ELK 安裝教學｜ELK 8.x 版完整安裝一次到位

ELK 在 8.x 版之後，都預設會以開啟安全性安裝的方式進行，所以比起 7.x
版，會多了一些設定，所以如果是從 7.x
版升級上來的，可能需要多注意憑證相關的安全性設置，像是 Logstash、ES
Client、Beats 等等。

下載最新版本 ELK 8.3.3 安裝包

下載 rpm 檔，並透過 rpm 檔進行安裝：

### Elasticsearch 下載 $ sudo wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.3.3-amd64.deb 
### Logstash 下載 $ sudo wget https://artifacts.elastic.co/downloads/logstash/logstash-8.3.3-amd64.deb 
### Kibana 下載 $ sudo wget https://artifacts.elastic.co/downloads/kibana/kibana-8.3.3-amd64.deb

$ dpkg -i elasticsearch-8.3.3-amd64.deb 
$ dpkg -i logstash-8.3.3-amd64.deb 
$ dpkg -i kibana-8.3.3-amd64.deb

Elasticsearch 設定

8.x 版的 ES 在安裝後，會出現以下的訊息，建議直接使用 ES
幫忙產生的亂數密碼，或是透過訊息上的指令，另行更改之。

--------------------------- Security autoconfiguration information ------------------------------  Authentication and authorization are enabled. TLS for the transport and HTTP layers is enabled and configured.  The generated password for the elastic built-in superuser is : PeGGS9D*JOt8S3=Tt57*  If this node should join an existing cluster, you can reconfigure this with '/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <token-here>' after creating an enrollment token on your existing cluster.  You can complete the following actions at any time:  Reset the password of the elastic built-in superuser with '/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'.  Generate an enrollment token for Kibana instances with  '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'.  Generate an enrollment token for Elasticsearch nodes with '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'.  ------------------------------------------------------------------------------------------------- 

修改 Elasticsearch 的 YML

$ vi /etc/elasticsearch/elasticsearch.yml  ### 不同的集群使用不同的 cluster.name cluster.name: bimap  ### 默認是主機名 node.name: ${HOSTNAME}  ### 根據路徑修改 可以多個 ### 如在data下需新建 path.data: ["/data/es"]   bootstrap.memory_lock: true network.host: ${IP}  ### 根據主機，可以連接多台，此處以單機模式做演示： discovery.type: single-node 

啟動 Elasticsearch

$ systemctl start elasticsearch $ systemctl enable elasticsearch $ systemctl status elasticsearch

驗證是否成功啟動

curl -k -u elastic:${你的密碼} "https://localhost:9200" {   "name" : "cluster-test1",   "cluster_name" : "ELK8-cluster",   "cluster_uuid" : "mJ6d920ORiytWGZxnYHhlA",   "version" : {     "number" : "8.3.3",     "build_flavor" : "default",     "build_type" : "deb",     "build_hash" : "801fed82df74dbe537f89b71b098ccaff88d2c56",     "build_date" : "2022-07-23T19:30:09.227964828Z",     "build_snapshot" : false,     "lucene_version" : "9.2.0",     "minimum_wire_compatibility_version" : "7.17.0",     "minimum_index_compatibility_version" : "7.0.0"   },   "tagline" : "You Know, for Search" } 

Kibana 設定

修改 kibana 權限

chown -R kibana. /etc/kibana 

設定 Kibana yml 檔

$ vi /etc/kibana/kibana.yml  server.port: 5601 server.host: "0.0.0.0" server.publicBaseUrl: "http://0.0.0.0:5601" 

啟動 Kibana

$ systemctl start kibana $ systemctl enable kibana $ systemctl status kibana 

取得 Elasticsearch Token

/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana

開啟 Kibana 介面

開啟瀏覽器，網址列輸入：localhost:5601.。

理論上會直接跳出以下畫面，貼上 Elasticsearch Token 即可。

此時會需要回到 Server 產生驗證碼，並回填到 UI 上，例如：

/usr/share/kibana/bin/kibana-verification-code  ##  #Your verification code is:  139 477 

kibana 開啟 https 設定

###產生https憑證  /usr/share/elasticsearch/bin/elasticsearch-certutil ca --pem  ###複製憑證至正確位置 cp /usr/share/elasticsearch/elastic-stack-ca.zip /etc/kibana cd /etc/kibana  unzip elastic-stack-ca.zip  ###複製 ES https 以修改權限 cp /etc/elasticsearch/certs/http_ca.crt /etc/kibana/ca   ### 修改權限  chown -R kibana. /etc/kibana/ca  

編輯 kibana.yml

server.publicBaseUrl: "https://0.0.0.0:5601" ### 開啟 SSL  server.ssl.enabled: true  ### SSL 文件位置  server.ssl.certificate: /etc/kibana/ca/ca.crt  ### SSL 文件位置  server.ssl.key: /etc/kibana/ca/ca.key  

Logstash 設定

調整 logstash 的 jvm.options，最大 4G

$ vi /etc/logstash/jvm.options -Xms4g -Xmx4g 

編輯 logstash.service

$ vi /lib/systemd/system/logstash.service  User=root Group=root 

重新載入 Services

systemctl daemon-reload

啟動 Logstash

$ systemctl start logstash ### 可以手動啟 (資料太大recover) ### curl -XGET "http://localhost:9200/_cat/recovery?v" $ systemctl enable logstash $ systemctl status logstash 

滖動式升級 Elasticsearch Node

如何最佳化 Elasticsearch 效能

有任何問題，或是想看新主題?

聯絡我們