centos7.9搭建ES8.12+Kibana8.12

学习来源https://blog.csdn.net/fen_fen/article/details/124596440

一、创建ES用户

groupadd es

useradd -g es es

passwd es

二、下载安装包

https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.12.2-linux-x86_64.tar.gz

三、将下载好的包上传到安装机器，并改变所属用户和组

tar -zxvf elasticsearch-8.12.2-linux-x86_64.tar.gz

chown -R es:es elasticsearch-8.12.2

四、启动es

1.切换到es用户

su - es

2.修改config下的jvm.options

-Xms16g
-Xmx16g

3.修改config下的elasticsearch.yml

network.host: 0.0.0.0

http.port: 9200

4.启动es

进入bin目录，执行./elasticsearch启动

启动过程中会有如下提示

✅ Elasticsearch security features have been automatically configured!
✅ Authentication is enabled and cluster connections are encrypted.

ℹ️ Password for the elastic user (reset with `bin/elasticsearch-reset-password -u elastic`):
YL-y61L+E3T4OnJT95L8

ℹ️ HTTP CA certificate SHA-256 fingerprint:
3bf198f3bee08dc8e4322dee03391da2c4f599e034800227dc24a5207665909f

ℹ️ Configure Kibana to use this cluster:
• Run Kibana and click the configuration link in the terminal when Kibana starts.
• Copy the following enrollment token and paste it into Kibana in your browser (valid for the next 30 minutes):
eyJ2ZXIiOiI4LjEyLjIiLCJhZHIiOlsiMTcyLjE3LjAuMTo5MjAwIl0sImZnciI6IjNiZjE5OGYzYmVlMDhkYzhlNDMyMmRlZTAzMzkxZGEyYzRmNTk5ZTAzNDgwMDIyN2RjMjRhNTIwNzY2NTkwOWYiLCJrZXkiOiJqMnlGTm80QlFaV21wZHN0ckRxUzpDWE8tU0ZQSlRCQ1YwMkt1MU5RV01BIn0=

ℹ️ Configure other nodes to join this cluster:
• Copy the following enrollment token and start new Elasticsearch nodes with `bin/elasticsearch --enrollment-token <token>` (valid for the next 30 minutes):
eyJ2ZXIiOiI4LjEyLjIiLCJhZHIiOlsiMTcyLjE3LjAuMTo5MjAwIl0sImZnciI6IjNiZjE5OGYzYmVlMDhkYzhlNDMyMmRlZTAzMzkxZGEyYzRmNTk5ZTAzNDgwMDIyN2RjMjRhNTIwNzY2NTkwOWYiLCJrZXkiOiJqbXlGTm80QlFaV21wZHN0ckRxUzpzbUdlaUNWRlQ0V1BKWXh1Z0ZfdC1BIn0=

If you're running in Docker, copy the enrollment token and run:
`docker run -e "ENROLLMENT_TOKEN=<token>" docker.elastic.co/elasticsearch/elasticsearch:8.12.2`

（启动过程中，因之前配置了全局的java的classpath，多了个空格，导致启动报错，注释掉/etc/profile下的配置，启动成功；尝试修改密码，执行了bin/elasticsearch-reset-password -u elastic，随机生成了另一串，并不能改成简单密码，以后再测试）

五、远程访问ES

打开浏览器，输入https://192.168.1.25:9200

需要输入用户密码，就是启动时提示的这一段，用户elastic，密码YL-y61L+E3T4OnJT95L8

ℹ️ Password for the elastic user (reset with `bin/elasticsearch-reset-password -u elastic`):
YL-y61L+E3T4OnJT95L8

六、创建kibana用户

groupadd kibana

useradd -m -g kibana kibana

passwd kibana

七、下载kibana

https://artifacts.elastic.co/downloads/kibana/kibana-8.12.2-linux-x86_64.tar.gz

八、将下载好的包上传到安装机器，并改变所属用户和组

tar -zxvf kibana-8.12.2-linux-x86_64.tar.gz

chown -R kibana:kibana kibana-8.12.2

九、启动kibana

1.切换到kibana用户

su kibana

2.修改config目录的kibana.yml配置文件

server.port: 5601

server.host: "0.0.0.0"

server.name: "kibana"

elasticsearch.hosts: ["https://192.168.1.25:9200"]

