Elastic search系统学习之二： 插件安装

系统： ubuntu

一、es安装X-Pack插件

1、安装插件

方法一：采用命令行

        $ bin/elasticsearch-plugin install x-pack

方法二：

步骤一：

下载插件：https://artifacts.elastic.co/downloads/packs/x-pack/x-pack-6.0.0.zip

步骤二：安装

 lxq@slave-01:~/elastic-search/elasticsearch-6.0.0$ bin/elasticsearch-plugin install file:///home/lxq/elastic-search/x-pack-6.0.0.zip
-> Downloading file:///home/lxq/elastic-search/x-pack-6.0.0.zip

2、配置密码

 单机版本

 lxq@slave-01:~/elastic-search/elasticsearch-6.0.0$ bin/x-pack/certgen
Let's get started...

Please enter the desired output file [certificate-bundle.zip]: demo
Enter instance name: 190
Enter name for directories and files [190]: 190
Enter IP Addresses for instance (comma-separated if more than one) []: 127.0.0.1
Enter DNS names for instance (comma-separated if more than one) []: 127.0.1.1
Would you like to specify another instance? Press 'y' to continue entering instance information: n
Certificates written to /home/lxq/elastic-search/yes-x-pack/elasticsearch-6.0.0/demo

配置elasticsearch.yml

xpack.ssl.key: certs/190/190.key
xpack.ssl.certificate: certs/190/190.crt
xpack.ssl.certificate_authorities: certs/ca/ca.crt
xpack.security.transport.ssl.enabled: true
#xpack.security.http.ssl.enabled: true                  //注意： 这儿一定不能设置，官方教程有误

3、启动elasticsearch

$ bin/elasticsearch

4、设置内置用户密码

lxq@slave-01:~/elastic-search/elasticsearch-6.0.0$ bin/x-pack/setup-passwords interactive
Initiating the setup of reserved user elastic,kibana,logstash_system passwords.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y


Enter password for [elastic]:
passwords must be at least [6] characters long
Try again.
Enter password for [elastic]:
passwords must be at least [6] characters long
Try again.
Enter password for [elastic]:
Reenter password for [elastic]:
Enter password for [kibana]:
Reenter password for [kibana]:
Enter password for [logstash_system]:
Reenter password for [logstash_system]:
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [elastic]

比如： 密码都为  elastic

二、配置x-pack java客户端

       可选

三、Kibana安装X-Pack插件

方法一：命令行安装

 

bin/kibana-plugin install x-pack

方法二：下载安装

步骤一：

下载插件：https://artifacts.elastic.co/downloads/packs/x-pack/x-pack-6.0.0.zip

步骤二： 安装

lxq@slave-01:~/elastic-search/kibana-6.060-linux-x86_64$ bin/kibana-plugin install  file:///home/lxq/elastic-search/x-pack-6.0.0.zip
Attempting to transfer from file:///home/lxq/elastic-search/x-pack-6.0.0.zip
Transferring 160402389 bytes....................
Transfer complete
Retrieving metadata from plugin archive
Extracting plugin archive
Extraction complete
Optimizing and caching browser bundles...


Plugin installation complete

步骤三：配置密码

 kibana.yml文件

# If your Elasticsearch is protected with basic authentication, these settings provide
# the username and password that the Kibana server uses to perform maintenance on the Kibana
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
# is proxied through the Kibana server.
elasticsearch.username: kibana
elasticsearch.password: elastic

步骤四：启动kibana

$bin/kibana

步骤五：验证

访问：http://localhost:5601/

用户名： elastic

密码： elastic

四、logstash安装x-pack插件

1、安装x-pack插件

方法一：命令

     lxq@slave-01:~/elastic-search/logstash-6.0.0$ bin/logstash-plugin install x-pack
方法二：zip包

     下载：https://artifacts.elastic.co/downloads/packs/x-pack/x-pack-6.0.0.zip (sha1)

      安装： $ bin/logstash-plugin install file:///path/to/file/x-pack-6.0.0.zip

2、配置  logstash.yml

   用户名和密码都是elasticsearch安装x-pack时候配置的：

    

xpack.monitoring.elasticsearch.username: logstash_systemxpack.monitoring.elasticsearch.password: elastic

3、配置logstash

    示例：logstash-simple.conf

input { stdin { } }
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    user => elastic  //这是重点，官方教程是错误的
    password => elastic
  }
  stdout { codec => rubydebug }
}

      示例： logstash-beats.con

      从filebeat读取数据

filebeat:
  prospectors:
    - paths:
        - /tmp/test.log #日志文件地址
      input_type: log #从文件中读取
      tail_files: true #以文件末尾开始读取数据
output:
  logstash:
      hosts: ["localhost:5043"] #填写logstash的访问IP

4、filebeat

1> 配置

 filebeat:
  prospectors:
    - paths:
        - /tmp/test.log #日志文件地址
      input_type: log #从文件中读取
      tail_files: true #以文件末尾开始读取数据
output:
  logstash:
      hosts: ["localhost:5043"] #填写logstash的访问IP

2> 运行

sudo ./filebeat -e -c filebeat.yml -d "publish"

3> 执行

 echo "hello,world" > /tmp/test.log

4> filebeat输出

    "@timestamp": "2017-11-20T15:43:58.436Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "doc",
    "version": "6.0.0"
  },
  "message": "hello,world",
  "beat": {
    "name": "slave-01",
    "hostname": "slave-01",
    "version": "6.0.0"
  },
  "source": "/tmp/test.log",
  "offset": 12
}

5> logstash输出

{
    "@timestamp" => 2017-11-20T15:43:58.436Z,
        "offset" => 12,
      "@version" => "1",
          "beat" => {
            "name" => "slave-01",
        "hostname" => "slave-01",
         "version" => "6.0.0"
    },
          "host" => "slave-01",
        "source" => "/tmp/test.log",
       "message" => "hello,world",
          "tags" => [
        [0] "beats_input_codec_plain_applied"
    ]
}