ES on debian
<p>https://www.rosehosting.com/blog/how-to-install-and-set-up-elasticsearch-on-debian-11/</p><pre><code class="language-bash">apt install default-jre
systemctl enable --now elasticsearch
systemctl status elasticsearch
systemctl restart elasticsearch
/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic
</code></pre>
<p>https://linuxhint.com/install-elasticsearch-debian/</p>
<pre><code class="language-bash"> sudo dpkg -i elasticsearch-7.14.1-amd64.deb
</code></pre>
<p>https://documentation.wazuh.com/current/deployment-options/elastic-stack/distributed-deployment/elasticsearch-cluster/elasticsearch-multi-node-cluster.html<br>
https://github.com/elastic/ansible-elasticsearch<br>
https://www.toptal.com/ansible/update-elastic-stack-ansible-playbooks<br>
https://garutilorenzo.github.io/ansible-collection-elk/</p>
<p>https://www.inmotionhosting.com/support/edu/software/how-to-install-elasticsearch/#debian</p>
<h1 id="setting-elasticsearch-as-a-system-service">Setting Elasticsearch as a System Service</h1>
<p>Use the following command to start Elasticsearch now:</p>
<pre><code class="language-bash">systemctl start elasticsearch
</code></pre>
<p>Use the following command to enable Elasticsearch to automatically start upon system reboot:</p>
<pre><code class="language-bash">systemctl enable elasticsearch
</code></pre>
<p>Use the following command to check for any issues related to starting or enabling Elasticsearch:</p>
<pre><code class="language-bash">systemctl status elasticsearch
</code></pre>
<pre><code class="language-bash">sudo systemctl start elasticsearch.service
sudo systemctl enable elasticsearch.service --now
sudo systemctl status elasticsearch.service
sudo ufw allow 9200
</code></pre>
<h1 id="configuring-elasticsearch">Configuring Elasticsearch</h1>
<p>To make changes to Elasticsearch, edit the Elasticsearch YAML file:</p>
<pre><code class="language-bash">nano /etc/elasticsearch/elasticsearch.yml
</code></pre>
<p>For the package distributions, the config directory location defaults to <code>/etc/elasticsearch</code>.</p>
<p><code>elasticsearch.yml</code> for configuring Elasticsearch<br>
<code>jvm.options</code> for configuring Elasticsearch JVM settings<br>
<code>log4j2.properties</code> for configuring Elasticsearch logging</p>
<p>By default, Elasticsearch uses port <code>9200</code> or the next available port between 9200-9300. If you need to specify a different Elasticsearch port, change the following line and remove the # at the beginning:</p>
<pre><code class="language-bash">#http.port: 9200
</code></pre>
<p>Ensure Elasticsearch is running on an open port, changing localhost to your domain or other hostname as needed:</p>
<pre><code class="language-bash">curl -X GET localhost:9200
</code></pre>
<p>To find your server IP in the command line, use <code>hostname -i</code></p>
<p>If this Elasticsearch installation will join a node cluster, change the hostname to a server IP address or server hostname and remove the # at the beginning of the following line:</p>
<pre><code class="language-bash">#network.host: 192.168.0.1
</code></pre>
<p>You can also create descriptive node name for easier navigation among cluster setups by modifying the following line:</p>
<pre><code class="language-bash">#node.name: node-1
</code></pre>
<h1 id="try">Try</h1>
<pre><code class="language-bash">espkg=/media/sf_tmp/sea/elasticsearch-8.9.1-amd64.deb
sudo apt install default-jre -y
java --version
sudo dpkg -i $espkg
</code></pre>
<pre><code class="language-log">Authentication and authorization are enabled.
TLS for the transport and HTTP layers is enabled and configured.
The generated password for the elastic built-in superuser is : N7VkGfnrLbLMwfzqT*kW
If this node should join an existing cluster, you can reconfigure this with
'/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <token-here>'
after creating an enrollment token on your existing cluster.
You can complete the following actions at any time:
Reset the password of the elastic built-in superuser with
'/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'.
Generate an enrollment token for Kibana instances with
'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'.
Generate an enrollment token for Elasticsearch nodes with
'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'.
-------------------------------------------------------------------------------------------------
### NOT starting on installation, please execute the following statements to
configure elasticsearch service to start automatically using systemd
sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
### You can start elasticsearch service by executing
sudo systemctl start elasticsearch.service
</code></pre>
<pre><code class="language-bash">sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
sudo systemctl status elasticsearch.service
sudo systemctl start elasticsearch.service
sudo systemctl status elasticsearch.service
</code></pre>
<pre><code class="language-bash">sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
Created symlink /etc/systemd/system/multi-user.target.wants/elasticsearch.service → /lib/systemd/system/elasticsearch.service.
</code></pre>
<pre><code class="language-bash">sudo systemctl status elasticsearch.service
○ elasticsearch.service - Elasticsearch
Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled; preset: enabled)
Active: inactive (dead)
Docs: https://www.elastic.co
</code></pre>
<pre><code class="language-bash">sudo systemctl status elasticsearch.service
● elasticsearch.service - Elasticsearch
Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled; preset: enabled)
Active: active (running) since Mon 2023-09-04 02:02:48 EDT; 11s ago
Docs: https://www.elastic.co
Main PID: 2848 (java)
Tasks: 85 (limit: 9453)
Memory: 4.3G
CPU: 37.191s
CGroup: /system.slice/elasticsearch.service
├─2848 /usr/share/elasticsearch/jdk/bin/java -Xms4m -Xmx64m -XX:+UseSerialGC -Dcli.name=server -Dcli.script=/usr/share/elasticsearch/>
├─2908 /usr/share/elasticsearch/jdk/bin/java -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -Djava.securi>
└─2931 /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x86_64/bin/controller
Sep 04 02:02:36 GnuNode systemd: Starting elasticsearch.service - Elasticsearch...
