Elasticsearch集羣的安裝與部署 - Clotho 詳情 - elasticsearch,docker,elastic,JavaScript,前端開發 bigrobin 博客

參考鏈接

假設我們有三台機器，172.24.52.209，172.24.52.210，172.24.52.211。
用户名xjw
三台機器都創建文件夾/home/xjw/docker/learning/elasticsearch，和/home/xjw/docker/learning/kibana，learning為項目名

mkdir -p /home/xjw/docker/learning/elasticsearch/data
mkdir -p /home/xjw/docker/learning/kibana/data

三台機器都下載elasticsearch和對應的kibana，我選擇的是最新的9.2.1

docker pull elasticsearch:9.2.1
docker pull kibana:9.2.1

安裝docker compose插件，一定得是插件
安裝過程可以參考我另一篇文章docker compose插件安裝。

進入目錄/home/xjw/docker/learning/elasticsearch 在當前目錄創建文件docker-compose-setup.yml，內容如下

version: "2.2"

services:
  setup:
    image: elasticsearch:9.2.1
    volumes:
      - ./certs:/usr/share/elasticsearch/config/certs
    user: "0"
    command: >
      bash -c '
        if [ x${ELASTIC_PASSWORD} == x ]; then
          echo "Set the ELASTIC_PASSWORD environment variable in the .env file";
          exit 1;
        elif [ x${KIBANA_PASSWORD} == x ]; then
          echo "Set the KIBANA_PASSWORD environment variable in the .env file";
          exit 1;
        fi;
        if [ ! -f config/certs/ca.zip ]; then
          echo "Creating CA";
          bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
          unzip config/certs/ca.zip -d config/certs;
        fi;
        if [ ! -f config/certs/certs.zip ]; then
          echo "Creating certs";
          bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
          unzip config/certs/certs.zip -d config/certs;
        fi;
        echo "Setting file permissions"
        chown -R root:root config/certs;
        find . -type d -exec chmod 750 \{\} \;;
        find . -type f -exec chmod 640 \{\} \;;
        echo "All done!";
      '

其中image: elasticsearch:9.2.1，如果你用其他版本就修改這裏，注意es和kibana版本要處處對應
version: "2.2"可能會報警告，不管它

volumes:
      - ./certs:/usr/share/elasticsearch/config/certs

這裏是做了文件夾映射

在當前目錄創建文件.env，這個文件在3台服務器上都要，內容如下

# Password for the 'elastic' user (at least 6 characters)
ELASTIC_PASSWORD=espasswd

# Password for the 'kibana_system' user (at least 6 characters)
KIBANA_PASSWORD=kbpasswd

# Version of Elastic products
STACK_VERSION=9.2.1

# Set the cluster name
CLUSTER_NAME=es-cluster

# Set to 'basic' or 'trial' to automatically start the 30-day trial
LICENSE=basic
#LICENSE=trial

# Port to expose Elasticsearch HTTP API to the host
ES_PORT=9200
#ES_PORT=127.0.0.1:9200

# Port to expose Elasticsearch Transport to the host
ES_TRANSPORT_PORT=9300

# Port to expose Kibana to the host
KIBANA_PORT=5601
#KIBANA_PORT=80

# Increase or decrease based on the available host memory (in bytes)
MEM_LIMIT=17179869184

# Project namespace (defaults to the current folder name if not set)
#COMPOSE_PROJECT_NAME=myproject

root用户在當前創建證書目錄

mkdir ./certs
chmod g+rwx ./certs
chgrp 0 ./certs

root用户在當前目錄的certs目錄下vim instances.yml，並寫入如下內容

instances:
  - name: es01
    dns:
      - es01
      - localhost
    ip:
      - 172.24.52.209
      - 127.0.0.1
  - name: es02
    dns:
      - es02
      - localhost
    ip:
      - 172.24.52.210
      - 127.0.0.1
  - name: es03
    dns:
      - es03
      - localhost
    ip:
      - 172.24.52.211
      - 127.0.0.1

