ES: ES+Kibana 环境部署

10.10.8.62
10.10.8.63
10.10.8.64

# 关闭防火墙
systemctl stop firewalld.service 
systemctl disable  firewalld.service
# 查看selinux
getenforce 
# 关闭selinux
setenforce 0  
# 永久关闭selinux
sed -i  's#SELINUX=enforcing#SELINUX=disabled#g'   /etc/selinux/config
# 清除iptables 规则
iptables -F
# 关闭NetworkManager
systemctl stop  NetworkManager
systemctl disable  NetworkManager
# 备份
mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
# 配置源
curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
# 清除缓存
yum clean all
# 安装常用命令及依赖
yum install   -y  net-tools lrzsz  vim  libaio-devel  unzip \
tree  libaio-devel lsof sysstat lrzsz ntpdate  bash-completion  bash-completion-extras 
# 定时时间同步
cat >>/var/spool/cron/root<<'EOF'
# ntp 时间同步
00 00 * * * /usr/sbin/ntpdate ntp.aliyun.com
EOF
# 时间同步
ntpdate ntp.aliyun.com

# 增大文件句柄数
cat >/etc/security/limits.conf<<'EOF'
# 所有用户文件打开数
* soft nofile 65536
* hard nofile 65536
# 增大线程池的大小
* soft nproc 9000
* hard nproc 9000
# 关闭内外存交换
* hard memlock unlimited
* soft memlock unlimited
EOF
# 此文件控制上面的文件也要改
cat >/etc/security/limits.d/20-nproc.conf<<'EOF'
*          soft    nproc     9000
root       soft    nproc     unlimited
EOF
# 虚拟内存
cat >/etc/sysctl.conf<<'EOF'
# 增大虚拟内存地址空间
vm.max_map_count=262144
# 系统文件最大打开数
fs.file-max = 2097152
# 减少交换空间的使用 0 - 100
vm.swappiness = 1
# 缓存回收速度 0-100
vm.vfs_cache_pressure = 50
EOF
# 生效配置
sysctl -p

yum install  java-1.8.0-openjdk java-1.8.0-openjdk-devel -y 
java -version

https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.1.tar.gz
https://artifacts.elastic.co/downloads/kibana/kibana-6.8.1-linux-x86_64.tar.gz

# 解压
cd /home/zcsadmin
tar xf elasticsearch-6.8.1.tar.gz  -C /usr/local/
# 修改工作目录
mv /usr/local/elasticsearch-6.8.1  /usr/local/es6_9200/
# 创建数据目录
mkdir -p /data/es_9200/{data,logs,tmp}
# 创建es账号
groupadd  es_dkecde
useradd es_dkecde  -g es_dkecde
# 配置环境变量
cat >/etc/profile.d/es_9200.sh<<'EOF'
export ES_HOME=/usr/local/es6_9200
export PATH=$PATH:$ES_HOME/bin
# 修改 tmp 目录
export ES_TMPDIR=/data/es_9200/tmp
EOF
# 生效环境变量
source /etc/profile.d/es_9200.sh

mkdir /usr/local/es6_9200/config/certs/
cd  /usr/local/es6_9200/config/certs/
elasticsearch-certutil ca  # 一路回车
elasticsearch-certutil cert --ca elastic-stack-ca.p12 # 一路回车

scp -r  /usr/local/es6_9200/config/certs zcsadmin@10.10.8.63:/tmp/
scp -r  /usr/local/es6_9200/config/certs zcsadmin@10.10.8.64:/tmp/

mv  /tmp/certs  /usr/local/es6_9200/config

# 编写配置文件
cat   >/usr/local/es6_9200/config/elasticsearch.yml<<'EOF'
cluster.name: test_es
# 修改每个节点不同的名字
node.name: es_62
node.master: true
node.data: true
path.data: /data/es_9200/data
path.logs: /data/es_9200/logs
network.host: 0.0.0.0
http.port: 9200
transport.tcp.port: 9300
discovery.zen.ping.unicast.hosts: ["10.10.8.62:9300", "10.10.8.63:9300", "10.10.8.64:9300"]
indices.fielddata.cache.size: 2%
# 最小主节点数
discovery.zen.minimum_master_nodes: 2
# 系统必须设置 unlimited
bootstrap.memory_lock: true
# 开启集群之间加密
xpack.security.enabled: true
xpack.monitoring.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /usr/local/es6_9200/config/certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/local/es6_9200/config/certs/elastic-certificates.p12
EOF

