Kibana

Kibana 是 Elasticsearch 的可视化界面，部署后可以通过 Web UI 查看日志、数据趋势、创建仪表盘等。

一、部署 Kibana

1. 添加 Elastic 官方源

cat > /etc/yum.repos.d/elastic.repo <<EOF
[elastic-8.x]
name=Elastic repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

2. 安装 Kibana

sudo yum install kibana -y

二、配置kibana连接ES集群

1、修改kibana的配置文件

[root@elk103.com elasticsearch-7.17.5]# vim /etc/kibana/kibana.yml 
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://192.168.200.201.101:9200","http://192.168.200.202:9200","http://192.168.200.203:9200"]
# 如果 Elasticsearch 启用了用户名密码
elasticsearch.username: "kibana_system"
elasticsearch.password: "VxFV4WjsHyxsA3CH2LQT"
i18n.locale: "zh-CN"
[root@elk103.com elasticsearch-7.17.5]# 

2、重启kibana

[root@elk103.com elasticsearch-7.17.5]# systemctl restart kibana

使用elastic用户登录并修改密码

三、启动 Kibana

sudo systemctl start kibana
sudo systemctl enable kibana

sudo systemctl status kibana

四、访问 Kibana Web 界面

登录信息：

• 用户名：elastic

• 密码：安装 Elasticsearch 时生成的密码

• 如果忘了密码，可以重新设置（ES 8+）：

  ./bin/elasticsearch-reset-password -u elastic

五、常见问题排查

问题	可能原因
Kibana Server is not ready yet	Kibana 未连上 Elasticsearch，或 ES 未启动
浏览器无法访问 5601 端口	防火墙未放行：执行 firewall-cmd --add-port=5601/tcp --permanent && firewall-cmd --reload
登录界面报错认证失败	Elasticsearch 开启了认证但 Kibana 配置文件中用户名密码未设置或错误

六、其他配置

1、配置ES集群TSL认证:

1生成自签证书（使用 elasticsearch 自带工具）

cd /usr/share/elasticsearch
sudo bin/elasticsearch-certutil cert --ca

生成 .p12 或 .crt 证书文件。

2修改 Elasticsearch 配置文件

# /etc/elasticsearch/elasticsearch.yml

# 开启 HTTP TLS
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.key: /etc/elasticsearch/certs/node.key
xpack.security.http.ssl.certificate: /etc/elasticsearch/certs/node.crt
xpack.security.http.ssl.certificate_authorities: [ "/etc/elasticsearch/certs/ca.crt" ]

# 节点间加密
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.key: /etc/elasticsearch/certs/node.key
xpack.security.transport.ssl.certificate: /etc/elasticsearch/certs/node.crt
xpack.security.transport.ssl.certificate_authorities: [ "/etc/elasticsearch/certs/ca.crt" ]

3修改 Kibana 配置文件 /etc/kibana/kibana.yml

elasticsearch.hosts: ["https://你的ip:9200"]
elasticsearch.username: "elastic"
elasticsearch.password: "你的密码"

# 信任 ES 证书
elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/certs/ca.crt"]
elasticsearch.ssl.verificationMode: full

####有待补充。。。。