3.启动kibana

进入bin目录，执行./kibana

[kibana@node3 bin]$ ./kibana
Kibana is currently running with legacy OpenSSL providers enabled! For details and instructions on how to disable see https://www.elastic.co/guide/en/kibana/8.12/production.html#openssl-legacy-provider
{"log.level":"info","@timestamp":"2024-03-13T07:05:36.953Z","log.logger":"elastic-apm-node","ecs.version":"8.10.0","agentVersion":"4.2.0","env":{"pid":42394,"proctitle":"./../node/bin/node","os":"linux 3.10.0-1160.el7.x86_64","arch":"x64","host":"node3","timezone":"UTC+0800","runtime":"Node.js v18.18.2"},"config":{"active":{"source":"start","value":true},"breakdownMetrics":{"source":"start","value":false},"captureBody":{"source":"start","value":"off","commonName":"capture_body"},"captureHeaders":{"source":"start","value":false},"centralConfig":{"source":"start","value":false},"contextPropagationOnly":{"source":"start","value":true},"environment":{"source":"start","value":"production"},"globalLabels":{"source":"start","value":[["kibana_uuid","c5de110e-c11f-41cd-9d84-0aefe81a5eca"],["git_rev","f5bd489c5ff9c676c4f861c42da6ea99ae350832"]],"sourceValue":{"kibana_uuid":"c5de110e-c11f-41cd-9d84-0aefe81a5eca","git_rev":"f5bd489c5ff9c676c4f861c42da6ea99ae350832"}},"logLevel":{"source":"default","value":"info","commonName":"log_level"},"metricsInterval":{"source":"start","value":120,"sourceValue":"120s"},"serverUrl":{"source":"start","value":"https://kibana-cloud-apm.apm.us-east-1.aws.found.io/","commonName":"server_url"},"transactionSampleRate":{"source":"start","value":0.1,"commonName":"transaction_sample_rate"},"captureSpanStackTraces":{"source":"start","sourceValue":false},"secretToken":{"source":"start","value":"[REDACTED]","commonName":"secret_token"},"serviceName":{"source":"start","value":"kibana","commonName":"service_name"},"serviceVersion":{"source":"start","value":"8.12.2","commonName":"service_version"}},"activationMethod":"require","message":"Elastic APM Node.js Agent v4.2.0"}
[2024-03-13T15:05:40.090+08:00][INFO ][root] Kibana is starting
[2024-03-13T15:05:40.192+08:00][INFO ][node] Kibana process configured with roles: [background_tasks, ui]
[2024-03-13T15:05:56.894+08:00][INFO ][plugins-service] Plugin "cloudChat" is disabled.
[2024-03-13T15:05:56.920+08:00][INFO ][plugins-service] Plugin "cloudExperiments" is disabled.
[2024-03-13T15:05:56.921+08:00][INFO ][plugins-service] Plugin "cloudFullStory" is disabled.
[2024-03-13T15:05:57.779+08:00][INFO ][plugins-service] Plugin "profilingDataAccess" is disabled.
[2024-03-13T15:05:57.780+08:00][INFO ][plugins-service] Plugin "profiling" is disabled.
[2024-03-13T15:05:58.022+08:00][INFO ][plugins-service] Plugin "securitySolutionServerless" is disabled.
[2024-03-13T15:05:58.023+08:00][INFO ][plugins-service] Plugin "serverless" is disabled.
[2024-03-13T15:05:58.024+08:00][INFO ][plugins-service] Plugin "serverlessObservability" is disabled.
[2024-03-13T15:05:58.024+08:00][INFO ][plugins-service] Plugin "serverlessSearch" is disabled.
[2024-03-13T15:05:58.998+08:00][INFO ][http.server.Preboot] http server running at http://0.0.0.0:5601
[2024-03-13T15:05:59.279+08:00][INFO ][plugins-system.preboot] Setting up [1] plugins: [interactiveSetup]
[2024-03-13T15:05:59.318+08:00][INFO ][preboot] "interactiveSetup" plugin is holding setup: Validating Elasticsearch connection configuration…
[2024-03-13T15:05:59.389+08:00][INFO ][root] Holding setup until preboot stage is completed.

i Kibana has not been configured.

Go to http://0.0.0.0:5601/?code=814117 to get started.

十、访问kibana

打开浏览器，访问 http://192.168.1.25:5601/?code=814117，需要输入elastic启动时生成的token

ℹ️ Configure Kibana to use this cluster:
• Run Kibana and click the configuration link in the terminal when Kibana starts.
• Copy the following enrollment token and paste it into Kibana in your browser (valid for the next 30 minutes):
eyJ2ZXIiOiI4LjEyLjIiLCJhZHIiOlsiMTcyLjE3LjAuMTo5MjAwIl0sImZnciI6IjNiZjE5OGYzYmVlMDhkYzhlNDMyMmRlZTAzMzkxZGEyYzRmNTk5ZTAzNDgwMDIyN2RjMjRhNTIwNzY2NTkwOWYiLCJrZXkiOiJqMnlGTm80QlFaV21wZHN0ckRxUzpDWE8tU0ZQSlRCQ1YwMkt1MU5RV01BIn0=

就这一段，如果提示token过期，可以通过./elasticsearch-create-enrollment-token -s kibana命令，重新生成token

 此处输入elastic启动时的用户密码：elastic/YL-y61L+E3T4OnJT95L8

问题：

1.Kibana8.2.0连接ElasticSearch8.2.0的enrollment token过期

[es@node3 bin]$ ./elasticsearch-create-enrollment-token -s kibana
warning: ignoring JAVA_HOME=/usr/java/jdk1.8.0_144/; using bundled JDK
eyJ2ZXIiOiI4LjEyLjIiLCJhZHIiOlsiMTcyLjE3LjAuMTo5MjAwIl0sImZnciI6IjNiZjE5OGYzYmVlMDhkYzhlNDMyMmRlZTAzMzkxZGEyYzRmNTk5ZTAzNDgwMDIyN2RjMjRhNTIwNzY2NTkwOWYiLCJrZXkiOiJrR3lsTm80QlFaV21wZHN0cGpyazo3cVRTbzdsWlFTQ2hlNDdwdTBGMHpnIn0=
[es@node3 bin]$