2. Elastic Stack 部署

此处都选择部署8.19.7版本

阿里云镜像地址：https://mirrors.aliyun.com/elasticstack/8.x/

2.1 ElasticSearch单点部署

1. 下载软件包并安装

[root@elk-91 ~]# wget https://mirrors.aliyun.com/elasticstack/8.x/yum/8.19.7/elasticsearch-8.19.7-x86_64.rpm
[root@elk-91 ~]# rpm -ivh elasticsearch-8.19.7-x86_64.rpm 

# 安装路径说明： 

配置目录：/etc/elasticsearch/
数据目录：/var/lib/elasticsearch/
日志目录：/var/log/elasticsearch/
二进制：/usr/share/elasticsearch/

2. 系统优化配置

# 创建数据目录

# 配置系统限制
[root@elk-91 ~]# tee /etc/security/limits.conf <<EOF
# Elasticsearch 系统限制配置
* soft nofile 65536
* hard nofile 65536
* soft nproc 4096
* hard nproc 4096
EOF

# 配置虚拟内存
[root@elk-91 ~]# vim /etc/sysctl.conf
...
# Elasticsearch 内核参数
vm.max_map_count=262144
net.core.somaxconn=2048
vm.swappiness=1
...
# 应用配置
[root@elk-91 ~]# sysctl -p

2 .配置Elasticsearch

主要配置文件：/etc/elasticsearch/elasticsearch.yml

[root@elk-91 ~]# vim /etc/elasticsearch/elasticsearch.yml
[root@elk-91 ~]# cat /etc/elasticsearch/elasticsearch.yml
# ======================== 数据路径配置 ========================
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch

# ======================== 安全功能配置 ========================
# 启用安全模块（认证+授权）
xpack.security.enabled: true

# 启用自动安全注册（8.x新特性）

xpack.security.enrollment.enabled: true

# ======================== HTTPS配置 ========================
# REST API加密配置
xpack.security.http.ssl:
  enabled: true           # 启用HTTPS
  keystore.path: certs/http.p12  # HTTPS证书路径

# ======================== 传输层安全 ========================
# 节点间通信加密
xpack.security.transport.ssl:
  enabled: true                    # 启用传输加密
  verification_mode: certificate   # 证书验证模式
  keystore.path: certs/transport.p12     # 节点身份证书
  truststore.path: certs/transport.p12    # 信任证书库

# ======================== 集群配置 ========================
# 指定集群名称
cluster.name: es-wyasw
# 部署集群为单点类型
discovery.type: "single-node"
# 初始主节点列表（集群引导）设置集群的时候需要，单节点不需要配置
# cluster.initial_master_nodes: ["elk-91"]

# ======================== 网络配置 ========================
# 绑定到所有网络接口
http.host: 0.0.0.0

3. 启动和验证

# 配置服务开机自启
[root@elk-91 ~]# systemctl daemon-reload
[root@elk-91 ~]# systemctl enable elasticsearch

# 启动服务
[root@elk-91 ~]# systemctl start elasticsearch

# 检查服务状态
[root@elk-91 ~]# systemctl status elasticsearch

# 查看启动日志
[root@elk-91 ~]# journalctl -u elasticsearch -f

# 或者直接查看日志文件
[root@elk-91 ~]# tail -f /var/log/elasticsearch/wyasw.log

4 .生成密码

##这种方式也可以用来重置用户密码
# 交互式生成用户密码，用其中一个即可
[root@elk-91 ~]# cd /usr/share/elasticsearch
[root@elk-91 elasticsearch]# ./bin/elasticsearch-reset-password -i -u elastic
This tool will reset the password of the [elastic] user.
You will be prompted to enter the password.
Please confirm that you would like to continue [y/N]y


Enter password for [elastic]:    ##输入密码
Re-enter password for [elastic]:   ##再次输入密码
Password for the [elastic] user successfully reset.

# 自动生成用户密码
[root@elk-91 ~]# cd /usr/share/elasticsearch
[root@elk-91 elasticsearch]# ./bin/elasticsearch-reset-password -u elastic --auto
This tool will reset the password of the [elastic] user to an autogenerated value.
The password will be printed in the console.
Please confirm that you would like to continue [y/N]y


Password for the [elastic] user successfully reset.
New value: zWBqQcCbfgX2yrlA_xNe

5. 登录验证

注意使用https：

登录地址：https://10.0.0.91:9200/

输入用户名：elastic 密码：123456 #密码是交互式设置的