ES_7.17.9安装教程(破解白金版、kibana安装)

一、ElasticSearch安装

1.修改服务器相关配置

1)永久关闭防火墙

#查看防火状态
systemctl status firewalld
#暂时关闭防火墙
systemctl stop firewalld
#重启防火墙
systemctl enable firewalld
#永久关闭防火墙
vim /etc/sysconfig/selinux
#改为SELINUX=disable
SELINUX=disable
#修改后需要重启服务器(可修改完主机名一起重启)
reboot

2)修改主机名

#修改主机名,方便主机间通信
vim /etc/hostname

XXXX01.localdomain

#修改后重启服务器
reboot

3)配置主机间通

vim /etc/hosts

10.10.16.161 XXXX01
10.10.16.162 XXXX02

4)ssh免密配置

cd ~/.ssh
#步骤1:用ssh-keygen在本地主机上创建公钥和密钥
ssh-keygen -t rsa
#三次回车

#步骤2:用ssh-copy-id把公钥发送至自己和其他主机
ssh-copy-id 10.10.16.161
#输入yes和密码
ssh-copy-id 10.10.16.162
#输入yes和密码

#步骤3: 测试直接登录远程主机
ssh 10.10.16.162
exit

5)修改最大可创建文件数大小

#在root用户下
vim /etc/security/limits.conf
#在文件末尾中增加下面内容
* soft nofile 65536
* hard nofile 131072
* soft nproc 4096
* hard nproc 4096

6)修改最大虚拟内存大小

vim /etc/sysctl.conf
#在文件中增加下面内容
vm.max_map_count=655360
#重新加载,输入下面命令:
sysctl -p

2.ES安装前期准备

1)创建es用户

#es和kibana不能在root用户下启动,创建非root用户
useradd es
passwd es
#密码设置为es123456

2)创建es文件夹,并在其下创建data和logs文件夹

mkdir /opt/es
mkdir /opt/es/data
mkdir /opt/es/logs
chmod 777 /opt/es
chmod 777 /opt/es/data
chmod 777 /opt/es/logs

3)为用户授权es文件操作权限

chown -R es /opt/es

3.ES解压安装

#1.将elasticsearch-XXX.tar. gz解压到/opt/es文件夹下
tar -zxvf  elasticsearch-7.17.9-linux-x86_64.tar.gz
#2.修改文件名
mv elasticsearch-7.17.9 elasticsearch

4.修改elasticsearch.yml配置文件

vim /opt/es/elasticsearch/config/elasticsearch.yml

# ============== Elasticsearch configuration ===========
#集群名称
cluster.name: es-cluster
#节点名称
node.name: XXXX01
#启动地址,如果不配置,只能本地访问
network.host: 10.10.16.161
#对外提供服务的端口
http.port: 9200
#一般建议的目录地址
path.data: /opt/es/data
path.logs: /opt/es/logs
#发现设置
discovery.seed_hosts: ["10.10.16.161", "10.10.16.162"]
#初始的候选 master 节点列表
cluster.initial_master_nodes: ["XXXX01","XXXX02"]
# 当前节点是否可以被选举为master节点,是:true否:false
node.master: true  (选择一个主节点即可,其他节点改为false)
# 当前节点是否用于存储数据,是:true否:false
node.data: true  (主节点也可以选择不存数据,改为false即可)

5)配置使用ES自带jdk(选配)

#备注:使用资料里的es安装包不需要修改,即可使用自带jdk
vim /opt/es/elasticsearch/bin/elasticsearch-env

# now set the path to java
if [ ! -z "$ES_JAVA_HOME" ]; then
  JAVA="$ES_JAVA_HOME/bin/java"
  JAVA_TYPE="ES_JAVA_HOME"
elif [ ! -z "$JAVA_HOME" ]; then
  # fallback to JAVA_HOME
  echo "warning: usage of JAVA_HOME is deprecated, use ES_JAVA_HOME" >&2
 # JAVA="$JAVA_HOME/bin/java"
 # JAVA_TYPE="JAVA_HOME"
   JAVA="$ES_JAVA_HOME/bin/java"
   JAVA_TYPE="ES_JAVA_HOME"
  echo "hello world"

