Elasticsearch 中误操作删除了所有用户解决办法

如果在 Elasticsearch 中误操作删除了所有用户，可以通过以下步骤重新创建用户和密码：

1. 在配置文件中开启 x-pack 验证，修改config（一般是在/usr/share/elasticsearch）目录下面的elasticsearch.yml文件，添加以下内容并重启：

   xpack.security.enabled: true
   xpack.license.self_generated.type: basic
   xpack.security.transport.ssl.enabled: true

2. 执行设置用户名和密码的命令，需要为4个用户分别设置密码，包括elastic、kibana、logstash_system和beats_system：

   bin/elasticsearch-setup-passwords interactive
   initiating the setup of passwords for reserved users elastic,kibana,logstash_system,beats_system.
   You will be prompted to enter passwords as the process progresses.
   Please confirm that you would like to continue (y/N)y
   Enter password for (elastic):
   Reenter password for (elastic):
   Passwords do not match. Try again.
   Enter password for (elastic):
   Reenter password for (elastic):
   Enter password for (kibana):
   Reenter password for (kibana):
   Enter password for (logstash_system):
   Reenter password for (logstash_system):
   Enter password for (beats_system):
   Reenter password for (beats_system):
   Changed password for user (kibana)
   Changed password for user (logstash_system)
   Changed password for user (beats_system)
   Changed password for user (elastic)

3. 后续需要修改密码，命令如下：

   curl -H "Content-Type:application/json" -XPOST -u elastic 'http://127.0.0.1:9200/_xpack/security/user/elastic/_password' -d '{ "password" : "123456" }'

备注：请谨慎删除security索引，这个是系统用户密码保存的索引。