# ======================== Elasticsearch Configuration =========================

#

# NOTE: Elasticsearch comes with reasonable defaults for most settings.

#       Before you set out to tweak and tune the configuration, make sure you

#       understand what are you trying to accomplish and the consequences.

#

# The primary way of configuring a node is via this file. This template lists

# the most important settings you may want to configure for a production cluster.

#

# Please see the documentation for further information on configuration options:

# <http://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration.html>

#

# ---------------------------------- Cluster -----------------------------------

#

# Use a descriptive name for your cluster:

#

  cluster.name: 你的集群名称

#

# ------------------------------------ Node ------------------------------------

#

# Use a descriptive name for the node:

#

# node.name: node-1

#

# Add custom attributes to the node:

#

# node.rack: r1

#

# ----------------------------------- Paths ------------------------------------

#

# Path to directory where to store the data (separate multiple locations by comma):

#

# path.data: /path/to/data

#

# Path to log files:

#

# path.logs: /path/to/logs

#

# ----------------------------------- Memory -----------------------------------

#

# Lock the memory on startup:

#

# bootstrap.memory_lock: true

#

# Make sure that the `ES_HEAP_SIZE` environment variable is set to about half the memory

# available on the system and that the owner of the process is allowed to use this limit.

#

# Elasticsearch performs poorly when the system is swapping the memory.

#

# ---------------------------------- Network -----------------------------------

#

# Set the bind address to a specific IP (IPv4 or IPv6):

#

  network.host: 0.0.0.0

#

# Set a custom port for HTTP:

#

# http.port: 9200

#

# For more information, see the documentation at:

# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html>

#

# --------------------------------- Discovery ----------------------------------

#

# Pass an initial list of hosts to perform discovery when new node is started:

# The default list of hosts is ["127.0.0.1", "[::1]"]

#

# discovery.zen.ping.unicast.hosts: ["host1", "host2"]

#

# Prevent the "split brain" by configuring the majority of nodes (total number of nodes / 2 + 1):

#

# discovery.zen.minimum_master_nodes: 3

#

# For more information, see the documentation at:

# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-discovery.html>

#

# ---------------------------------- Gateway -----------------------------------

#

# Block initial recovery after a full cluster restart until N nodes are started:

#

# gateway.recover_after_nodes: 3

#

# For more information, see the documentation at:

# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-gateway.html>

#

# ---------------------------------- Various -----------------------------------

#

# Disable starting multiple nodes on a single system:

#

# node.max_local_storage_nodes: 1

#

# Require explicit names when deleting indices:

#

# action.destructive_requires_name: true

[2017-01-24 10:02:49,627][INFO ][node                     ] [Ariel] version[2.4.3], pid[23274], build[d38a34e/2016-12-07T16:28:56Z]

[2017-01-24 10:02:49,628][INFO ][node                     ] [Ariel] initializing ...

[2017-01-24 10:02:50,259][INFO ][plugins                  ] [Ariel] modules [reindex, lang-expression, lang-groovy], plugins [], sites []

[2017-01-24 10:02:50,279][INFO ][env                      ] [Ariel] using [1] data paths, mounts [[/ (overlay)]], net usable_space [75.3gb], net total_space [113.9gb], spins? [possibly], types [overlay]

[2017-01-24 10:02:50,279][INFO ][env                      ] [Ariel] heap size [990.7mb], compressed ordinary object pointers [true]

[2017-01-24 10:02:52,051][INFO ][node                     ] [Ariel] initialized

[2017-01-24 10:02:52,051][INFO ][node                     ] [Ariel] starting ...

[2017-01-24 10:02:52,110][INFO ][transport                ] [Ariel] publish_address {127.0.0.1:9300}, bound_addresses {[::1]:9300}, {127.0.0.1:9300}

[2017-01-24 10:02:52,116][INFO ][discovery                ] [Ariel] elasticsearch/MI21JVBWSbKfj9nC1V6N9w

[2017-01-24 10:02:55,166][INFO ][cluster.service          ] [Ariel] new_master {Ariel}{MI21JVBWSbKfj9nC1V6N9w}{127.0.0.1}{127.0.0.1:9300}, reason: zen-disco-join(elected_as_master, [0] joins received)

[2017-01-24 10:02:55,197][INFO ][http                     ] [Ariel] publish_address {127.0.0.1:9200}, bound_addresses {[::1]:9200}, {127.0.0.1:9200}

[2017-01-24 10:02:55,197][INFO ][node                     ] [Ariel] started

index:

      analysis:

        analyzer:

          ik:

              alias: [ik_analyzer]

              type: org.elasticsearch.index.analysis.IkAnalyzerProvider

          ik_max_word:

              type: ik

              use_smart: false

          ik_smart:

              type: ik

              use_smart: true

index.analysis.analyzer.ik.type : “ik”

gen_client_node_cert.sh 创建客户端证书

gen_node_cert.sh        创建节点证书

gen_root_ca.sh          创建根证书

#!/bin/bash

set -e

./clean.sh

./gen_root_ca.sh password password

./gen_node_cert.sh 0 password  password

./gen_node_cert.sh 1 password  password

./gen_client_node_cert.sh admin password password

cp truststore.jks node-0-keystore.jks /usr/local/elasticsearch-2.4.3/config/

cp truststore.jks admin-keystore.jks /usr/local/elasticsearch-2.4.3/plugins/search-guard-2/sgconfig/

#############################################################################################

#                                     SEARCH GUARD                                          #

#                                     Configuration                                         #

#############################################################################################

  security.manager.enabled: false

  searchguard.authcz.admin_dn:

   - "CN=admin, OU=client, O=client, L=Test, C=DE"

#############################################################################################

#                                     SEARCH GUARD SSL                                      #

#                                       Configuration                                       #

#############################################################################################

#############################################################################################

# Transport layer SSL                                                                       #

#                                                                                           #

#############################################################################################

# Enable or disable node-to-node ssl encryption (default: true)

# searchguard.ssl.transport.enabled: true

# JKS or PKCS12 (default: JKS)

#searchguard.ssl.transport.keystore_type: PKCS12

# Relative path to the keystore file (mandatory, this stores the server certificates), must be placed under the config/ dir

  searchguard.ssl.transport.keystore_filepath: node-0-keystore.jks

# Alias name (default: first alias which could be found)

#searchguard.ssl.transport.keystore_alias: my_alias

# Keystore password (default: changeit)

  searchguard.ssl.transport.keystore_password: password

# JKS or PKCS12 (default: JKS)

#searchguard.ssl.transport.truststore_type: PKCS12

# Relative path to the truststore file (mandatory, this stores the client/root certificates), must be placed under the config/ dir

  searchguard.ssl.transport.truststore_filepath: truststore.jks

# Alias name (default: first alias which could be found)

#searchguard.ssl.transport.truststore_alias: my_alias

# Truststore password (default: changeit)

  searchguard.ssl.transport.truststore_password: password

# Enforce hostname verification (default: true)

# searchguard.ssl.transport.enforce_hostname_verification: true

# If hostname verification specify if hostname should be resolved (default: true)

# searchguard.ssl.transport.resolve_hostname: true

# Use native Open SSL instead of JDK SSL if available (default: true)

# searchguard.ssl.transport.enable_openssl_if_available: false