Sep 04 02:02:48 GnuNode systemd: Started elasticsearch.service - Elasticsearch.
</code></pre>
<pre><code class="language-bash">curl -X GET localhost:9200
curl: (52) Empty reply from server
</code></pre>
<pre><code class="language-bash">sudo cat /etc/elasticsearch/elasticsearch.yml
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /var/lib/elasticsearch
#
# Path to log files:
#
path.logs: /var/log/elasticsearch
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# By default Elasticsearch is only accessible on localhost. Set a different
# address here to expose this node on the network:
#
#network.host: 192.168.0.1
#
# By default Elasticsearch listens for HTTP traffic on the first free port it
# finds starting at 9200. Set a specific HTTP port here:
#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
#cluster.initial_master_nodes: ["node-1", "node-2"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Allow wildcard deletion of indices:
#
#action.destructive_requires_name: false
#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------
#
# The following settings, TLS certificates, and keys have been automatically
# generated to configure Elasticsearch security features on 04-09-2023 05:54:24
#
# --------------------------------------------------------------------------------
# Enable security features
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
enabled: true
keystore.path: certs/http.p12
# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p12
# Create a new cluster with the current node only
# Additional nodes can still join the cluster later
cluster.initial_master_nodes: ["GnuNode"]
# Allow HTTP API connections from anywhere
# Connections are encrypted and require user authentication
http.host: 0.0.0.0
# Allow other nodes to join the cluster from anywhere
# Connections are encrypted and mutually authenticated
#transport.host: 0.0.0.0
#----------------------- END SECURITY AUTO CONFIGURATION -------------------------
</code></pre>
<pre><code class="language-bash">kibpkg=/media/sf_tmp/sea/kibana-8.9.1-amd64.deb
sudo dpkg -i $kibpkg
Setting up kibana (8.9.1) ...
Creating kibana group... OK
Creating kibana user... OK
Created Kibana keystore in /etc/kibana/kibana.keystore
</code></pre>
<p>To configure Kibana to start automatically when the system starts, run the following commands:</p>
<pre><code class="language-bash">sudo systemctl daemon-reload
sudo systemctl enable kibana.service
</code></pre>
<p>Kibana can be started and stopped as follows:</p>
<pre><code class="language-bash">sudo systemctl start kibana.service
sudo systemctl stop kibana.service
</code></pre>
<p>These commands provide no feedback as to whether Kibana was started successfully or not.</p>
<p>Log information can be accessed via</p>
<pre><code class="language-bash">journalctl -u kibana.service
</code></pre>
<pre><code class="language-bash">/etc/kibana/kibana.yml
</code></pre>
<pre><code class="language-bash">sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
eyJ2ZXIiOiI4LjkuMSIsImFkciI6WyIxMC44OC45Ni4yMTI6OTIwMCJdLCJmZ3IiOiI4MmI1MTA3NTQ2NTI3N2U2NTI5Yzg4ZGFkMmNlYjM3YjY0N2EwNDdkNmZmMWIxMzJiY2JlZGI3ODRkYjhiN2E1Iiwia2V5IjoiejkzWlhvb0JYckZIV1RYNEhQNk06QTJpYXJxOWpTUnFrY2M2RS1CX2I1ZyJ9
</code></pre>
<pre><code class="language-bash">sudo systemctl status kibana.service
</code></pre>
<pre><code class="language-bash">sudo systemctl status kibana.service
● kibana.service - Kibana
Loaded: loaded (/lib/systemd/system/kibana.service; enabled; preset: enabled)
Active: active (running) since Mon 2023-09-04 02:20:34 EDT; 37s ago
Docs: https://www.elastic.co
Main PID: 3372 (node)
Tasks: 11 (limit: 9453)
Memory: 354.6M
CPU: 8.465s
CGroup: /system.slice/kibana.service
└─3372 /usr/share/kibana/bin/../node/bin/node /usr/share/kibana/bin/../src/cli/dist
Sep 04 02:20:41 GnuNode kibana: Plugin "serverless" is disabled.
Sep 04 02:20:41 GnuNode kibana: Plugin "serverlessObservability" is disabled.
Sep 04 02:20:41 GnuNode kibana: Plugin "serverlessSearch" is disabled.
Sep 04 02:20:41 GnuNode kibana: Plugin "serverlessSecurity" is disabled.
Sep 04 02:20:41 GnuNode kibana: http server running at http://localhost:5601
Sep 04 02:20:41 GnuNode kibana: Setting up plugins:
Sep 04 02:20:41 GnuNode kibana: "interactiveSetup" plugin is holding setup: Validating Elast>
Sep 04 02:20:41 GnuNode kibana: Holding setup until preboot stage is completed.
Sep 04 02:20:42 GnuNode kibana: i Kibana has not been configured.
Sep 04 02:20:42 GnuNode kibana: Go to http://localhost:5601/?code=147556 to get started.
</code></pre>
<p><img src="https://img2023.cnblogs.com/blog/859364/202309/859364-20230904142656646-1791904317.png"></p>
<p><img src="https://img2023.cnblogs.com/blog/859364/202309/859364-20230904142707797-126114447.png"></p><br><br>
来源：https://www.cnblogs.com/Searchor/p/17654614.html
頁:
[1]