ELK

# Elasticsearch

## installation

Elasticsearch requires at least Java 8

java -version
    echo $JAVA_HOME
    
    curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.1.0.tar.gz
    tar -xvf elasticsearch-6.1.0.tar.gz
    cd elasticsearch-6.1.0/bin
    
    //install x-pack
    bin/elasticsearch-plugin install x-pack
    
    
## configuration

cluster.name: cluster-01
    node.name: node-01
    path.data: /home/elk/elasticsearch-6.1.0/data
    path.logs: /home/elk/elasticsearch-6.1.0/logs
    network.host: 0.0.0.0
    http.port: 9200
    discovery.zen.ping.unicast.hosts: ["103.29.70.96","139.162.88.149"]
    discovery.zen.minimum_master_nodes: 2
    
## starting

./elasticsearch -d -p pidfile
    tail -100f ../logs/cluster-01.log
    
Set the passwords for all built-in users

bin/x-pack/setup-passwords interactive
    
    Enter password for [elastic]: 
    Reenter password for [elastic]: 
    Enter password for [kibana]: 
    Reenter password for [kibana]: 
    Enter password for [logstash_system]: 
    Reenter password for [logstash_system]: 
    Changed password for user [kibana]
    Changed password for user [logstash_system]
    Changed password for user [elastic]

# Kibana

wget kibana
    
    //install x-pack
    bin/kibana-plugin install x-pack
    
    //Update Kibana to use the new password for the built-in kibana user
    vi kibana.yml
    
    elasticsearch.username: "kibana"
    elasticsearch.password: "kibanapassword"
    
    //start
    bin/kibana
    
    //visit
    http://localhost:5601
    
# logstash

//download
    wget logstash
    
    //install-xpack
    bin/logstash-plugin install x-pack
    
    //Update Logstash to use the new password for the built-in logstash_system user
    vi logstash.yml
    
    xpack.monitoring.elasticsearch.username: logstash_system
    xpack.monitoring.elasticsearch.password: logstashpassword
    
Configuring Logstash to use Basic Authentication
Logstash needs to be able to manage index templates, create indices, and write and delete documents in the indices it creates.
To set up authentication credentials for Logstash:
Create a logstash_writer role that has the manage_index_templates cluster privilege, and the write, delete, and create_index privileges for the Logstash indices. You can create roles from the Management > Roles UI in Kibana or through the role API:
    
    
    curl -i -X POST -H 'Content-Type: application/json' -H 'Authorization: Basic ZWxhc3RpYzpNaW5nanVlaW5mbzIwMTVfZWxhc3RpYw==' -d '{   "cluster": ["manage_index_templates", "monitor"],   "indices": [     {       "names": [ "*" ],        "privileges": ["write","delete","create_index"]     }   ] }' http://localhost:9200/_xpack/security/role/logstash_writer

Create a logstash_internal user and assign it the logstash_writer role. You can create users from the Management > Users UI in Kibana or through the user API:

curl -i -X POST -H 'Content-Type: application/json' -H 'Authorization: Basic ZWxhc3RpYzpNaW5nanVlaW5mbzIwMTVfZWxhc3RpYw==' -d '{   "password" : "Mingjueinfo2015_logstash",   "roles" : [ "logstash_writer"],   "full_name" : "Internal Logstash User" }' http://localhost:9200/_xpack/security/user/logstash_internal

Configure Logstash to authenticate as the logstash_internal user you just created. You configure credentials separately for each of the Elasticsearch plugins in your Logstash .conf file. For example:

```
input {
  elasticsearch {
    ...
    user => logstash_internal
    password => x-pack-test-password
  }
}
filter {
  elasticsearch {
    ...
    user => logstash_internal
    password => x-pack-test-password
  }
}
output {
  elasticsearch {
    ...
    user => logstash_internal
    password => x-pack-test-password
  }
}
```

Navigation

Recent Posts

Friend Links