Elastic Stack (ELK Stack) 6.5.1 启用 X-Pack

开启X-Pack

# 新版Elastic Stack整合了X-pack，无需单独安装。
echo "xpack.security.enabled: true" >>/etc/elasticsearch/elasticsearch.yml
service elasticsearch restart

设置各类应用密码

/usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive
# elastic 用户为超级管理员

为logstash输出到elasticsearch配置密码

output{
  if [type] == "sit" or [type] == "pro" or [type] == "uat" or [type] == "ptsit" {
    elasticsearch {
      hosts => "localhost:9200"
      user => "elastic"
      password => "kibana"
      document_type => "doc"
      index => "gameclient-%{+YYYY.MM.dd}"
    }
  }
}

各类监控应用状态使用的账号密码配置

kibana

vi /etc/kibana/kibana.yml
elasticsearch.username: "kibana"
elasticsearch.password: "kibana"
# 控制web页面使用的功能：
xpack.apm.enabled: false            设置为false禁用X-Pack性能管理功能。
xpack.graph.enabled: false          设置为false禁用X-Pack图形功能。
xpack.ml.enabled: false             设置为false禁用X-Pack机器学习功能。
xpack.monitoring.enabled: false     设置为false禁用X-Pack监视功能。
xpack.reporting.enabled: false      设置为false禁用X-Pack报告功能。
# xpack.security.enabled: false       设置为false禁用X-Pack安全功能。（引起报错）
xpack.watcher.enabled: false        设置false为禁用观察器。
# https://www.elastic.co/guide/en/kibana/current/settings-xpack-kb.html

logstash

vi /etc/logstash/logstash.yml
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: logstash_system
xpack.monitoring.elasticsearch.password: kibana
xpack.monitoring.elasticsearch.url: ["http://localhost:9200"]

filebeat

vi /etc/filebeat/filebeat.yml
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: beats_system
xpack.monitoring.elasticsearch.password: kibana
xpack.monitoring.elasticsearch.hosts: ["http://localhost:9200"]