ELK 7.17.9 生产集群部署操作手册 3 主 3 从 · 命令可直接复制执行版 适用版本Elasticsearch 7.17.9 Kibana 7.17.9 架构3 主 3 从安全认证 节点间 SSL 操作系统CentOS 7 / 8 配套《ELK7.17生产部署方案.docx》为完整说明版本文件为命令行速查版 说明 1. 命令块用上下虚线------围成整段复制粘贴到终端执行即可。 2. 命令块顶部标注【在哪台机器执行】。 3. 占位符 需替换为实际值本文档已填好本集群真实地址。 4. 密码以《密码备份.txt》实际生成为准文中用 elastic密码 占位。 一、节点规划速查 es-master-1 10.10.10.25 候选主节点node.mastertrue, node.datafalse es-master-2 10.10.10.26 候选主节点 es-master-3 10.10.10.27 候选主节点 es-data-1 10.10.10.28 数据节点node.masterfalse, node.datatrue es-stack-1 10.10.10.29 数据节点 Kibana5601 es-data-2 10.10.10.30 数据节点 部署目录统一/usr/local/elk ES 安装目录/usr/local/elk/elasticsearch Kibana 安装目录/usr/local/elk/kibana仅 es-stack-1 二、前置环境准备【所有节点执行】 ------ 关闭防火墙与 SELinux ------ systemctl stop firewalld systemctl disable firewalld setenforce 0 vi /etc/selinux/config # 将 SELINUXenforcing 改为 SELINUXdisabled ------ 配置主机名各节点对应执行 ------ hostnamectl set-hostname es-master-1 # 10.10.10.25 hostnamectl set-hostname es-master-2 # 10.10.10.26 hostnamectl set-hostname es-master-3 # 10.10.10.27 hostnamectl set-hostname es-data-1 # 10.10.10.28 hostnamectl set-hostname es-stack-1 # 10.10.10.29 hostnamectl set-hostname es-data-2 # 10.10.10.30 ------ 配置 hosts 映射所有节点 ------ vi /etc/hosts 10.10.10.25 es-master-1 10.10.10.26 es-master-2 10.10.10.27 es-master-3 10.10.10.28 es-data-1 10.10.10.29 es-stack-1 10.10.10.30 es-data-2 ------ 创建 elk 用户并授权目录 ------ useradd elk passwd elk mkdir -p /usr/local/elk chown -R elk:elk /usr/local/elk ------ 优化系统参数 ------ ulimit -n 65535 vi /etc/security/limits.conf # 追加 # * soft nofile 65535 # * hard nofile 65535 # * soft nproc 4096 # * hard nproc 4096 sysctl -w vm.max_map_count262144 echo vm.max_map_count262144 /etc/sysctl.conf sysctl -p 三、Elasticsearch 部署【所有节点执行】 ------ 下载并解压elk 用户 ------ su elk cd /usr/local/elk wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.17.9-linux-x86_64.tar.gz tar -zxvf elasticsearch-7.17.9-linux-x86_64.tar.gz mv elasticsearch-7.17.9 elasticsearch ------ 配置 elasticsearch.yml主节点模板替换 node.name 和 publish_host ------ vi /usr/local/elk/elasticsearch/config/elasticsearch.yml # 主节点es-master-1/2/3 cluster.name: elk-cluster node.name: es-master-1 node.master: true node.data: false node.ingest: false network.host: 0.0.0.0 http.port: 9200 transport.port: 9300 discovery.seed_hosts: [es-master-1,es-master-2,es-master-3,es-data-1,es-stack-1,es-data-2] cluster.initial_master_nodes: [es-master-1,es-master-2,es-master-3] http.cors.enabled: true http.cors.allow-origin: * path.data: /usr/local/elk/elasticsearch/data path.logs: /usr/local/elk/elasticsearch/logs bootstrap.memory_lock: false bootstrap.system_call_filter: false network.bind_host: 0.0.0.0 network.publish_host: 10.10.10.25 discovery.zen.minimum_master_nodes: 2 cluster.election.max_timeout: 30s xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: elastic-certificates.p12 xpack.security.transport.ssl.keystore.password: xpack.security.transport.ssl.truststore.password: xpack.security.transport.ssl.verification_mode: none xpack.security.http.ssl.enabled: false # 数据节点es-data-1 / es-stack-1 / es-data-2 # 与主节点相比仅改node.master: false、node.data: true、node.ingest: true、 # node.name 和 network.publish_host 填各自值其余相同。 ------ 生成 SSL 证书仅 es-master-1elk 用户 ------ su elk cd /usr/local/elk/elasticsearch/bin ./elasticsearch-certutil cert -out /usr/local/elk/elasticsearch/config/elastic-certificates.p12 -pass ------ 同步证书到所有节点仅 es-master-1root 用户 ------ su root scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 rootes-master-2:/usr/local/elk/elasticsearch/config/ scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 rootes-master-3:/usr/local/elk/elasticsearch/config/ scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 rootes-data-1:/usr/local/elk/elasticsearch/config/ scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 rootes-stack-1:/usr/local/elk/elasticsearch/config/ scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 rootes-data-2:/usr/local/elk/elasticsearch/config/ ------ 授权证书权限所有节点root 用户 ------ chown elk:elk /usr/local/elk/elasticsearch/config/elastic-certificates.p12 chmod 600 /usr/local/elk/elasticsearch/config/elastic-certificates.p12 四、Kibana 部署【仅 es-stack-1】 ------ 下载并解压 ------ su elk cd /usr/local/elk wget https://artifacts.elastic.co/downloads/kibana/kibana-7.17.9-linux-x86_64.tar.gz tar -zxvf kibana-7.17.9-linux-x86_64.tar.gz mv kibana-7.17.9-linux-x86_64 kibana ------ 配置 kibana.yml ------ vi /usr/local/elk/kibana/config/kibana.yml server.port: 5601 server.host: 0.0.0.0 server.name: es-stack-1 elasticsearch.hosts: [http://10.10.10.25:9200, http://10.10.10.26:9200, http://10.10.10.27:9200] i18n.locale: zh-CN logging.dest: /usr/local/elk/kibana/logs/kibana.log 五、集群启动与初始化 ------ 启动所有 ES 节点所有节点elk 用户 ------ su elk cd /usr/local/elk/elasticsearch/bin ./elasticsearch -d # 验证ps -ef | grep elasticsearch | grep -v grep ------ 生成内置用户密码仅 es-master-1elk 用户 ------ su elk cd /usr/local/elk/elasticsearch/bin ./elasticsearch-setup-passwords auto # 记录 elastic 和 kibana_system 两个密码参考《密码备份.txt》 ------ 完善 Kibana 配置并启动仅 es-stack-1 ------ su elk vi /usr/local/elk/kibana/config/kibana.yml # 追加 # elasticsearch.username: kibana_system # elasticsearch.password: kibana_system密码 cd /usr/local/elk/kibana/bin nohup ./kibana /dev/null 21 # 验证ps -ef | grep kibana | grep -v grep 六、验证 ------ 任意节点执行 ------ curl -u elastic:elastic密码 http://127.0.0.1:9200 curl -u elastic:elastic密码 http://127.0.0.1:9200/_cluster/health?pretty curl -u elastic:elastic密码 http://127.0.0.1:9200/_cat/nodes?v ------ 访问 Kibana ------ # 浏览器打开 http://10.10.10.29:5601用 elastic 账号登录 七、常见问题速查 1. ES 启动失败权限不足 - chown -R elk:elk /usr/local/elk/elasticsearch 2. SSL 握手 No name matching - 配置 verification_mode: none 3. 节点无法发现 - 检查防火墙、hosts、discovery.seed_hosts 4. Kibana 连不上 ES - 核对 kibana.yml 账号密码与 ES 地址 手册结束
