OOKB - Olaf's Own Knowledge Base

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
===== Install Elasticsearch on Linux =====

Install Debian with basic function, only add SSH server.
Login as root
Modify ''/etc/network/interfaces''

<code>
auto enp8s0
iface enp8s0 inet static
  address 10.0.0.12
  netmask 255.255.0.0
  gateway 10.0.0.1
  dns-nameservers 10.0.0.1
</code>

Set the name of the machine in ''/etc/hostname'' and the IP addresses in ''/etc/hosts''\\
Register it with your DNS server or add it to /etc/hosts on the host system

Update the system
<code bash>
apt update && apt upgrade -y
apt autoremove -y
</code>

Create another user and set the password
<code bash>
useradd kenny
passwd kenny
</code>

Reboot 
<code bash>
reboot now
</code>

Login through ssh
<code bash>
ssh kenny@deb11-elk-01
</code>

Become root
<code bash>
su -
</code>


Install vim, tools for importing the elastic key ring, allow apt to download through https and for mounting SMB (CIFS) shares.
Then get the elastic key ring and add the repository
<code bash>
apt install -y vim gpg apt-transport-https cifs-utils 
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | tee /etc/apt/sources.list.d/elastic-8.x.list
</code>

Now is a good time to shutdown and clone the VM for the other two nodes.\\
Remember that the clones will have the name and IP address of the first node.
Therefore, start one after the other and adjust ''/etc/network/interfaces'', ''/etc/hostname'' and ''/etc/hosts''. Then shut it down.

Start the first node again, login with ssh, change to root and install elasticsearch:
<code bash>
apt update && apt upgrade -y
apt install elasticsearch -y
</code>

<code>
root@deb11-elk-01:~# apt install elasticsearch -y
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  elasticsearch
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 582 MB of archives.
After this operation, 1,195 MB of additional disk space will be used.
Get:1 https://artifacts.elastic.co/packages/8.x/apt stable/main amd64 elasticsearch amd64 8.6.2 [582 MB]
Fetched 582 MB in 53s (11.0 MB/s)                                                                                                                
Selecting previously unselected package elasticsearch.
(Reading database ... 35064 files and directories currently installed.)
Preparing to unpack .../elasticsearch_8.6.2_amd64.deb ...
Creating elasticsearch group... OK
Creating elasticsearch user... OK
Unpacking elasticsearch (8.6.2) ...
Setting up elasticsearch (8.6.2) ...
--------------------------- Security autoconfiguration information ------------------------------

Authentication and authorization are enabled.
TLS for the transport and HTTP layers is enabled and configured.

The generated password for the elastic built-in superuser is : vOzEV_QT*vV-mOuRa-9q

If this node should join an existing cluster, you can reconfigure this with
'/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <token-here>'
after creating an enrollment token on your existing cluster.

You can complete the following actions at any time:

Reset the password of the elastic built-in superuser with 
'/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'.

Generate an enrollment token for Kibana instances with 
 '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'.

Generate an enrollment token for Elasticsearch nodes with 
'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'.

-------------------------------------------------------------------------------------------------
### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd
 sudo systemctl daemon-reload
 sudo systemctl enable elasticsearch.service
### You can start elasticsearch service by executing
 sudo systemctl start elasticsearch.service
</code>

DO NOT START IT YET!!\\

Modify ''/etc/elasticsearch/elasticsearch.yml'':\\
<code yaml>
cluster.name: elastickenny
network.host: 10.68.100.12
cluster.initial_master_nodes: ["deb11-elk-01"]
transport.host: 0.0.0.0
</code>
Start the node (deb11-elk-01), install ES as service and start it:
<code bash>
systemctl daemon-reload
systemctl enable elasticsearch.service
systemctl start elasticsearch.service
</code>

Check if the start was successful with:
<code bash>
systemctl status elasticsearch.service
</code>
Or check ''/var/log/elasticsearch/elastickenny.log''

Congratulations: the first node is running.

Let's add the backup repository. If you are using a Linux share, just specify the location in ''/etc/elasticsearch/elasticsearch.yml'' (see below ).\\
But, I am using a Windows share. Windows is using the SMB (Simple Message Block) protocol.  SMB started as Common Internet File System (CIFS). In Linux the tools required to mount SMB shares are still referring to CIFS: the package is called ''cifs-utils''.\\
I assume the Windows machine has the IP address ''10.0.1.10'' and the share name is ''ES''.

Create a file containing the credentials for the share in the root user directory:
<code bash>
cat > /root/backup.crd
username=kenny
password=kennyspassword
<ctrl-d>
</code>

To mount the share for the snapshot repository with the correct permissions for the elasticsearch user, we need to know the user id (uid) of the elasticsearch user:
''id -u elasticsearch''
''106''

Create the mount directory
<code bash>
mkdir /mnt/backup
</code>

Add the share used for repository in /etc/fstab\\
<code bash>
//10.0.1.10/ES       /mnt/backup     cifs    vers=3.0,credentials=/root/backup.crd,uid=106   0       0
</code>


Mount the share
<code bash>
mount //10.0.0.10/ES
</code>

In ''/etc/elasticsearch/elasticsearch.yml'' add
<code yaml>
path.repo: /mnt/backup/ElasticBackup
</code>
Restart ES:
<code bash>
systemctl restart elasticsearch
</code> 

Note: if the share is not reachable when elasticsearch starts - it will not.


