elastic学习-elasticsearch8.5启动控制台内容

[toc]

1. 不生成证书直接启动

1.1 完整的控制台信息

直接启动后控制台会展示记录一段关键信息

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ Elasticsearch security features have been automatically configured!
✅ Authentication is enabled and cluster connections are encrypted.

ℹ️  Password for the elastic user (reset with `bin/elasticsearch-reset-password -u elastic`):
  +H2hnvwZ2DmAHY1Eim_M

ℹ️  HTTP CA certificate SHA-256 fingerprint:
  d924ffb43dd09829e6f25156b2264dc5b8f5b1d119ac7e1bdde2dd0104776836

ℹ️  Configure Kibana to use this cluster:
• Run Kibana and click the configuration link in the terminal when Kibana starts.
• Copy the following enrollment token and paste it into Kibana in your browser (valid for the next 30 minutes):
  eyJ2ZXIiOiI4LjUuMiIsImFkciI6WyIyLjAuMC4xOjU5MjAwIl0sImZnciI6ImQ5MjRmZmI0M2RkMDk4MjllNmYyNTE1NmIyMjY0ZGM1YjhmNWIxZDExOWFjN2UxYmRkZTJkZDAxMDQ3NzY4MzYiLCJrZXkiOiJMWFZJVjRVQlVQN1dJOFdZREM2LTpRaTd6WGVHWFFTdS1hZEU1RFJ4Z3Z3In0=

ℹ️  Configure other nodes to join this cluster:
• On this node:
  ⁃ Create an enrollment token with `bin/elasticsearch-create-enrollment-token -s node`.
  ⁃ Uncomment the transport.host setting at the end of config/elasticsearch.yml.
  ⁃ Restart Elasticsearch.
• On other nodes:
  ⁃ Start Elasticsearch with `bin/elasticsearch --enrollment-token <token>`, using the enrollment token that you generated.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1.2 整体说明

1. elastic账号的默认密码
2. HTTP CA证书
3. kibana访问es的token
4. 其他node加入当前node的cluster的token

1.3 记性不好我忘了,怎么办

• 问题1. elastic账号默认密码我没看到,清了, 怎么办?
• 问题2. kibana访问的token超过30分钟了,怎么办?

1.4 重置密码和token

1.4.1 重置密码

运行中另开一个窗口, 使用下列命令可以重置一个密码;

bin/elasticsearch-reset-password -u elastic

1.4.2 重置密码-手动自定义密码

交互式输入密码

bin/elasticsearch-reset-password --username elastic -i

1.5 kibana/其他node加入集群

1.5.1 kibana加入集群的token

(另开命令行执行)

  bin/elasticsearch-create-enrollment-token -s kibana --url "https://localhost:9200"

1.5.2 其他node加入集群token

(另开命令行执行)

  bin/elasticsearch-create-enrollment-token -s node

2. 先生成证书再启动

2.1 控制台信息

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ Elasticsearch security features have been automatically configured!
✅ Authentication is enabled and cluster connections are encrypted.

ℹ️  Password for the elastic user (reset with `bin/elasticsearch-reset-password -u elastic`):
  DIsWATYoHD8gg8R7Cgdt

❌ Unable to generate an enrollment token for Kibana instances, try invoking `bin/elasticsearch-create-enrollment-token -s kibana`.

❌ An enrollment token to enroll new nodes wasn't generated. To add nodes and enroll them into this cluster:
• On this node:
  ⁃ Create an enrollment token with `bin/elasticsearch-create-enrollment-token -s node`.
  ⁃ Restart Elasticsearch.
• On other nodes:
  ⁃ Start Elasticsearch with `bin/elasticsearch --enrollment-token <token>`, using the enrollment token that you generated.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

2.2 整体说明

只有一项: elasticsearch的密码

1. elastic账号的默认密码

为什么?

• kibana访问,用证书
• 其他node加入,用证书

3. 补充:生成证书全过程

3.1 签发CA证书

bin\elasticsearch-certutil.bat ca

目录下生成: elastic-stack-ca.p12

3.2 用CA证书生成节点证书

bin\elasticsearch-certutil.bat cert --ca elastic-stack-ca.p12

会生成: elastic-certificates.p12

注意: 一路回车不要密码

3.3 将CA证书和节点证书mv到config/certs下

如题

3.4 签发HTTP证书

交互过程如下:

bin\elasticsearch-certutil.bat http
# 不需要csr, 输入n
Generate a CSR? [y/N]n
# 使用生成的CA整肃, 输入y
Use an existing CA? [y/N]y
# 输入CA路径: 从certs开始
CA Path: certs/elastic-stack-ca.p12
# 没有CA密码,直接回车
Password for elastic-stack-ca.p12:
# 设置5年,默认,输入:5y
For how long should your certificate be valid? [5y] 5y
# 是否需要每个节点都生成证书:输入n
Generate a certificate per node? [y/N]n
# 输入node名称: hostname, 输入后y确认
ZB-PF2P9LED
# 输入ip: , 输入后y确认
192.168.0.102
# 刚才这些配置还需要修改吗? 输入n
Do you wish to change any of these options? [y/N]n
# 不用密码, 回车
Provide a password for the "http.p12" file:  [<ENTER> for none]
# 问要不要给http证书改名, 直接回车
What filename should be used for the output zip file? [D:\devs\elastic-safe\es8.5.2\elasticsearch-ssl-http.zip]
#最后:
Zip file written to D:\devs\elastic-safe\es8.5.2\elasticsearch-ssl-http.zip

3.5 证书放到certs目录下

unzip elasticsearch-ssl-http.zip elasticsearch-ssl-http/
mv elasticsearch/http.p12 kibana/elasticsearch-ca.pem config/certs/
# 其余的文件删掉即可