엘라스틱서치 8.5.2_우분투 2204 기본 설치 및 구성

PONERponix 2026. 8. 31. 19:41

# VM UBUNTU 2204 SETUP

# VM nat 10022 > 22 port open

# sudo apt-get update

# adduser sw

# default directory 생성

zhenya@host1:/$ sudo mkdir /app               # 엔진 설치 위치
zhenya@host1:/$ sudo mkdir /log               # 로그파일 위치
zhenya@host1:/$ sudo mkdir /sw/elasticsearch/config             # 컨피그 위치
zhenya@host1:/$ sudo mkdir /data             # 데이터 위치
zhenya@host1:/$ sudo mkdir /sw/install           # 인스톨파일 위치
zhenya@host1:/$ sudo mkdir /sw/sh                 # 쉘파일 위치

# SYSTEM setting

- ulimit, swap mem lock, virtual memory, number of threads, TCP retransmission timeout

zhenya@host1:/$ sudo su
root@host1:/# vi /etc/security/limits.conf

elastic         -       nofile          65535
elastic         -       nproc           4096
elastic         soft    memlock         unlimited
elastic         hard    memlock         unlimited

ulimit -a
# 확인

# 추후 노드별로 파일 디스크럽트 갯수에 대한 확인이 필수
GET _nodes/stats/process?filter_path=**.max_file_descriptors

root@host1:/# vi /etc/sysctl.conf

vm.swappiness = 1
vm.max_map_count=262144
net.ipv4.tcp_retries2 = 5

root@host1:/# sysctl -p
#적용

root@host1:/# vi /etc/fstab
swap 관련 UUID 주석처리

# 엘라스틱서치 8.5.2 config 분리 및 bash 설정

mkdir /app /sw /log /data
chown -R sw:sw /app /sw /log /data
mv /app/elasticsearch-8.5.2/config /sw/elasticsearch/
cd
vi ./.bashrc

export JAVA_HOME=/app/elasticsearch-8.5.2/jdk
export ES_PATH_CONF=/sw/elasticsearch/config
export KBN_PATH_CONF=/sw/kibana/config

# 쉘 생성

sw@ibk2:~/sh$ cat ./es_start.sh
#!/bin/bash

ES_HOME=/app/elasticsearch-8.5.2
ES_PATH_CONF=/sw/elasticsearch/config $ES_HOME/bin/elasticsearch -d -p $ES_HOME/elasticsearch.pid

sw@ibk2:~/sh$ cat ./es_stop.sh
#!/bin/bash

ES_HOME=/app/elasticsearch-8.5.2
PID=`ps -ef | grep -v "grep" | grep "elasticsearch.bootstrap" | awk '{print $2}'`

kill -15 `cat $ES_HOME/elasticsearch.pid`

#######################################

sw@ibk2:/sw/kibana/sh$ cat ./kbn_start.sh
#!/bin/bash

KBN_HOME=/app/kibana-8.5.2
NOW_DATE=`date "+%Y%m%d-%H%M%S"`

nohup $KBN_HOME/bin/kibana > /log/kibana/KBN_${NOW_DATE}.log &

sw@ibk2:/sw/kibana/sh$ cat ./kbn_stop.sh
#!/bin/bash

KBN_HOME=/app/kibana-8.5.2

kill -15 `cat $KBN_HOME/kibana.pid`

#######################################

sw@ibk3:/sw/logstash/sh$ cat ./ls_start.sh
#!/bin/bash

LS_HOME=/app/logstash-8.5.2

nohup $LS_HOME/bin/logstash --path.setting /sw/logstash/config > /dev/null &

sw@ibk3:/sw/logstash/sh$ cat ./ls_stop.sh
#!/bin/bash

PID=`ps -ef | grep -v "grep" | grep "logstash/jdk/bin/java" | awk '{print $2}'`

kill -15 $PID

# elasticsearch.yml

cluster.name: demo1

node.name: node-1

path.data: /data/elasticsearch
path.logs: /logs/elasticsearch

bootstrap.memory_lock: true

transport.host: _local_
http.host: 0.0.0.0

#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
#cluster.initial_master_nodes: ["node-1", "node-2"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# --------------------------------- Readiness ----------------------------------
#
# Enable an unauthenticated TCP readiness endpoint on localhost
#
#readiness.port: 9399
#
# ---------------------------------- Various -----------------------------------
#
# Allow wildcard deletion of indices:
#
#action.destructive_requires_name: false

