摘要：安装适合 M1 芯片的 elasticsearch、kibana、logstash，优化内存占用并设定访问密码。
安装 elasticsearch#
使用 brew 安装适用 M1 芯片的 elasticsearch
# brew tap elastic/tap
brew install elastic/tap/elasticsearch-full
安装成功后显示使用帮助：
# 安装日志
==> Installing elasticsearch-full from elastic/tap
Warning: Tried to install empty array to /opt/homebrew/etc/elasticsearch/jvm.options.d
==> codesign -f -s - /opt/homebrew/Cellar/elasticsearch-full/7.17.1/libexec/modules/x-pack
==> find /opt/homebrew/Cellar/elasticsearch-full/7.17.1/libexec/jdk.app/Contents/Home/bin
==> Caveats
# 相关安装文件位置
Data: /opt/homebrew/var/lib/elasticsearch/elasticsearch_zhangminglei/
Logs: /opt/homebrew/var/log/elasticsearch/elasticsearch_zhangminglei.log
Plugins: /opt/homebrew/var/elasticsearch/plugins/
Config: /opt/homebrew/etc/elasticsearch/
# 后台运行，并开机自动启动
brew services start elastic/tap/elasticsearch-full
# 在当前命令行运行，终端关闭后服务关闭
elasticsearch
启动后台服务：
brew services start elastic/tap/elasticsearch-full
运行后验证，使用浏览器访问：http://localhost:9200/ ，出现以下响应内容：
// 20220315232052
// http://localhost:9200/
{
"name": "LegalgesMacBook.lan",
"cluster_name": "elasticsearch_zhangminglei",
"cluster_uuid": "fB4xhSO1TrO0yh1I4h7qaw",
"version": {
"number": "7.17.1",
"build_flavor": "default",
"build_type": "tar",
"build_hash": "e5acb99f822233d62d6444ce45a4543dc1c8059a",
"build_date": "2022-02-23T22:20:54.153567231Z",
"build_snapshot": false,
"lucene_version": "8.11.1",
"minimum_wire_compatibility_version": "6.8.0",
"minimum_index_compatibility_version": "6.0.0-beta1"
},
"tagline": "You Know, for Search"
}
安装 kibana#
使用 brew 安装适用 M1 芯片的 kibana
# brew tap elastic/tap
brew install elastic/tap/kibana-full
安装成功后提示：
# 安装过程日志
==> Installing kibana-full from elastic/tap
==> Caveats
Config: /opt/homebrew/etc/kibana/
If you wish to preserve your plugins upon upgrade, make a copy of
/opt/homebrew/opt/kibana-full/plugins before upgrading, and copy it into the
new keg location after upgrading.
# 后台运行，并开机自动启动
To start elastic/tap/kibana-full now and restart at login:
brew services start elastic/tap/kibana-full
# 在当前命令行运行，终端关闭后服务关闭
Or, if you don't want/need a background service you can just run:
kibana
# 安装结果摘要
==> Summary
🍺 /opt/homebrew/Cellar/kibana-full/7.17.1: 51,438 files, 720MB, built in 30 seconds
==> Running `brew cleanup kibana-full`...
Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP.
Hide these hints with HOMEBREW_NO_ENV_HINTS (see `man brew`).
