初始文档

软件or平台使用/ELK笔记.md

@@ -0,0 +1,38 @@
+elastic
++IfGiU_tAw=pXHt1RnES
+
+kibana_system
+A-PajW36E9tJjDnKOdUm
+
+HTTP CA certificate SHA-256 fingerprint:
+c4a63732232b28cdb46435b94d412cc172d5323baf297d323c20d8c837c059dc
+
+```sh
+# 启动elastic容器
+docker run --name es01 --net vlan100 -p 9200:9200 -p 9300:9300 -t docker.elastic.co/elasticsearch/elasticsearch:8.9.0
+# 启动kibana容器
+docker run --name kib01 --net vlan100 -p 5601:5601 docker.elastic.co/kibana/kibana:8.9.0
+
+docker run -h filebeat --name=filebeat --network vlan100 -v /data/docker_data/filebeat:/var/data docker.elastic.co/beats/filebeat:8.9.0 setup -E setup.kibana.host=172.18.0.7:5601 -E output.elasticsearch.hosts=["172.18.0.8:9200"]
+
+# 生成kibana验证码
+docker exec -it kib01 /usr/share/kibana/bin/kibana-verification-code
+
+# 重置es用户密码
+docker exec -it es01 /usr/share/elasticsearch/bin/elasticsearch-reset-password --username kibana_system
+
+# 重新生成elastic注册秘钥
+docker exec -it es01 /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node
+# 加入elastic集群
+docker run -e ENROLLMENT_TOKEN="<token>" --name es02 --net elastic -it docker.elastic.co/elasticsearch/elasticsearch:8.9.0
+
+# 重新生成kibana注册秘钥
+docker exec -it es01 /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
+```
+## elastc容器启动失败
+```sh
+# 设置虚拟内存,临时生效
+sysctl -w vm.max_map_count=262144
+# 永久生效在/etc/sysctl.conf添加
+vm.max_map_count=262144
+```