# 下载安装包
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.9.2-x86_64.rpm
# 安装java环境
yum install java-1.8.0-openjdk java-1.8.0-openjdk-devel -y
java -version
# 上传安装包到其他节点
scp elasticsearch-7.9.2-x86_64.rpm 10.10.8.165:/root
scp elasticsearch-7.9.2-x86_64.rpm 10.10.8.166:/root
# 安装 //三个节点都进行安装
yum install -y elasticsearch-7.9.2-x86_64.rpm
# 修改测试机最大使用内存 //三个节点都进行操作
vim /etc/elasticsearch/jvm.options
-Xms256M
-Xmx256M
# 创建证书 //所有机器必须拷贝,同集群需要证书内容一致、权限一致
/usr/share/elasticsearch/bin/elasticsearch-certutil ca # 一路回车
/usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca /usr/share/elasticsearch/elastic-stack-ca.p12 # 一路回车
# 将证书拷贝到其他两个节点
scp /usr/share/elasticsearch/elastic-certificates.p12 /usr/share/elasticsearch/elastic-stack-ca.p12 10.10.8.165:/usr/share/elasticsearch/
scp /usr/share/elasticsearch/elastic-certificates.p12 /usr/share/elasticsearch/elastic-stack-ca.p12 10.10.8.166:/usr/share/elasticsearch/
# 拷贝到etc下 并附权 //三个节点都进行操作
cp /usr/share/elasticsearch/elastic-certificates.p12 /etc/elasticsearch/elastic-certificates.p12
chmod 600 /etc/elasticsearch/elastic-certificates.p12
chown elasticsearch:elasticsearch /etc/elasticsearch/elastic-certificates.p12
# 对比证书是否相同 //三个节点都进行操作
md5sum /etc/elasticsearch/elastic-certificates.p12
# 配置集群 //三个节点都进行操作
vim /etc/elasticsearch/elasticsearch.yml
cluster.name: elk
node.name: node1 # 集群每台不同 //只需要修改这里即可
node.master: true
node.data: true
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: ["10.10.8.164", "10.10.8.165", "10.10.8.166"] # 集群地址
cluster.initial_master_nodes: ["10.10.8.164", "10.10.8.165", "10.10.8.166"] # 集群地址
xpack.security.enabled: true
xpack.monitoring.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/elastic-certificates.p12
# 启动集群 //三个节点都进行操作
systemctl enable elasticsearch
systemctl start elasticsearch
# 如有问题观察日志 //三个节点都进行操作
tail -f /var/log/elasticsearch/elk.log
# 检查端口
netstat -lntp|egrep "9300|9200"
# 设置ES密码
/usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive # 为方便记录设置为相同密码 1qaz@WSX //输入的手麻
# 验证集群是否搭建成功 //网页访问 输入设置的密码 账号为 elastic 密码为 1qaz@WSX
http://10.10.8.164:9200
http://10.10.8.164:9200/_cat/nodes?v
http://10.10.8.164:9200/_cat/indices?v
