ELK - Using “elasticsearch.username: elastic“ is deprecated

本文介绍如何在Elasticsearch中创建并使用服务账号Token来替代传统的用户名密码认证方式,包括通过API创建Token的过程及如何在Kibana中进行配置。

新建一个elastic/kibana token: mytoken

POST /_security/service/elastic/kibana/credential/token/mytoken

运行以上命令之后,记得把token记录下来,否则根本就找不回来(GET /_security/service),至少7.17如此。

试一下用token登陆。

curl -H "Authorization: Bearer <token>" http://localhost:9200/_security/_authenticate

测试没问题之后把Kibana里的ES用户名密码替换为serviceAccountToken重启就好。

vi /etc/kibana/kibana.yml
#elasticsearch.username: "elastic"
#elasticsearch.password: "******"
elasticsearch.serviceAccountToken: "<token>"

systemctl restart kibana

记录一下,主要还是因为踩了坑。
一开始用elasticsearch-service-tokens CLI tool,并不成功。

[root@localhost elasticsearch-7.17.0]# ./bin/elasticsearch warning: usage of JAVA_HOME is deprecated, use ES_JAVA_HOME warning: usage of JAVA_HOME is deprecated, use ES_JAVA_HOME [2025-05-30T10:48:11,359][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [localhost.localdomain] uncaught exception in thread [main] org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.17.0.jar:7.17.0] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:157) ~[elasticsearch-7.17.0.jar:7.17.0] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:77) ~[elasticsearch-7.17.0.jar:7.17.0] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112) ~[elasticsearch-cli-7.17.0.jar:7.17.0] at org.elasticsearch.cli.Command.main(Command.java:77) ~[elasticsearch-cli-7.17.0.jar:7.17.0] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:122) ~[elasticsearch-7.17.0.jar:7.17.0] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:80) ~[elasticsearch-7.17.0.jar:7.17.0] Caused by: java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:107) ~[elasticsearch-7.17.0.jar:7.17.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:183) ~[elasticsearch-7.17.0.jar:7.17.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:434) ~[elasticsearch-7.17.0.jar:7.17.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:166) ~[elasticsearch-7.17.0.jar:7.17.0] ... 6 more uncaught exception in thread [main] java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:107) at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:183) at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:434) at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:166) at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:157) at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:77) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112) at org.elasticsearch.cli.Command.main(Command.java:77) at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:122) at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:80) For complete error details, refer to the log at /root/elasticsearch-7.17.0/logs/elasticsearch.log 2025-05-30 02:48:11,706744 UTC [711689] INFO Main.cc@111 Parent process died - ML controller exiting 排查问题并给出详细解决办法步骤
05-31
./bin/elasticsearch warning: usage of JAVA_HOME is deprecated, use ES_JAVA_HOME warning: usage of JAVA_HOME is deprecated, use ES_JAVA_HOME [2025-05-30T10:09:39,771][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [localhost.localdomain] uncaught exception in thread [main] org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:173) ~[elasticsearch-7.17.24.jar:7.17.24] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:160) ~[elasticsearch-7.17.24.jar:7.17.24] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:77) ~[elasticsearch-7.17.24.jar:7.17.24] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112) ~[elasticsearch-cli-7.17.24.jar:7.17.24] at org.elasticsearch.cli.Command.main(Command.java:77) ~[elasticsearch-cli-7.17.24.jar:7.17.24] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:125) ~[elasticsearch-7.17.24.jar:7.17.24] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:80) ~[elasticsearch-7.17.24.jar:7.17.24] Caused by: java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:107) ~[elasticsearch-7.17.24.jar:7.17.24] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:183) ~[elasticsearch-7.17.24.jar:7.17.24] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:434) ~[elasticsearch-7.17.24.jar:7.17.24] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:169) ~[elasticsearch-7.17.24.jar:7.17.24] ... 