ELK7.17生成部署操作手册

复制代码
================================================================
        ELK 7.17.9 生产集群部署操作手册
        （3 主 3 从 · 命令可直接复制执行版）
================================================================
适用版本：Elasticsearch 7.17.9 + Kibana 7.17.9
架构：3 主 3 从，安全认证 + 节点间 SSL
操作系统：CentOS 7 / 8
配套：《ELK7.17生产部署方案.docx》为完整说明版，本文件为命令行速查版

说明：
  1. 命令块用上下虚线（------）围成，整段复制粘贴到终端执行即可。
  2. 命令块顶部标注【在哪台机器执行】。
  3. <占位符> 需替换为实际值；本文档已填好本集群真实地址。
  4. 密码以《密码备份.txt》实际生成为准，文中用 <elastic密码> 占位。

================================================================
一、节点规划速查
================================================================
  es-master-1   10.10.10.25   候选主节点（node.master=true, node.data=false）
  es-master-2   10.10.10.26   候选主节点
  es-master-3   10.10.10.27   候选主节点
  es-data-1     10.10.10.28   数据节点（node.master=false, node.data=true）
  es-stack-1    10.10.10.29   数据节点 + Kibana（5601）
  es-data-2     10.10.10.30   数据节点

  部署目录统一：/usr/local/elk
  ES 安装目录：/usr/local/elk/elasticsearch
  Kibana 安装目录：/usr/local/elk/kibana（仅 es-stack-1）

================================================================
二、前置环境准备【所有节点执行】
================================================================
------ 关闭防火墙与 SELinux ------
systemctl stop firewalld
systemctl disable firewalld
setenforce 0
vi /etc/selinux/config     # 将 SELINUX=enforcing 改为 SELINUX=disabled

------ 配置主机名（各节点对应执行） ------
hostnamectl set-hostname es-master-1   # 10.10.10.25
hostnamectl set-hostname es-master-2   # 10.10.10.26
hostnamectl set-hostname es-master-3   # 10.10.10.27
hostnamectl set-hostname es-data-1     # 10.10.10.28
hostnamectl set-hostname es-stack-1    # 10.10.10.29
hostnamectl set-hostname es-data-2     # 10.10.10.30

------ 配置 hosts 映射（所有节点） ------
vi /etc/hosts
10.10.10.25 es-master-1
10.10.10.26 es-master-2
10.10.10.27 es-master-3
10.10.10.28 es-data-1
10.10.10.29 es-stack-1
10.10.10.30 es-data-2

------ 创建 elk 用户并授权目录 ------
useradd elk
passwd elk
mkdir -p /usr/local/elk
chown -R elk:elk /usr/local/elk

------ 优化系统参数 ------
ulimit -n 65535
vi /etc/security/limits.conf    # 追加：
# * soft nofile 65535
# * hard nofile 65535
# * soft nproc 4096
# * hard nproc 4096
sysctl -w vm.max_map_count=262144
echo "vm.max_map_count=262144" >> /etc/sysctl.conf
sysctl -p

================================================================
三、Elasticsearch 部署【所有节点执行】
================================================================
------ 下载并解压（elk 用户） ------
su elk
cd /usr/local/elk
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.17.9-linux-x86_64.tar.gz
tar -zxvf elasticsearch-7.17.9-linux-x86_64.tar.gz
mv elasticsearch-7.17.9 elasticsearch

------ 配置 elasticsearch.yml（主节点模板，替换 node.name 和 publish_host） ------
vi /usr/local/elk/elasticsearch/config/elasticsearch.yml
# ===== 主节点（es-master-1/2/3）=====
cluster.name: elk-cluster
node.name: es-master-1
node.master: true
node.data: false
node.ingest: false
network.host: 0.0.0.0
http.port: 9200
transport.port: 9300
discovery.seed_hosts: ["es-master-1","es-master-2","es-master-3","es-data-1","es-stack-1","es-data-2"]
cluster.initial_master_nodes: ["es-master-1","es-master-2","es-master-3"]
http.cors.enabled: true
http.cors.allow-origin: "*"
path.data: /usr/local/elk/elasticsearch/data
path.logs: /usr/local/elk/elasticsearch/logs
bootstrap.memory_lock: false
bootstrap.system_call_filter: false
network.bind_host: 0.0.0.0
network.publish_host: 10.10.10.25
discovery.zen.minimum_master_nodes: 2
cluster.election.max_timeout: 30s
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
xpack.security.transport.ssl.keystore.password: ""
xpack.security.transport.ssl.truststore.password: ""
xpack.security.transport.ssl.verification_mode: none
xpack.security.http.ssl.enabled: false