启动后台服务：
brew services start elastic/tap/kibana-full
浏览器访问 http://localhost:5601/ ，查看运行界面情况，将系统界面修改为中文：
# 切换到配置文件目录
cd /opt/homebrew/etc/kibana/
# 编辑配置文件
nano kibana.yml
# 将最后一行修改为：
i18n.locale: "zh-CN"
重启 brew 服务：
brew services restart elastic/tap/kibana-full
调整系统内存占用#
ES 服务默认会占用系统一半以上的内存，可以通过修改配置文件，进行限制：
所需修改文件在服务配置路径当中：/opt/homebrew/etc/elasticsearch/
所需修改文件：jvm.options
修改前：
## jvm.options.d directory containing these lines:
##
## -Xms4g
## -Xmx4g
##
修改后：
## jvm.options.d directory containing these lines:
##
-Xms4g
-Xmx4g
##
重启 ES 服务，即可在系统的【活动监视器】看到 java 内存占用已经受限:
brew services restart elastic/tap/elasticsearch-full
设置密码保护#
注：可参考官方文档：https://www.elastic.co/guide/en/elasticsearch/reference/7.17/security-minimal-setup.html
-
step1：关闭运行中的 elasticsearch、kibana 2 项服务
-
step2：修改 elasticsearch.yml 文件，启用密码保护，设置为单节点
# 进入配置文件夹
/opt/homebrew/etc/elasticsearch/
# 编辑配置文件
elasticsearch.yml
# 文件末尾追加以下2行内容：
xpack.security.enabled: true
discovery.type: single-node
- step3: 利用 elasticsearch 内置工具自动生成账号、密码
#1 启动 elasticsearch 服务：
brew services start elastic/tap/elasticsearch-full
#2 进入es可执行文件目录：
/opt/homebrew/Cellar/elasticsearch-full/7.17.1/bin
#3 在以上目录打开终端，执行自动生成密码命令：
./elasticsearch-setup-passwords auto
#4 记录下控制台输出的账号密码内容，后面会用到
生成的账号密码示例：
Changed password for user kibana_system
PASSWORD kibana_system = n9zXw2UnJwvWdrJ4ZPcg
Changed password for user elastic
PASSWORD elastic = Lhder7yQVB8z3rzdFoKY
- step4: 将以上自动生成的账号密码配置到 Kibana ，使其可以访问 es
#1 进入 Kibana 配置文件目录：
/opt/homebrew/etc/kibana/
#2 修改 Kibana 配置文件，追加内容:
elasticsearch.username: "kibana_system"
#3 进入 Kibana 可执行文件目录：
/opt/homebrew/Cellar/kibana-full/7.17.1/bin
#4 在以上目录打开终端，依次执行：
./kibana-keystore create
./kibana-keystore add elasticsearch.password
输入以上生成的 kibana_system 密码
#5 重启 Kibana 服务：
brew services start elastic/tap/kibana-full
- step5: 使用以上自动生成的 elastic 账号密码登录 kibana
地址： http://localhost:5601/
账号： elastic
密码： Lhder8yQVB8z3rzdFoKY
*可在 kibana 当中修改密码
安装 logstash#
使用 brew 安装适用 M1 芯片的 logstash:
# brew tap elastic/tap
brew install elastic/tap/logstash-full
安装成功日志：
Please read the getting started guide located at:
https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html
To start elastic/tap/logstash-full now and restart at login:
brew services start elastic/tap/logstash-full
Or, if you don't want/need a background service you can just run:
logstash
==> Summary
🍺 /opt/homebrew/Cellar/logstash-full/7.17.1: 14,003 files, 604.8MB, built in 13 seconds
==> Running `brew cleanup logstash-full`...
Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP.
在 logstash.yml 中配置用户名和密码:
路径：/opt/homebrew/etc/logstash
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: logstash_system
xpack.monitoring.elasticsearch.password: *****
xpack.monitoring.elasticsearch.hosts: ["http://127.0.0.1:9200"]
启动服务：
brew services start elastic/tap/logstash-full
验证安装成功：
# 进入logstash目录
cd /opt/homebrew/Cellar/logstash-full/7.17.1/bin
# 执行如下命令,等待输入光标出现
bin/logstash -e 'input { stdin { } } output { stdout { } }'
# 输入hello后系统的反馈：
{
"@version" => "1",
"message" => "hello",
"@timestamp" => 2022-05-29T06:28:37.021Z,
"host" => "izwz9cte3psk7ixd8kospzz"
}
创建并使用管道配置文件：
一个 Logstash 管理通常有一个或多个 input, filter 和 output 插件，例如：
//hello.conf
input { stdin { } }
output {
elasticsearch {
hosts => "http://127.0.0.1:9200"
index => "logs"
user => "elastic"
password => "************"
}
stdout {}
}
使用管道：
# 执行
logstash -f hello.conf
# 输入：
hello world
# 反馈：
{
"host" => "Legalgeeks-MacBook.local",
"@timestamp" => 2022-03-20T05:50:48.988Z,
"@version" => "1",
"message" => "hello world"
}