6 more uncaught exception in thread [main] java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:107) at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:183) at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:434) at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:169) at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:160) at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:77) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112) at org.elasticsearch.cli.Command.main(Command.java:77) at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:125) at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:80) For complete error details, refer to the log at /root/elasticsearch-7.17.24/logs/elasticsearch.log 排查并给出解决方法
05-31
[root@localhost snort-2.9.20]# ps aux --sort=-%mem | head -n 11 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND elastic+ 77086 2.8 45.3 5926628 1749404 ? Ssl 13:12 2:50 /usr/share/elasticsearch/jdk/bin/java -Xshare:auto -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -XX:+ShowCodeDetailsInExceptionMessages -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Dlog4j2.formatMsgNoLookups=true -Djava.locale.providers=SPI,COMPAT --add-opens=java.base/java.io=ALL-UNNAMED -Djava.security.manager=allow -XX:+UseG1GC -Djava.io.tmpdir=/tmp/elasticsearch-7622450778843719240 -XX:+HeapDumpOnOutOfMemoryError -XX:+ExitOnOutOfMemoryError -XX:HeapDumpPath=/var/lib/elasticsearch -XX:ErrorFile=/var/log/elasticsearch/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/elasticsearch/gc.log:utctime,pid,tags:filecount=32,filesize=64m -XX:+UnlockDiagnosticVMOptions -XX:G1NumCollectionsKeepPinned=10000000 -Xms1885m -Xmx1885m -XX:MaxDirectMemorySize=988807168 -XX:G1HeapRegionSize=4m -XX:InitiatingHeapOccupancyPercent=30 -XX:G1ReservePercent=15 -Des.path.home=/usr/share/elasticsearch -Des.path.conf=/etc/elasticsearch -Des.distribution.flavor=default -Des.distribution.type=rpm -Des.bundled_jdk=true -cp /usr/share/elasticsearch/lib/* org.elasticsearch.bootstrap.Elasticsearch -p /var/run/elasticsearch/elasticsearch.pid --quiet logstash 78580 1.6 19.4 4889740 751868 ? SNsl 13:29 1:23 /usr/share/logstash/jdk/bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djdk.io.File.enableADS=true -Djruby.compile.invokedynamic=true -Djruby.jit.threshold=0 -Djruby.regexp.interruptible=true -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -Dlog4j2.isThreadContextMapInheritable=true -cp /usr/share/logstash/logstash-core/lib/jars/checker-qual-3.37.0.jar:/usr/share/logstash/logstash-core/lib/jars/commons-codec-1.14.jar:/usr/share/logstash/logstash-core/lib/jars/commons-compiler-3.1.0.jar:/usr/share/logstash/logstash-core/lib/jars/commons-logging-1.2.jar:/usr/share/logstash/logstash-core/lib/jars/error_prone_annotations-2.21.1.jar:/usr/share/logstash/logstash-core/lib/jars/failureaccess-1.0.1.jar:/usr/share/logstash/logstash-core/lib/jars/google-java-format-1.1.jar:/usr/share/logstash/logstash-core/lib/jars/guava-32.1.3-jre.jar:/usr/share/logstash/logstash-core/lib/jars/j2objc-annotations-2.8.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-annotations-2.14.1.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-core-2.14.1.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-databind-2.14.1.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-dataformat-cbor-2.14.1.jar:/usr/share/logstash/logstash-core/lib/jars/jackson-dataformat-yaml-2.14.1.jar:/usr/share/logstash/logstash-core/lib/jars/janino-3.1.0.jar:/usr/share/logstash/logstash-core/lib/jars/javassist-3.26.0-GA.jar:/usr/share/logstash/logstash-core/lib/jars/jruby-complete-9.2.20.1.jar:/usr/share/logstash/logstash-core/lib/jars/jsr305-3.0.2.jar:/usr/share/logstash/logstash-core/lib/jars/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-1.2-api-2.17.1.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-api-2.17.1.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-core-2.17.1.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-jcl-2.17.1.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-slf4j-impl-2.17.1.jar:/usr/share/logstash/logstash-core/lib/jars/logstash-core.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.commands-3.6.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.contenttype-3.4.