Elasticsearch 6.x 问题解决和添加验证

一、 为添加Elasticsearch添加账号

adduser elastic
chown -R elastic:elastic /usr/share/elasticsearch/

---

二、 es启动时可能出现如下问题

原因：linux中elasticsearch最大文件打开数太小，需要我们修改到对应的数值

错误1

max file descriptors [4096] for elasticsearch process is too low, increase to at

解决：
修改/etc/security/limits.conf文件，添加或修改如下行：

*        hard    nofile           65536
*        soft    nofile           65536

错误2

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

修改 /etc/sysctl.conf 文件,添加如下行：

vm.max_map_count=262144

修改好了以后，运行/sbin/sysctl -p

重启以后，再启动es即可，就可以通过主机ip访问。

---

三、调整内存大小

编辑elasticsearch/config/jvm.options

-Xms2g
-Xmx2g

---

四、head插件设置

1. 不限制访问IP
   编辑head/Gruntfile.js

connect: {
    server: {
        options: {
            port: 9100,
            hostname: '*',  #此处设置
            base: '.',
            keepalive: true
        }
    }
}

2. 修改head连接es的地址
   编辑head/_site/app.js，修改localhost为es服务器IP
   this.base_uri = this.config.base_uri || this.prefs.get("app-base_uri") || "http://localhost:9200";

---

五、添加认证

1. 安装x-pack

bin/elasticsearch-plugin install x-pack

2. 设置验证密码
   进入elasticsearch/bin/x-pack

./setup-passwords interactive

会对elasticsearch、logstash、kibana分别设置登录密码（默认es用户名为elastic，logstash用户名为logstash_system，kibana用户名为kibana）

elasticsearch/bin/x-pack$ ./setup-passwords interactive
Initiating the setup of passwords for reserved users elastic,kibana,logstash_system.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]yes
Did not understand answer 'yes'
Please confirm that you would like to continue [y/N]y
Enter password for [elastic]: 
Reenter password for [elastic]: 
Enter password for [kibana]: 
Reenter password for [kibana]: 
Enter password for [logstash_system]: 
Reenter password for [logstash_system]: 
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [elastic]

3. 设置elasticsearch配置文件
   编辑 elasticsearch/config/elasticsearch.yml

http.cors.enabled: true
http.cors.allow-origin: '*'
http.cors.allow-headers: Authorization,X-Requested-With,Content-Length,Content-Type

4. head访问方式

http://localhost:9100/?base_uri=http://localhost:9200&auth_user=elastic&auth_password=password

5. 命令行使用

curl -u elastic:blackey -XPUT http://10.2.197.69:9200/baidu -H 'Content-Type: application/json' -d '{}'

---

六、kibana添加认证

1. 安装x-pack,文件有200多兆，很慢，耐心等待

./bin/kibana-plugin install x-pack

2. 配置kibana配置文件
   修改如下配置信息
   注意：用户名和密码必须与之前x-pack设置的kibana账号密码一致

server.host: "0.0.0.0"
elasticsearch.url: "http://10.2.97.169:9200"   #10.2.97.169为es服务器IP地址
elasticsearch.username: "kibana"    # 用户名
elasticsearch.password: "password"   # 密码  

3. 开启kibana

./bin/kibana     正常启动
./bin/kibana &   后台启动

4. 登录kibana
   浏览器打开http://10.2.97.169:5601/
   输入步骤2中的账号密码即可
   如果想对之前用elastic账号导入的数据库操作，请使用elastic(用户名)、password（密码）登录

11.png
2.png

设置角色权限与添加用户

curl -u elastic:password -XPOST http://10.2.97.169:9200/_xpack/security/role/events_admin -H 'Content-Type: application/json' -d '{
  "indices" : [
    {
      "names" : [ "events*" ],
      "privileges" : [ "all" ]
    },
    {
      "names" : [ ".kibana*" ],
      "privileges" : [ "manage", "read", "index" ]
    }
  ]
}'

curl -u elastic:password -XPOST http://10.2.97.169:9200/_xpack/security/user/jack -H 'Content-Type: application/json' -d '{
  "password" : "123456",
  "full_name" : "test",
  "email" : "test@163.com",
  "roles" : [ "events_admin" ]
}'

---

5. x-pack license过期
   启动ElasticSearch时提示:

[2017-06-20T09:54:43,462][ERROR][o.e.x.s.a.f.SecurityActionFilter] [_gHqs1e] blocking [cluster:monitor/stats] operation due to expired license. Cluster health, cluster stats and indices stats
operations are blocked on license expiration. All data operations (read and write) continue to work.
If you have a new license, please update it. Otherwise, please reach out to your support contact.

直接影响的后果是kibana web页无法�访问

是因为证书过期了,需要注册申请一个license.

申请地址: https://register.elastic.co/marvel_register

注册后将以email的方式发送，通过链接下载license json文件.

根据文档提示请求api并指定新的证书

$ curl -XPUT -u elastic:changeme 'http://192.168.2.110:9200/_xpack/license?acknowledge=true' -H "Content-Type: application/json" -d @hakim-zhao-705a2a54-84d9-4ea8-b4ca-23b9d75b4ead-v5.json
{"acknowledged":true,"license_status":"valid"}

查看最新证书状态:

$ curl --user elastic:changeme 'http://192.168.2.110:9200/_xpack/license'

{
  "license" : {
    "status" : "active",
    "uid" : "5-84d9-4ea8-b4ca-23b9d75b4ead",
    "type" : "basic",
    "issue_date" : "2017-06-20T00:00:00.000Z",
    "issue_date_in_millis" : 1497916800000,
    "expiry_date" : "2018-06-20T23:59:59.999Z",
    "expiry_date_in_millis" : 1529539199999,
    "max_nodes" : 100,
    "issued_to" : "hakim zhao (none)",
    "issuer" : "Web Form",
    "start_date_in_millis" : 1497916800000
  }
}

可以看到证书是自生效起有1年的使用期。。