6)将elasticsearch文件发送至其他节点服务器(此步现在不需要做,破解完在发送)

#备注:建议在root下操作,同时确保每台服务器节点均完成1.修改服务器相关配置和2.ES安装前期准备操作
scp -r /opt/es root@10.10.16.161:/opt
#将文件发送至其他几点后,按需修改elasticsearch.yml配置文件(参照三)

7)修改jvm.options

cd /opt/es/elasticsearch/config
vim jvm.options
#将-Xmx1g改为-Xmx2g或-Xmx4g

8)启动ES

#备注:需要以es用户启动es集群,不能用root有户启动
su es 
#输入密码
es123456
#启动命令
cd /opt/es/elasticsearch
./bin/elasticsearch
#后台启动命令:
cd /opt/es/elasticsearch
./bin/elasticsearch -d

9)测试ES启动情况

#1.服务器
curl http://10.10.16.161:9200
curl http://10.1.80.94:9200/_cat/nodes?v
curl http://10.10.16.161:9200/_cat/nodes?pretty
#2.浏览器:确保win下hosts配置
http://10.10.16.161:9200
http://10.10.16.161:9200/_cat/health?v
http://10.10.16.161:9200/_cat/nodes?pretty

10)配置自动启动ES(非必须)

#第一步:
#先查看当前的开机启动服务
chkconfig --list

#第二步:
#创建es 的系统启动服务文件,进入到 cd /etc/init.d 目录
cd /etc/init.d

#第三步:
# 编写启动脚本
vim elasticsearch

#!/bin/bash
#chkconfig: 345 63 37
#description: elasticsearch
#processname: elasticsearch-7.4.2
export ES_HOME=/opt/es/elasticsearch
case $1 in
        start)
                su elsearch<<!
                cd $ES_HOME
                ./bin/elasticsearch -d -p pid
                exit
!
                echo "elasticsearch is started"
                ;;
        stop)
                pid=`cat $ES_HOME/pid`
                kill -9 $pid
                echo "elasticsearch is stopped"
                ;;
        restart)
                pid=`cat $ES_HOME/pid`
                kill -9 $pid
                echo "elasticsearch is stopped"
                sleep 1
                su elsearch<<!
                cd $ES_HOME
                ./bin/elasticsearch -d -p pid
                exit
!
                echo "elasticsearch is started"
        ;;
    *)
        echo "start|stop|restart"
        ;;
esac
exit 0

#第四步:
# 修改文件权限
chmod 777 elasticsearch

#第五步:
# 添加和删除服务并设置启动方式;
chkconfig --add elasticsearch
chkconfig --del elasticsearch

#第六步:(非必须操作)
# 关闭和启动服务;
service elasticsearch start
service elasticsearch stop
service elasticsearch restart

#第七步:
# 设置服务是否开机启动;
chkconfig elasticsearch on
chkconfig elasticsearch off

二、破解ES到白金版

1.修改LicenseVerifier.java

package org.elasticsearch.license;

import java.nio.*;
import org.elasticsearch.common.bytes.*;
import java.security.*;
import java.util.*;
import org.elasticsearch.common.xcontent.*;
import org.apache.lucene.util.*;
import org.elasticsearch.core.internal.io.*;
import java.io.*;

public class LicenseVerifier
{
    public static boolean verifyLicense(final License license, final byte[] publicKeyData) {
        return true;
    }

    public static boolean verifyLicense(final License license) {
        return true;
    }
}

2.修改XpackBuild.java

package org.elasticsearch.xpack.core;

import org.elasticsearch.core.PathUtils;
import org.elasticsearch.core.SuppressForbidden;

import java.io.IOException;
import java.net.URISyntaxException;
import java.net.URL;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.jar.JarInputStream;
import java.util.jar.Manifest;

/**
 * Information about the built version of x-pack that is running.
 */
public class XPackBuild {

    public static final XPackBuild CURRENT;

    static {
        final String shortHash;
        final String date;