# kibana.yml

server.name: "demo1"
server.host: "0.0.0.0"
server.port: 5601
server.maxPayload: 104857600

#server.basePath: ""
#server.rewriteBasePath: false
#server.publicBaseUrl: ""

logging.root.level: debug
logging.appenders.default:
  type: rolling-file
  fileName: /logs/kibana/kibana.log
  policy:
    type: size-limit
    size: 50mb
  strategy:
    type: numeric
    pattern: '-%i'
    max: 7
  layout:
    type: json

#server.ssl.enabled: false
#server.ssl.certificate: /path/to/your/server.crt
#server.ssl.key: /path/to/your/server.key

#elasticsearch.hosts: ["http://localhost:9200"]
#elasticsearch.username: "kibana_system"
#elasticsearch.password: "pass"
#elasticsearch.pingTimeout: 1500
#elasticsearch.requestTimeout: 30000
#elasticsearch.maxSockets: 1024
#elasticsearch.compression: false
#elasticsearch.requestHeadersWhitelist: [ authorization ]

#elasticsearch.customHeaders: {}
#elasticsearch.shardTimeout: 30000
#elasticsearch.ssl.certificate: /path/to/your/client.crt
#elasticsearch.ssl.key: /path/to/your/client.key
#elasticsearch.ssl.certificateAuthorities: [ "/path/to/your/CA.pem" ]
#elasticsearch.ssl.verificationMode: full

path.data: data
pid.file: /app/kibana-8.6.0/kibana.pid

#ops.interval: 5000
#i18n.locale: "en"

unifiedSearch.autocomplete.valueSuggestions.timeout: 5000
unifiedSearch.autocomplete.valueSuggestions.terminateAfter: 500000

#xpack.security.encryptionKey: dsearchdsearchdsearchdsearchdsearch

수정 후,

elasticsearch 기동

ES_PATH_CONF=/sw/elasticsearch/config ./bin/elasticsearch

auto configuration 을 위한 enrollerment token 등 저장

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ Elasticsearch security features have been automatically configured!
✅ Authentication is enabled and cluster connections are encrypted.

ℹ️  Password for the elastic user (reset with `bin/elasticsearch-reset-password -u elastic`):
  U7vocRO0abjsY3h-ejW_

ℹ️  HTTP CA certificate SHA-256 fingerprint:
  9620cecd7db147ef8394a9b6f96dfc88f682dcd2a133a4c82023bcb8d8eb8156

ℹ️  Configure Kibana to use this cluster:
• Run Kibana and click the configuration link in the terminal when Kibana starts.
• Copy the following enrollment token and paste it into Kibana in your browser (valid for the next 30 minutes):
  eyJ2ZXIiOiI4LjYuMCIsImFkciI6WyIxMC4yNDQuMTEyLjY0OjkyMDAiXSwiZmdyIjoiOTYyMGNlY2Q3ZGIxNDdlZjgzOTRhOWI2Zjk2ZGZjODhmNjgyZGNkMmExMzNhNGM4MjAyM2JjYjhkOGViODE1NiIsImtleSI6Iml0Ums4WVVCREM5Y1AwcDlKQWFmOmZVbmVaSHpwVHQ2bHVKTlQ1V1VRSXcifQ==

ℹ️  Configure other nodes to join this cluster:
• On this node:
  ⁃ Create an enrollment token with `bin/elasticsearch-create-enrollment-token -s node`.
  ⁃ Uncomment the transport.host setting at the end of config/elasticsearch.yml.
  ⁃ Restart Elasticsearch.
• On other nodes:
  ⁃ Start Elasticsearch with `bin/elasticsearch --enrollment-token <token>`, using the enrollment token that you generated.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

종료 후, elasticsearch 백그라운드 실행

ES_PATH_CONF=/sw/elasticsearch/config ./bin/elasticsearch -d

키바나 실행

KBN_PATH_CONF=/sw/kibana/config ./bin/kibana

Go to {주소} 접속 후

enrollment token 입력

프로세스 종료 후 elasticsearch / kibana config 필요에 따라 수정 후 기동