ELK 7.17.9 生产集群部署操作手册 3 主 3 从 · 命令可直接复制执行版 适用版本Elasticsearch 7.17.9 Kibana 7.17.9 架构3 主 3 从安全认证 节点间 SSL 操作系统CentOS 7 / 8 配套《ELK7.17生产部署方案.docx》为完整说明版本文件为命令行速查版 说明 1. 命令块用上下虚线------围成整段复制粘贴到终端执行即可。 2. 命令块顶部标注【在哪台机器执行】。 3. 占位符 需替换为实际值本文档已填好本集群真实地址。 4. 密码以《密码备份.txt》实际生成为准文中用 elastic密码 占位。 一、节点规划速查 es-master-1 10.10.10.25 候选主节点node.mastertrue, node.datafalse es-master-2 10.10.10.26 候选主节点 es-master-3 10.10.10.27 候选主节点 es-data-1 10.10.10.28 数据节点node.masterfalse, node.datatrue es-stack-1 10.10.10.29 数据节点 Kibana5601 es-data-2 10.10.10.30 数据节点 部署目录统一/usr/local/elk ES 安装目录/usr/local/elk/elasticsearch Kibana 安装目录/usr/local/elk/kibana仅 es-stack-1 二、前置环境准备【所有节点执行】 ------ 关闭防火墙与 SELinux ------ systemctl stop firewalld systemctl disable firewalld setenforce 0 vi /etc/selinux/config # 将 SELINUXenforcing 改为 SELINUXdisabled ------ 配置主机名各节点对应执行 ------ hostnamectl set-hostname es-master-1 # 10.10.10.25 hostnamectl set-hostname es-master-2 # 10.10.10.26 hostnamectl set-hostname es-master-3 # 10.10.10.27 hostnamectl set-hostname es-data-1 # 10.10.10.28 hostnamectl set-hostname es-stack-1 # 10.10.10.29 hostnamectl set-hostname es-data-2 # 10.10.10.30 ------ 配置 hosts 映射所有节点 ------ vi /etc/hosts 10.10.10.25 es-master-1 10.10.10.26 es-master-2 10.10.10.27 es-master-3 10.10.10.28 es-data-1 10.10.10.29 es-stack-1 10.10.10.30 es-data-2 ------ 创建 elk 用户并授权目录 ------ useradd elk passwd elk mkdir -p /usr/local/elk chown -R elk:elk /usr/local/elk ------ 优化系统参数 ------ ulimit -n 65535 vi /etc/security/limits.conf # 追加 # * soft nofile 65535 # * hard nofile 65535 # * soft nproc 4096 # * hard nproc 4096 sysctl -w vm.max_map_count262144 echo vm.max_map_count262144 /etc/sysctl.conf sysctl -p 三、Elasticsearch 部署【所有节点执行】 ------ 下载并解压elk 用户 ------ su elk cd /usr/local/elk wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.17.9-linux-x86_64.tar.gz tar -zxvf elasticsearch-7.17.9-linux-x86_64.tar.gz mv elasticsearch-7.17.9 elasticsearch ------ 配置 elasticsearch.yml主节点模板替换 node.name 和 publish_host ------ vi /usr/local/elk/elasticsearch/config/elasticsearch.yml # 主节点es-master-1/2/3 cluster.name: elk-cluster node.name: es-master-1 node.master: true node.data: false node.ingest: false network.host: 0.0.0.0 http.port: 9200 transport.port: 9300 discovery.seed_hosts: [es-master-1,es-master-2,es-master-3,es-data-1,es-stack-1,es-data-2] cluster.initial_master_nodes: [es-master-1,es-master-2,es-master-3] http.cors.enabled: true http.cors.allow-origin: * path.data: /usr/local/elk/elasticsearch/data path.logs: /usr/local/elk/elasticsearch/logs bootstrap.memory_lock: false bootstrap.system_call_filter: false network.bind_host: 0.0.0.0 network.publish_host: 10.10.10.25 discovery.zen.minimum_master_nodes: 2 cluster.election.max_timeout: 30s xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: elastic-certificates.p12 xpack.security.transport.ssl.keystore.password: xpack.security.transport.ssl.truststore.password: xpack.security.transport.ssl.verification_mode: none xpack.security.http.ssl.enabled: false # 数据节点es-data-1 / es-stack-1 / es-data-2 # 与主节点相比仅改node.master: false、node.data: true、node.ingest: true、 # node.name 和 network.publish_host 填各自值其余相同。 ------ 生成 SSL 证书仅 es-master-1elk 用户 ------ su elk cd /usr/local/elk/elasticsearch/bin ./elasticsearch-certutil cert -out /usr/local/elk/elasticsearch/config/elastic-certificates.p12 -pass ------ 同步证书到所有节点仅 es-master-1root 用户 ------ su root scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 rootes-master-2:/usr/local/elk/elasticsearch/config/ scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 rootes-master-3:/usr/local/elk/elasticsearch/config/ scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 rootes-data-1:/usr/local/elk/elasticsearch/config/ scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 rootes-stack-1:/usr/local/elk/elasticsearch/config/ scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 rootes-data-2:/usr/local/elk/elasticsearch/config/ ------ 授权证书权限所有节点root 用户 ------ chown elk:elk /usr/local/elk/elasticsearch/config/elastic-certificates.p12 chmod 600 /usr/local/elk/elasticsearch/config/elastic-certificates.p12 四、Kibana 部署【仅 es-stack-1】 ------ 下载并解压 ------ su elk cd /usr/local/elk wget https://artifacts.elastic.co/downloads/kibana/kibana-7.17.9-linux-x86_64.tar.gz tar -zxvf kibana-7.17.9-linux-x86_64.tar.gz mv kibana-7.17.9-linux-x86_64 kibana ------ 配置 kibana.yml ------ vi /usr/local/elk/kibana/config/kibana.yml server.port: 5601 server.host: 0.0.0.0 server.name: es-stack-1 elasticsearch.hosts: [http://10.10.10.25:9200, http://10.10.10.26:9200, http://10.10.10.27:9200] i18n.locale: zh-CN logging.dest: /usr/local/elk/kibana/logs/kibana.log 五、集群启动与初始化 ------ 启动所有 ES 节点所有节点elk 用户 ------ su elk cd /usr/local/elk/elasticsearch/bin ./elasticsearch -d # 验证ps -ef | grep elasticsearch | grep -v grep ------ 生成内置用户密码仅 es-master-1elk 用户 ------ su elk cd /usr/local/elk/elasticsearch/bin ./elasticsearch-setup-passwords auto # 记录 elastic 和 kibana_system 两个密码参考《密码备份.txt》 ------ 完善 Kibana 配置并启动仅 es-stack-1 ------ su elk vi /usr/local/elk/kibana/config/kibana.yml # 追加 # elasticsearch.username: kibana_system # elasticsearch.password: kibana_system密码 cd /usr/local/elk/kibana/bin nohup ./kibana /dev/null 21 # 验证ps -ef | grep kibana | grep -v grep 六、验证 ------ 任意节点执行 ------ curl -u elastic:elastic密码 http://127.0.0.1:9200 curl -u elastic:elastic密码 http://127.0.0.1:9200/_cluster/health?pretty curl -u elastic:elastic密码 http://127.0.0.1:9200/_cat/nodes?v ------ 访问 Kibana ------ # 浏览器打开 http://10.10.10.29:5601用 elastic 账号登录 七、常见问题速查 1. ES 启动失败权限不足 - chown -R elk:elk /usr/local/elk/elasticsearch 2. SSL 握手 No name matching - 配置 verification_mode: none 3. 节点无法发现 - 检查防火墙、hosts、discovery.seed_hosts 4. Kibana 连不上 ES - 核对 kibana.yml 账号密码与 ES 地址 手册结束
