Elasticsearch官网下载地址： https://www.elastic.co/cn/downloads/elasticsearch
Elasticsearch 8.17.4地址：https://www.elastic.co/downloads/past-releases/elasticsearch-8-17-4

elasticsearch

安装目录

/home/elk8.17.4/elasticsearch

创建docker 网络

docker network create -d bridge elastic

拉取镜像文件

docker pull elasticsearch:8.17.4

执行docker脚本。

docker run -it
-d
-p 19200:19200
-p 19300:19300
--name elasticsearch
--net elastic
-e ES_JAVA_OPTS="-Xms1g -Xmx1g"
-e "discovery.type=single-node"
-e LANG=C.UTF-8
-e LC_ALL=C.UTF-8
-v /home/elk8.17.4/elasticsearch/config:/usr/share/elasticsearch/config
-v /home/elk8.17.4/elasticsearch/data:/usr/share/elasticsearch/data
-v /home/elk8.17.4/elasticsearch/plugins:/usr/share/elasticsearch/plugins
-v /home/elk8.17.4/elasticsearch/logs:/usr/share/elasticsearch/logs
elasticsearch:8.17.4
elasticsearch 默认端口号和项目微服务端口号一样修改为19200和19300
在elasticsearch.yml文件中增加http.port和transport.prot

image.png
云服务中删除再重新安装elasticsearch
密码重置：
elasticsearch-reset-password -u elastic
生成kibana账号：
elasticsearch-users useradd 用户名
角色授权操作：
elasticsearch-users roles -a superuser 用户名
elasticsearch-users roles -a kibana_system 用户名
查看授权：
elasticsearch-users roles -v 用户名

Kibana 8.17.4

下载地址：https://www.elastic.co/downloads/past-releases#kibana
下载镜像文件
docker pull kibana:8.17.4
启动命令
docker run -it
-d
--restart=always
--log-driver json-file
--log-opt max-size=100m
--log-opt max-file=2
--name kibana
-p 5601:5601
--net elastic
kibana:8.17.4
创建挂载目录
mkdir /home/elk8.17.4/kibana
sudo chown -R 1000:1000 /home/elk8.17.4/kibana/
复制文件内容到主机
docker cp kibana:/usr/share/kibana/config /home/elk8.17.4/kibana/
docker cp kibana:/usr/share/kibana/data /home/elk8.17.4/kibana/
docker cp kibana:/usr/share/kibana/plugins /home/elk8.17.4/kibana/
docker cp kibana:/usr/share/kibana/logs /home/elk8.17.4/kibana/
重新挂载

docker run -it \
    -d \
    --log-driver json-file \
    --log-opt max-size=100m \
    --log-opt max-file=2 \
    --name kibana \
    -p 5601:5601 \
    --net elastic \
    -v /home/elk8.17.4/kibana/config:/usr/share/kibana/config \
    -v /home/elk8.17.4/kibana/data:/usr/share/kibana/data \
    -v /home/elk8.17.4/kibana/plugins:/usr/share/kibana/plugins \
    -v /home/elk8.17.4/kibana/logs:/usr/share/kibana/logs \
    kibana:8.17.4

配置服务令牌
elasticsearch-service-tokens.bat create elastic/kibana kibana-token
在kibana.yml中设置
# 允许所有IP访问Kibana.
server.host: "0.0.0.0"
# 连接ES的HTTPS地址(因为es8.x自带安全认证，所以必须是HTTPS地址)
elasticsearch.hosts: ["https://127.0.0.1:19200"]

```elasticsearch.serviceAccountToken: ```"AAEAAWVsYXN0aWMva2liYW5hL2tpYmFuYS10b2tlbjo2QkhCRU9acFJBMjBUZkZpbWdFV3BB"

```elasticsearch.ssl.certificateAuthorities: [ "D:/elasticsearch-8.17.3/config/certs/http_ca.crt" ]
# 如果忘记第一次登录的token
**先进入已经启动的es集群中路径或者容器中**
docker exec -it es-node1 /bin/bash
cd /usr/share/elasticsearch
**kibana使用的**
bin/elasticsearch-create-enrollment-token -s kibana --url "https://localhost:19200"
**node节点使用的**
bin/elasticsearch-create-enrollment-token -s node
#或者重置密码
./bin/elasticsearch-reset-password -u elastic




#Logstash 8.17.4
**下载镜像文件**
docker pull logstash:8.17.4
**执行脚本**
docker run -it \
    -d \
    --name logstash \
    -p 9600:9600 \
    -p 5044:5044 \
    --net elastic \
    logstash:8.17.4

**创建挂载目录**
mkdir /home/elk8.17.4//logstash
sudo chown -R 1000:1000 /home/elk8.17.4/logstash/
**复制文件内容到主机**
docker cp logstash:/usr/share/logstash/config /home/elk8.17.4/logstash/ 
docker cp logstash:/usr/share/logstash/pipeline /home/elk8.17.4/logstash/ 
**拷贝证书到logstash**
sudo cp -r /home/elk8.17.4/elasticsearch/config/certs /home/elk8.17.4/logstash/config/certs
**修改config\logstash.yml**
http.host: "0.0.0.0"
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.hosts: [ "https://8.138.159.106:19200" ]
xpack.monitoring.elasticsearch.username: "elastic"
xpack.monitoring.elasticsearch.password: "bmcx123456."
xpack.monitoring.elasticsearch.ssl.certificate_authority: "/usr/share/logstash/config/certs/http_ca.crt"
xpack.monitoring.elasticsearch.ssl.ca_trusted_fingerprint: ""
**再修改pipline\logstash.conf**

input {
  stdin { 
    codec => "plain"
  }
  http {
    port => 5044
    codec => json_lines  
    
  }
}

filter {

  mutate {
    add_field => { "source" => "postman" }
  }
}

output {
  elasticsearch {
    hosts => ["https://8.138.159.109:19200"]
    index => "test"
    user => "elastic"
    password => "bmcx123456."
    ssl_enabled => false                          
      # 启用 HTTPS
    ssl_verification_mode => "none"             
      # 不验证证书
  }
}

#单机版ElasticSearch健康状态yellow解决
修改分片数为0 
PUT _settings
{
  "index": {
    "number_of_replicas": 0
  }
}