然後一台機器上使用root在elasticsearch目錄下執行

docker compose -f docker-compose-setup.yml up

然後在certs文件夾生成了目錄，目錄結構如下所示，

Elasticsearch集羣的安裝與部署 - Clotho_elastic

將目錄同步到所有節點
將certs目錄下載下來，上傳到其他節點上，記得

chown 0 -R  certs
chgrp 0 -R certs

第一個節點當前目錄創建docekr-compose.yml文件，寫入如下，其他兩個節點修改environment下的node.name分別為es02，es03，修改network.publish_host分別為es02，es03。

x-extra_hosts:
  &es_extra_hosts
  - "es01:172.24.52.209"
  - "es02:172.24.52.210"
  - "es03:172.24.52.211"

services:
  elasticsearch:
    image: elasticsearch:9.2.1
    volumes:
      - ./certs:/usr/share/elasticsearch/config/certs
      - /home/xjw/docker/learning/elasticsearch/data:/usr/share/elasticsearch/data
    ports:
      - ${ES_PORT}:9200
      - ${ES_TRANSPORT_PORT}:9300
    extra_hosts: *es_extra_hosts
    environment:
      - node.name=es01
      - cluster.name=${CLUSTER_NAME}
      - cluster.initial_master_nodes=es01,es02,es03
      - discovery.seed_hosts=es01,es02,es03
      - network.publish_host=es01
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - bootstrap.memory_lock=true
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=certs/es01/es01.key
      - xpack.security.http.ssl.certificate=certs/es01/es01.crt
      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.key=certs/es01/es01.key
      - xpack.security.transport.ssl.certificate=certs/es01/es01.crt
      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.license.self_generated.type=${LICENSE}
    mem_limit: ${MEM_LIMIT}
    ulimits:
      memlock:
        soft: -1
        hard: -1
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
        ]
      interval: 10s
      timeout: 10s
      retries: 120


  kibana:
    image: kibana:9.2.1
    volumes:
      - ./certs:/usr/share/kibana/config/certs
      - /home/xjw/docker/learning/kibana/data:/usr/share/kibana/data
    ports:
      - ${KIBANA_PORT}:5601
    extra_hosts: *es_extra_hosts
    environment:
      - SERVERNAME=kibana
      - ELASTICSEARCH_HOSTS=https://es01:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
      - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt
    mem_limit: ${MEM_LIMIT}
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'",
        ]
      interval: 10s
      timeout: 10s
      retries: 120

三台機器都執行

chmod g+rwx /home/xjw/docker/learning/kibana/data/
chmod g+rwx /home/xjw/docker/learning/elasticsearch/data/

修改權限

sudo chown -R 1000:1000 /home/xjw/docker/learning/elasticsearch/
sudo chown -R 1000:1000 /home/xjw/docker/learning/kibana/
chmod 775 -R certs/

設置主機系統級參數 vm.max_map_count

echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.d/99-es.conf
sudo sysctl -p /etc/sysctl.d/99-es.conf

三個機器都啓動es

docker compose up elasticsearch -d

啓動後可以查看集羣狀態，這裏的$ELASTIC_PASSWORD替換.env文件裏設置的密碼kbpasswd

curl --cacert ./certs/ca/ca.crt -u elastic:$ELASTIC_PASSWORD https://localhost:9200/_cat/nodes?v
# 或者 Docker Compose 內部執行
docker compose exec -it elasticsearch curl --cacert /usr/share/elasticsearch/config/certs/ca/ca.crt -u elastic:$ELASTIC_PASSWORD https://localhost:9200/_cat/health?v

成功啓動後會顯示

Elasticsearch集羣的安裝與部署 - Clotho_elasticsearch_02

其中master下面的*代表這個是主節點，下面我們的kibana要在主節點上啓動

在es中設置kibana的密碼，設置成和.env文件上寫的一樣

docker compose exec -it elasticsearch bin/elasticsearch-reset-password -i -u kibana_system

在主節點上啓動kibana

docker compose up kibana -d

可以通過啓動kibana的機器ip的5601端口訪問es，用户名為默認的elastic，密碼為.env文件中的espasswd

本文章為轉載內容，我們尊重原作者對文章享有的著作權。如有內容錯誤或侵權問題，歡迎原作者聯繫我們進行內容更正或刪除文章。

bigrobin 博客

bigrobin 博客

博客 / 詳情