# 修改测试机最大使用内存 //三个节点都进行操作
# 生产环境设置可用内存的 50% 但最好不超过 32G 
sed -i 's#-Xms1g#-Xms512M#g' /usr/local/es6_9200/config/jvm.options
sed -i 's#-Xmx1g#-Xmx512M#g' /usr/local/es6_9200/config/jvm.options

# 使用 systemd 管理
cat  >/usr/lib/systemd/system/es_9200.service<<'EOF'
[Unit]
Description=Elasticsearch 9200
Wants=network-online.target
After=network-online.target
[Service]
User=es_dkecde
Group=es_dkecde
LimitNOFILE=100000
LimitNPROC=100000
Type=simple
ExecStart=/usr/local/es6_9200/bin/elasticsearch
Restart=on-failure
RestartSec=10
StartLimitInterval=10
StartLimitBurst=3  # 设置重启次数
LimitMEMLOCK=infinity
PrivateTmp=true
[Install]
WantedBy=multi-user.target
EOF

# 授权工作及数据目录
chown -R es_dkecde:es_dkecde /data/es_9200/
chown -R es_dkecde:es_dkecde /usr/local/es6_9200
# 重载 systemd
systemctl daemon-reload
# 启动
systemctl start  es_9200.service
# 状态
systemctl status  es_9200.service
# 开机自启
systemctl enable es_9200.service

elasticsearch-setup-passwords interactive # 为方便记录设置为相同密码 mypassword

# 查看实例状态
curl -u elastic:'mypassword' -XGET  "http://127.0.0.1:9200"
# 查看集群状态
curl -u elastic:'mypassword' -XGET  "http://127.0.0.1:9200/_cluster/health"

cd /home/zcsadmin
tar xf kibana-6.8.1-linux-x86_64.tar.gz -C /usr/local/
mv /usr/local/kibana-6.8.1-linux-x86_64  /usr/local/kibana6

mkdir /usr/local/kibana6/config/certs
cd  /usr/local/kibana6/config/certs
# 编写证书生成文件
cat >instance.yml<<'EOF'
instances:
  - name: 'kibana6'
    dns: [ '10.10.8.62' ]
EOF
# 生成CA证书
elasticsearch-certutil cert ca --pem --in instance.yml --out ./certs.zip
# 解压
unzip certs.zip

cat >/usr/local/kibana6/config/kibana.yml<<'EOF'
server.port: 5601
server.host: "0.0.0.0"
# 集群地址列表
elasticsearch.hosts: ["http://10.10.8.62:9200", "http://10.10.8.63:9200", "http://10.10.8.64:9200"]
elasticsearch.username: "elastic"
elasticsearch.password: "mypassword"
logging.dest: /var/log/kibana.log
i18n.locale: "zh-CN"
# 客户端开启 https
server.ssl.enabled: true
server.ssl.certificate: /usr/local/kibana6/config/certs/kibana6/kibana6.crt
server.ssl.key: /usr/local/kibana6/config/certs/kibana6/kibana6.key
elasticsearch.ssl.certificateAuthorities: /usr/local/kibana6/config/certs/ca/ca.crt
elasticsearch.ssl.verificationMode: certificate
EOF

touch /var/log/kibana.log 
chown -R es_dkecde:es_dkecde  /var/log/kibana.log
chown -R es_dkecde:es_dkecde  /usr/local/kibana6

# 使用 systemd 管理
cat  >/usr/lib/systemd/system/kibana.service<<'EOF'
[Unit]
Description=kibana
Wants=network-online.target
After=network-online.target
[Service]
User=es_dkecde
Group=es_dkecde
LimitNOFILE=100000
LimitNPROC=100000
Type=simple
ExecStart=/usr/local/kibana6/bin/kibana
Restart=on-failure
RestartSec=10
StartLimitInterval=10
# 设置重启次数
StartLimitBurst=3
LimitMEMLOCK=infinity
PrivateTmp=true
[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl start kibana.service
systemctl enable kibana.service
systemctl status  kibana.service