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.expressions-3.4.300.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.filesystem-1.3.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.jobs-3.5.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.resources-3.7.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.core.runtime-3.7.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.app-1.3.100.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.common-3.6.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.preferences-3.4.1.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.equinox.registry-3.5.101.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.jdt.core-3.10.0.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.osgi-3.7.1.jar:/usr/share/logstash/logstash-core/lib/jars/org.eclipse.text-3.5.101.jar:/usr/share/logstash/logstash-core/lib/jars/reflections-0.9.11.jar:/usr/share/logstash/logstash-core/lib/jars/slf4j-api-1.7.30.jar:/usr/share/logstash/logstash-core/lib/jars/snakeyaml-1.33.jar org.logstash.Logstash --path.settings /etc/logstash kibana 87484 3.8 6.1 11977548 235664 ? Rsl 14:45 0:19 /usr/share/kibana/bin/../node/bin/node /usr/share/kibana/bin/../src/cli/dist --logging.dest="/var/log/kibana/kibana.log" --pid.file="/run/kibana/kibana.pid" --deprecation.skip_deprecated_settings[0]="logging.dest" admin 2435 0.6 3.3 3716180 131136 ? Sl 07:12 3:02 /usr/bin/gnome-shell admin 2780 0.0 1.3 1317520 52164 ? Sl 07:12 0:03 /usr/bin/gnome-software --gapplication-service root 1812 0.2 1.1 384988 46096 tty1 Ssl+ 07:12 1:06 /usr/bin/X :0 -background none -noreset -audit 4 -verbose -auth /run/gdm/auth-for-gdm-Ycs6w0/database -seat seat0 -nolisten tcp vt1 admin 3206 0.1 0.3 766860 13744 ? Sl 07:13 0:36 /usr/libexec/gnome-terminal-server admin 2718 0.0 0.2 984720 10380 ? Sl 07:12 0:01 nautilus-desktop --force root 522 0.0 0.2 48724 8236 ? Ss 07:12 0:01 /usr/lib/systemd/systemd-journald geoclue 3057 0.0 0.1 457860 7508 ? Ssl 07:13 0:00 /usr/libexec/geoclue -t 5 检查有哪些不需要的文件占用内存,并删除
05-13
### 三级标题:Docker Compose ELK Stack 网络与版本冲突修复 在使用 `docker-compose.yml` 配置 ELK 栈时,若指定的 `version: '3.8'` 并出现网络错误 `service "logstash" refers to undefined network elk-net`,说明服务中引用了未定义的自定义网络。为确保容器间的通信正常运行,必须在 `networks` 段显式声明所有自定义网络[^1]。 #### 正确配置自定义网络 在 YAML 文件顶部添加如下网络声明: ```yaml networks: elk-net: driver: bridge ``` Logstash、ElasticsearchKibana 的服务配置需统一使用该网络: ```yaml logstash: image: docker.elastic.co/logstash/logstash:7.2.0 networks: - elk-net ports: - "5044:5044" - "9600:9600" depends_on: - elasticsearch ``` --- #### 完整 ELK 栈配置示例(适配 Logstash 7.2.0) 以下是一个适用于 Logstash 7.2.0 的 `docker-compose.yml` 示例片段,确保兼容性与功能性: ```yaml version: '3.8' networks: elk-net: driver: bridge services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:7.2.0 container_name: elasticsearch environment: - discovery.type=single-node ports: - "9200:9200" - "9300:9300" networks: - elk-net logstash: image: docker.elastic.co/logstash/logstash:7.2.0 container_name: logstash ports: - "5044:5044" - "9600:9600" volumes: - ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf depends_on: - elasticsearch networks: - elk-net kibana: image: docker.elastic.co/kibana/kibana:7.2.0 container_name: kibana ports: - "5601:5601" depends_on: - elasticsearch networks: - elk-net ``` --- #### 日志管道无输出问题排查 若 Logstash 启动成功但数据无法写入 Elasticsearch 或控制台无输出,可检查日志确认是否因安全认证失败导致: ``` [security_exception] unable to authenticate user [elastic] for REST request ``` 此错误表明 Logstash 使用的账号权限不足或未正确配置安全凭证。可在 Logstash 输出插件中明确指定用户名和密码: ```ruby output { elasticsearch { hosts => ["http://elasticsearch:9200"] user => "elastic" password => "your_secure_password" } } ``` 此外,确保 Elasticsearch 已关闭安全验证或已正确配置 TLS 加密与用户权限管理[^2]。 --- #### 网络连通性验证 进入 Logstash 容器并测试对 Elasticsearch 的访问能力: ```bash docker exec -it logstash bash curl -v http://elasticsearch:9200 ``` 若返回 `Connection refused`,应进一步检查 Elasticsearch 是否启动成功,并确认其绑定地址是否为 `0.0.0.0` 而非仅限于 `localhost`。 --- #### 版本兼容性建议 Logstash 7.2.0 属于较旧版本,需确保与 ElasticsearchKibana 的版本一致,避免因协议变更或功能弃用导致不可预见的问题。官方推荐使用相同主版本的组件以保证稳定性。对于新部署项目,建议优先考虑更新至 8.x 系列以获得更好的安全性与性能优化。 ---
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
红包 添加红包
表情包 插入表情
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值