluster ----------------------------------- # # Use a descriptive name for your cluster: # #cluster.name: my-application cluster.name: elasticsearch-secure # # ------------------------------------ Node ------------------------------------ # # Use a descriptive name for the node: # #node.name: node-1 node.name: elasticsearch-secure101 # 其他改成对应主机名 node.roles: [ data ] # # Add custom attributes to the node: # #node.attr.rack: r1 # bootstrap.memory_lock: true # 8不支持这个参数 node.attr.box_type: hot # 10.4.2.101-103为hot热节点，10.4.2.104-106为warm节点，需改为warm node.attr.rack: rack1 # ----------------------------------- Paths ------------------------------------ # # Path to directory where to store the data (separate multiple locations by comma): # #path.data: /var/lib/elasticsearch path.data: /data1/elasticsearch,/data2/elasticsearch # # Path to log files: # # path.logs: /var/log/elasticsearch path.logs: /var/log/elasticsearch # # ----------------------------------- Memory ----------------------------------- # # Lock the memory on startup: # #bootstrap.memory_lock: true # # Make sure that the heap size is set to about half the memory available # on the system and that the owner of the process is allowed to use this # limit. # # Elasticsearch performs poorly when the system is swapping the memory. # # ---------------------------------- Network ----------------------------------- # # By default Elasticsearch is only accessible on localhost. Set a different # address here to expose this node on the network: # #network.host: 192.168.0.1 network.host: 10.4.2.106 # # By default Elasticsearch listens for HTTP traffic on the first free port it # finds starting at 9200. Set a specific HTTP port here: # http.port: 9200 # # For more information, consult the network module documentation. # # --------------------------------- Discovery ---------------------------------- # # Pass an initial list of hosts to perform discovery when this node is started: # The default list of hosts is ["127.0.0.1", "[::1]"] # #discovery.seed_hosts: ["host1", "host2"] discovery.seed_hosts: ["10.4.2.101", "10.4.2.102", "10.4.2.103", "10.4.2.104", "10.4.2.105", "10.4.2.106", "10.4.2.107", "10.4.2.108", "10.4.2.109"] # # Bootstrap the cluster using an initial set of master-eligible nodes: # #cluster.initial_master_nodes: ["node-1", "node-2"] # # For more information, consult the discovery and cluster formation module documentation. # # --------------------------------- Readiness ---------------------------------- # # Enable an unauthenticated TCP readiness endpoint on localhost # #readiness.port: 9399 # # ---------------------------------- Various ----------------------------------- # # Allow wildcard deletion of indices: # #action.destructive_requires_name: false #----------------------- BEGIN SECURITY AUTO CONFIGURATION ----------------------- # # The following settings, TLS certificates, and keys have been automatically # generated to configure Elasticsearch security features on 11-06-2022 19:23:51 # # -------------------------------------------------------------------------------- # Enable security features xpack.security.enabled: true xpack.security.enrollment.enabled: false # Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents xpack.security.http.ssl: enabled: false keystore.path: certs/http.p12 # Enable encryption and mutual authentication between cluster nodes xpack.security.transport.ssl: enabled: true verification_mode: certificate keystore.path: certs/transport.p12 truststore.path: certs/transport.p12 # Create a new cluster with the current node only # Additional nodes can still join the cluster later cluster.initial_master_nodes: ["elasticsearch-secure107", "elasticsearch-secure108", "elasticsearch-secure109"] # Allow HTTP API connections from anywhere # Connections are encrypted and require user authentication http.host: 0.0.0.0 # Allow other nodes to join the cluster from anywhere # Connections are encrypted and mutually authenticated # transport.host: 0.0.0.0 transport.host: 10.4.2.106 #----------------------- END SECURITY AUTO CONFIGURATION ------------------------- http.cors.enabled: true http.cors.allow-origin: "*" http.cors.allow-headers: Authorization,X-Requested-With,Content-Type,Content-Length [root@ly-elasticsearch-secure106 elasticsearch]#
从master把cert目录拷贝过来-并授权
修改kestone/usr/share/elasticsearch/bin/elasticsearch-keystore remove xpack.security.http.ssl.keystore.secure_password /usr/share/elasticsearch/bin/elasticsearch-keystore remove xpack.security.transport.ssl.keystore.secure_password /usr/share/elasticsearch/bin/elasticsearch-keystore remove xpack.security.transport.ssl.truststore.secure_passwordhot节点启动es
systemctl restart elasticsearch
