SYSTEM

엘라스틱서치를 구동하기 위해 기본적으로 해야할 서버 셋팅

1. 유저 생성

#useradd elasticsearch

2. sysctl 커널 파라미터 설정

# vi /etc/sysctl.conf

vm.max_map_count = 262144
fs.file-max = 262144

3. 리소스 제한 해제 # vi /etc/security/limits.conf

domain	type	item	value
elasticsearch	hard	nofile	65536
elasticsearch	soft	nofile	65536
elasticsearch	hard	nproc	65536
elasticsearch	soft	nproc	65536

이 부분에서 65536 > 1024000 으로 셋팅하는 설정도 있으나, 참고만...

4. 방화벽 해제

firewall-cmd --zone=public --permanent --add-port=9200/tcp
firewall-cmd --zone=public --permanent --add-port=5601/tcp
firewall-cmd --zone=public --permanent --add-port=5044/tcp
firewall-cmd --reload
firewall-cmd --list-all

5. 재기동

---

엘라스틱서치 기본 셋팅

cluster.name: es-appliances

node:
  name: node-1
  attr.rack: r1
  master: true
  data: true
  ingest: true
  ml: true

path.data: /home/elasticsearch/elasticsearch/data
path.logs: /home/elasticsearch/elasticsearch/logs

bootstrap.memory_lock: true

network.host: 0.0.0.0
http.port: 9200

discovery.seed_hosts: ["es-appliances"]
cluster.initial_master_nodes: ["node-1"]

xpack:
  security:
    enabled: true
    transport.ssl.enabled: true

키바나 기본 셋팅

server:
  port: 5601
  host: "0.0.0.0"
  name: "es-appliances"

elasticsearch:
  hosts: ["http://0.0.0.0:9200"]
  username: "kibana_system"
  password: "openerd1!"

pid.file: /home/elasticsearch/kibana/kibana.pid

#server.ssl.enabled: false
#server.ssl.certificate: /path/to/your/server.crt
#server.ssl.key: /path/to/your/server.key

#elasticsearch.ssl.certificate: /path/to/your/client.crt
#elasticsearch.ssl.key: /path/to/your/client.key
#elasticsearch.ssl.certificateAuthorities: [ "/path/to/your/CA.pem" ]
#elasticsearch.ssl.verificationMode: full

#i18n.locale: "en"

---

x-pack 라이선스 활성화 때문에 고생을 좀 했는데, 위와 같이 설정했는데 ./bin/elasticsearch-setup-passwords interactive

로 실행시 아래와 같은 오류가 발생한다면, 라이선스 문제가 맞다.

Failed to determine the health of the cluster running at http://172.18.0.2:9200
Unexpected response code [503] from calling GET http://172.18.0.2:9200/_cluster/health?pretty
Cause: master_not_discovered_exception

고생 엄청했는데, 결국 또 포트 문제... 도커로 올리면서 9300 통신을 까먹었다.......

---

위 문제도 아니었음 아오 빡쳐... 매번 하던걸 2틀이나 고생했는데, SSL 상위인 TLS 설정해서 서로 통신되게 하려면 결국 CA까지 해야한다.

설정 예시

cluster.name: es-cluster

node.name: node-1
node.attr.es: hot

#path.data: /path/to/data
#path.logs: /path/to/logs
#bootstrap.memory_lock: true

network.host: 0.0.0.0
#network.publish_host: 172.18.0.2

#http.port: 9200
#transport.port: 9300
#transport.publish_port: 9301

discovery.seed_hosts: ["es-1", "es-2", "es-3"]
cluster.initial_master_nodes: ["node-1", "node-2", "node-3"]

xpack.security.enabled: true

xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  key: /home/elastic/elasticsearch/config/cert/es-cluster.key
  certificate: /home/elastic/elasticsearch/config/cert/es-cluster.crt
  certificate_authorities: ["/home/elastic/elasticsearch/config/cert/ca.crt"]

#xpack.security.http.ssl:
#  enabled: true
#  key: /home/elastic/elasticsearch/config/cert/es-cluster.key
#  certificate: /home/elastic/elasticsearch/config/cert/es-cluster.crt
#  certificate_authorities: ["/home/elastic/elasticsearch/config/cert/ca.crt"]
#  verification_mode: certificate