        Path path = getElasticsearchCodebase();
       /* if (path.toString().endsWith(".jar")) {
            try (JarInputStream jar = new JarInputStream(Files.newInputStream(path))) {
                Manifest manifest = jar.getManifest();
                shortHash = manifest.getMainAttributes().getValue("Change");
                date = manifest.getMainAttributes().getValue("Build-Date");
            } catch (IOException e) {
                throw new RuntimeException(e);
            }
        } else {
            // not running from a jar (unit tests, IDE)
            shortHash = "Unknown";
            date = "Unknown";
        }*/

        CURRENT = new XPackBuild("Unknown", "Unknown");
    }

    /**
     * Returns path to xpack codebase path
     */
    @SuppressForbidden(reason = "looks up path of xpack.jar directly")
    static Path getElasticsearchCodebase() {
        URL url = XPackBuild.class.getProtectionDomain().getCodeSource().getLocation();
        try {
            return PathUtils.get(url.toURI());
        } catch (URISyntaxException bogus) {
            throw new RuntimeException(bogus);
        }
    }

    private String shortHash;
    private String date;

    XPackBuild(String shortHash, String date) {
        this.shortHash = shortHash;
        this.date = date;
    }

    public String shortHash() {
        return shortHash;
    }

    public String date() {
        return date;
    }
}

3.重新编译生成.class文件

ES_home_dir='/opt/es/elasticsearch'

# 生成LicenseVerifier.class文件
/opt/es/elasticsearch/jdk/bin/javac -cp "${ES_home_dir}/lib/elasticsearch-7.17.9.jar:${ES_home_dir}/lib/lucene-core-8.11.1.jar:${ES_home_dir}/modules/x-pack-core/x-pack-core-7.17.9.jar:${ES_home_dir}/modules/x-pack-core/netty-common-4.1.66.Final.jar:${ES_home_dir}/lib/elasticsearch-core-7.17.9.jar" /root/ES/7.17.9/LicenseVerifier.java

#生成XPackBuild.class文件
/opt/es/elasticsearch/jdk/bin/javac -cp "${ES_home_dir}/lib/elasticsearch-7.17.9.jar:${ES_home_dir}/lib/lucene-core-8.11.1.jar:${ES_home_dir}/modules/x-pack-core/x-pack-core-7.17.9.jar:${ES_home_dir}/lib/elasticsearch-core-7.17.9.jar" /root/ES/7.17.9/XPackBuild.java

4.替换.class文件,并替换jar包

1.将x-pack-core-7.17.9.jar(路径/opt/es/elasticsearch/modules/x-pack-core)、生成的LicenseVerifier.class文件和XPackBuild.class文件拷贝到桌面上,
2.将生成的LicenseVerifier.class文件替换掉x-pack-core-7.17.9.jar\org\elasticsearch\license中的LicenseVerifier.class文件
3.将生成的XPackBuild.class文件替换掉x-pack-core-7.17.9.jar\org\elasticsearch\xpack\core中的XPackBuild.class文件
4.将桌面的x-pack-core-7.17.9.jar替换掉/opt/es/elasticsearch/modules/x-pack-core下的x-pack-core-7.17.9.jar

备注:可以省略上述步骤,直接将安装包中的x-pack-core-7.17.9.jar替换掉/opt/es/elasticsearch/modules/x-pack-core下的x-pack-core-7.17.9.jar

5.导入License

#首先,编辑config/elasticsearch.yml,在最后设置禁用xpack.security.并启动ES
vim config/elasticsearch.yml

# Xpack's security certification
xpack.security.enabled: false
xpack.security.transport.ssl.enabled: false

#关闭es
ps -ef | gref elastic
kill -9 进程号
#重新启动es,建议先删除删除数据目录 opt/es/data/nodes
su es

cd /opt/es/elasticsearch
./bin/elasticsearch -d
#导入license
curl -XPUT -u elastic 'http://10.10.16.161:9200/_xpack/license' -H "Content-Type: application/json" -d @/opt/2099-license.json
# 此时提示需要输入elastic账号的密码,直接回车就可以
Enter host password for user 'elastic':
{"acknowledged":true,"license_status":"valid"}
#出现上述表示成功
#查看
curl http://10.10.16.160:9200/_license