# ===== 数据节点（es-data-1 / es-stack-1 / es-data-2）=====
# 与主节点相比，仅改：node.master: false、node.data: true、node.ingest: true、
# node.name 和 network.publish_host 填各自值，其余相同。

------ 生成 SSL 证书（仅 es-master-1，elk 用户） ------
su elk
cd /usr/local/elk/elasticsearch/bin
./elasticsearch-certutil cert -out /usr/local/elk/elasticsearch/config/elastic-certificates.p12 -pass ""

------ 同步证书到所有节点（仅 es-master-1，root 用户） ------
su root
scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 root@es-master-2:/usr/local/elk/elasticsearch/config/
scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 root@es-master-3:/usr/local/elk/elasticsearch/config/
scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 root@es-data-1:/usr/local/elk/elasticsearch/config/
scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 root@es-stack-1:/usr/local/elk/elasticsearch/config/
scp /usr/local/elk/elasticsearch/config/elastic-certificates.p12 root@es-data-2:/usr/local/elk/elasticsearch/config/

------ 授权证书权限（所有节点，root 用户） ------
chown elk:elk /usr/local/elk/elasticsearch/config/elastic-certificates.p12
chmod 600 /usr/local/elk/elasticsearch/config/elastic-certificates.p12

================================================================
四、Kibana 部署【仅 es-stack-1】
================================================================
------ 下载并解压 ------
su elk
cd /usr/local/elk
wget https://artifacts.elastic.co/downloads/kibana/kibana-7.17.9-linux-x86_64.tar.gz
tar -zxvf kibana-7.17.9-linux-x86_64.tar.gz
mv kibana-7.17.9-linux-x86_64 kibana

------ 配置 kibana.yml ------
vi /usr/local/elk/kibana/config/kibana.yml
server.port: 5601
server.host: "0.0.0.0"
server.name: "es-stack-1"
elasticsearch.hosts: ["http://10.10.10.25:9200", "http://10.10.10.26:9200", "http://10.10.10.27:9200"]
i18n.locale: "zh-CN"
logging.dest: /usr/local/elk/kibana/logs/kibana.log

================================================================
五、集群启动与初始化
================================================================
------ 启动所有 ES 节点（所有节点，elk 用户） ------
su elk
cd /usr/local/elk/elasticsearch/bin
./elasticsearch -d
# 验证：ps -ef | grep elasticsearch | grep -v grep

------ 生成内置用户密码（仅 es-master-1，elk 用户） ------
su elk
cd /usr/local/elk/elasticsearch/bin
./elasticsearch-setup-passwords auto
# 记录 elastic 和 kibana_system 两个密码（参考《密码备份.txt》）

------ 完善 Kibana 配置并启动（仅 es-stack-1） ------
su elk
vi /usr/local/elk/kibana/config/kibana.yml
# 追加：
# elasticsearch.username: "kibana_system"
# elasticsearch.password: "<kibana_system密码>"
cd /usr/local/elk/kibana/bin
nohup ./kibana >/dev/null 2>&1 &
# 验证：ps -ef | grep kibana | grep -v grep

================================================================
六、验证
================================================================
------ 任意节点执行 ------
curl -u elastic:<elastic密码> http://127.0.0.1:9200
curl -u elastic:<elastic密码> http://127.0.0.1:9200/_cluster/health?pretty
curl -u elastic:<elastic密码> http://127.0.0.1:9200/_cat/nodes?v

------ 访问 Kibana ------
# 浏览器打开 http://10.10.10.29:5601，用 elastic 账号登录

================================================================
七、常见问题速查
================================================================
1. ES 启动失败权限不足 -> chown -R elk:elk /usr/local/elk/elasticsearch
2. SSL 握手 No name matching -> 配置 verification_mode: none
3. 节点无法发现 -> 检查防火墙、hosts、discovery.seed_hosts
4. Kibana 连不上 ES -> 核对 kibana.yml 账号密码与 ES 地址

================================================================
                         手册结束
================================================================