Ubuntu系统Elastic Stack 8.12.0 集群平台搭建

Ubuntu系统Elastic Stack 8.12.0 集群平台搭建

一、环境准备

elasticsearch: 8.12.0

kibana

1.1.软件介绍

elasticsearch: 8.12.0

1.2.硬件环境：

二、系统环境基础设置（所有机器）

2.1.设置系统名称

sudo hostnamectl set-hostname elk51.forgcat.com

2.2.关闭防火墙

sudo systemctl disable ufw
sudo systemctl stop ufw  

2.3.配置hosts

sudo cat > /etc/hosts << EOF
127.0.0.1 localhost
127.0.1.1       elk-51.forgcat.com elk-51

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

192.168.20.51 elk-51.forgcat.com elk-51
192.168.20.52 elk-52.forgcat.com elk-52
192.168.20.53 elk-53.forgcat.com elk-53
192.168.20.54 elk-54.forgcat.com elk-54
192.168.20.55 elk-55.forgcat.com elk-55
192.168.20.56 elk-56.forgcat.com elk-56
192.168.20.54 kibana.forgcat.com 
EOF

2.3. 关闭缓存

sudo sed -ri 's/.*swap.*/#&/' /etc/fstab
sudo swapoff -a

三、es集群部署

3.1.1安装节点介绍

3.2 服务器优化(三台操作一样)

$ sudo cat > /etc/sysctl.d/10-elasticsearch.conf <<EOF
vm.swappiness=1
fs.file-max=655360  #系统最大打开文件描述符数
net.ipv4.tcp_retries2=5
vm.max_map_count = 262144   #用于限制一个进程可以拥有的VMA(虚拟内存区域)的大小，系统默认是65530，建议修改成262144或者更高
EOF
$ sudo cat >> /etc/security/limits.conf <<EOF
#添加以下这行
* soft  nproc   20480
* hard   nproc  20480
* soft  nofile  65535
* hard  nofile  65535
* soft  memlock  unlimited
* hard  memlock  unlimited
elasticsearch  -  nofile  65535
EOF

3.3.安装elasticsearch(三台操作一样)

3.3.1.下载公钥文件和elastic-8.x存储文件

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list

3.3.2.安装elasticsearch

sudo apt-get update && sudo apt-get install elasticsearch
#安装后会出现安全信息请注意保存
--------------------------- Security autoconfiguration information ------------------------------

Authentication and authorization are enabled.
TLS for the transport and HTTP layers is enabled and configured.

The generated password for the elastic built-in superuser is : 164IeiYBPr7RHMYeHD38

If this node should join an existing cluster, you can reconfigure this with
'/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <token-here>'
after creating an enrollment token on your existing cluster.

You can complete the following actions at any time:

Reset the password of the elastic built-in superuser with 
'/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'.

Generate an enrollment token for Kibana instances with 
 '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'.

Generate an enrollment token for Elasticsearch nodes with 
'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'.

-------------------------------------------------------------------------------------------------
### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd
 sudo systemctl daemon-reload
 sudo systemctl enable elasticsearch.service
### You can start elasticsearch service by executing
 sudo systemctl start elasticsearch.service

3.3.3.elasticsearch配置

备份初始文件

sudo  cp /etc/elasticsearch/elasticsearch.yml  /etc/elasticsearch/elasticsearch.yml_bak

修改elasticsearch.yml

sudo vim /etc/elasticsearch/elasticsearch.yml
cluster.name: es-elk #集群名称 三台节点一样
node.name: elk-51 #节点名称 三台节点根据情况修改
#数据和日志的存储目录
path.data: /var/lib/elasticsearch 
path.logs: /var/log/elasticsearch
network.host: elk-51.forgcat.com
http.port: 9200
discovery.seed_hosts: ["elk-51"]
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
cluster.initial_master_nodes: ["elk-51"]
transport.host: 0.0.0.0

elk-51启动elasticsearch

sudo systemctl daemon-reload
sudo systemctl enable elasticsearch
sudo systemctl start  elasticsearch
sudo systemctl status   elasticsearch

elk-51上查看加入节点的token

sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node 
eyJ2ZXIiOiI4LjEyLjAiLCJhZHIiOlsiMTkyLjE2OC4yMC41MTo5MjAwIl0sImZnciI6ImRlNmMzNjFkMzI0MTBlMWYyMmUwNGNkZmQzNzY2MWFmOTJkZTBkZTcyM2FkZDNhYmJiZWQ3ZmM4MjJhNjFmMTUiLCJrZXkiOiJhMk1LUkkwQngzSkpDeS1MOEt4NzpjTVRtMWJsQVFXS29aYlVWQ25VWHJRIn0=

elk-52和elk-53输入下面命令加入现有集群