6.启用Xpack

#导入License成功后,修改elasticsearch.yml配置文件,再把xpack安全认证打开
vim config/elasticsearch.yml

# Xpack's security certification
xpack.security.enabled: true


#关闭es
ps -ef | gref elastic
kill -9 进程号
#重新启动es,建议先删除删除数据目录 opt/es/data/nodes
su es

cd /opt/es/elasticsearch
./bin/elasticsearch -d
#命令生成elastic的密码
# 如果需要重新设置密码,手动设置密码
./bin/elasticsearch-setup-passwords interactive
#建议密码全设置为123456

# 自动生成密码:
./bin/elasticsearch-setup-passwords auto

Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
The passwords will be randomly generated and printed to the console.
Please confirm that you would like to continue [y/N]y



Changed password for user apm_system
PASSWORD apm_system = fjPKrxrJTi9p0ZOfhW9t

Changed password for user kibana_system
PASSWORD kibana_system = t1GoRua7WnbndX5wlolC

Changed password for user kibana
PASSWORD kibana = t1GoRua7WnbndX5wlolC

Changed password for user logstash_system
PASSWORD logstash_system = rGo4Gnkdo0j6LMPUi2J4

Changed password for user beats_system
PASSWORD beats_system = 6mHKdNqxCg1fkuI0ptde

Changed password for user remote_monitoring_user
PASSWORD remote_monitoring_user = F9q1JljbdQRoJYcOCQOg

Changed password for user elastic
PASSWORD elastic = hs5AB2SJaGWsjIXFER2t
#密码和License配置好,证书实现集群的加密通信
# 生成CA证书, 一路回车就可以
bin/elasticsearch-certutil ca  (生成的CA证书: elastic-stack-ca.p12)

# 生成节点使用的证书 一路回车就可以
bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12   (生成的节点证书: elastic-certificates.p12)

# 将节点证书,放到所有节点的 config目录下
cp elastic-certificates.p12 /opt/es/elasticsearch/config/

#将此文件发送到其他节点
scp /opt/es/elasticsearch/config/elastic-stack-ca.p12 root@10.10.16.161:/opt/es/elasticsearch/config

# 修改配置文件添加下列参数项
xpack.security.transport.ssl.enabled: true
xpack.license.self_generated.type: basic
xpack.security.transport.ssl.verification_mode: certificate  # 证书验证级别
xpack.security.transport.ssl.keystore.path: /data/local/elasticsearch/config/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /data/local/elasticsearch/config/elastic-certificates.p12

#关闭es
ps -ef | gref elastic
kill -9 进程号

su es
cd /opt/es/elasticsearch
./bin/elasticsearch -d

备注:成功启动后,可以在浏览器进行es启动测试,此时需要填写elastic,密码123456

7.将es发送至各个节点

#备注:建议在root下操作,同时确保每台服务器节点均完成1.修改服务器相关配置和2.ES安装前期准备操作 scp -r /opt/es root@10.10.16.161:/opt #将文件发送至其他几点后,按需修改elasticsearch.yml配置文件(参照三) #为用户es授权 chown -R es /opt/es #修改elasticsearch.yml 按需修改,主要修改节点信息 #重新启动es,建议先删除删除数据目录 opt/es/data/nodes和opt/es/logs/ su es cd /opt/es/elasticsearch ./bin/elasticsearch -d

三、安装kibana

1.解压安装kibana

#解压
tar --zxvf kibana-7.17.9-linux-x86_64.tar.gz
#修改文件名
mv kibana-7.17.9 kibana

2.修改kibana.yml文件

cd /opt/kibana/config
vim kibana.yml

# ============== Kibana configuration ===========
#kibana端口
server.port: 5601      
server.name: "kibana-server"
server.host: "10.10.16.161" 
#配置es的访问地址
elasticsearch.hosts: ["http://10.10.16.161:9200","http://10.10.16.162:9200"]     
kibana.index: ".kibana"
elasticsearch.username: "elastic"
elasticsearch.password: "123456"
xpack.reporting.encryptionKey: "a_random_string"
xpack.security.encryptionKey: "something_at_least_32_characters"

3.启动测试

# kibana也不能用root启动
su es
cd /opt/es/kibana
./bin/kibana