==== Add the other two nodes to the cluster ====

The other two nodes have almost all configuration needed.

On the first node generate a node enrollment token
<code bash>
/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node

eyJ2ZXIiOiI4LjYuMiIsImFkciI6WyIxMC42OC4xMDAuMTI6OTIwMCJdLCJmZ3IiOiI0MzBhMWRiYWFhZGFmMjEzMjBiYzEyZTI5ZWM5NjhlOTNmZWQzMDA4YzgxMGMwYTY3NjMzOGYyZDY5NjE3OTAxIiwia2V5Ijoibm85cnc0WUIwdkRBWFhaMWpZTnA6MnZLbGs3VElTR09RZDRlS1FQV1NGQSJ9
</code>

Start the second VM (deb11-elk-02), logon with SSH and change to be root.\\
Add the mount in ''/etc/fstab'', create the mount point and the credential file and mount the share - like on the first node.\\

Install elasticsearch:
<code bash>
apt update && apt upgrade -y
apt install elasticsearch -y
</code>

Its needed to remove the default configuration:
<code bash>
rm -rf /etc/elasticsearch/certs
rm /etc/elasticsearch/elasticsearch.keystore
</code>

Generate a new /etc/elasticsearch/elasticsearch.yml:
<code yaml>
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: elastickenny
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /var/lib/elasticsearch
#
# Path to log files:
#
path.logs: /var/log/elasticsearch
#
# Path to snapshot repository
#
path.repo: /mnt/backup/ElasticBackup
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# By default Elasticsearch is only accessible on localhost. Set a different
# address here to expose this node on the network:
#
network.host: 10.0.0.13
#
# By default Elasticsearch listens for HTTP traffic on the first free port it
# finds starting at 9200. Set a specific HTTP port here:
#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
#cluster.initial_master_nodes: ["node-1"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# --------------------------------- Readiness ----------------------------------
#
# Enable an unauthenticated TCP readiness endpoint on localhost
#
#readiness.port: 9399
#
# ---------------------------------- Various -----------------------------------
#
# Allow wildcard deletion of indices:
#
#action.destructive_requires_name: false
#
# Allow HTTP API connections from anywhere
# Connections are encrypted and require user authentication
http.host: 0.0.0.0

# Allow other nodes to join the cluster from anywhere
# Connections are encrypted and mutually authenticated
transport.host: 0.0.0.0
</code>

Configure the second node:
<code bash>
/usr/share/elasticsearch/bin/elasticsearch --enrollment-token eyJ2ZXIiOiI4LjYuMiIsImFkciI6WyIxMC42OC4xMDAuMTI6OTIwMCJdLCJmZ3IiOiI0MzBhMWRiYWFhZGFmMjEzMjBiYzEyZTI5ZWM5NjhlOTNmZWQzMDA4YzgxMGMwYTY3NjMzOGYyZDY5NjE3OTAxIiwia2V5Ijoibm85cnc0WUIwdkRBWFhaMWpZTnA6MnZLbGs3VElTR09RZDRlS1FQV1NGQSJ9
</code>

Elasticsearch cannot run as root. Therfore it won't start. However, it configures everything and then complaints about being started as root. We just need to adjust a couple of permissions that were set wrong because we tried to start it as root:

<code bash>
chown -R elasticsearch:elasticsearch /var/log/elasticsearch
chown -R root:elasticsearch /etc/elasticsearch/
</code>

Install ES as service and start it:
<code bash>
systemctl daemon-reload
systemctl enable elasticsearch.service
systemctl start elasticsearch.service
</code>

The installation of the third node works like the second - just chage the IP address for network.host in elasticsearch.yml.

Once the cluster is formed (all nodes are running in the same cluster), \\
adjust discovery.seed_hosts in each nodes elasticsearch.yml:\\

deb11-elk-01:<code yaml>
discovery.seed_hosts: ["10.68.100.13:9300", "10.68.100.14:9300"]</code>
deb11-elk-02:<code yaml>
discovery.seed_hosts: ["10.68.100.12:9300", "10.68.100.14:9300"]</code>
deb11-elk-03:<code yaml>
discovery.seed_hosts: ["10.68.100.12:9300", "10.68.100.13:9300"]</code>

and on deb11-elk-01 comment-out the line:<code yaml>
#cluster.initial_master_nodes: ["deb11-elk-01"]</code>

Next: **[[elastic:kibanaonlinux|Installation on Linux]]**
OOKB - Olaf's Own Knowledge Base

User Tools

Site Tools

Page Tools
