【es】es 通过curl 命令行工具进行用户管理

1.es通过crul命令进行用户管理

30.查看数据库的节点信息
curl -u elastic:elastic -k  https://192.168.1.1:9200/_cat/nodes
192.168.1.1 55 70 19 1.10 5.38 5.34 cdfhimrstw  * node-1
192.168.1.1 37 97  0 0.09 0.05 0.01 cdfhilmrstw - node-2
31.查看分片信息

[es@192.168.1.1 config]$ 
curl -u elastic:elastic -k  http://192.168.1.1:9200/_cat/shards
pro_003.v1.0                0 p STARTED  1  6.8kb 192.168.1.1 node-2
.security-7                  0 p STARTED 12 27.5kb 192.168.1.1 node-1
.security-7                  0 r STARTED 12 27.5kb 192.168.1.1 node-2
test_001                   0 p STARTED  1  6.8kb 192.168.1.1 node-1
test_001                    0 r STARTED  1  6.8kb 192.168.1.1 node-2
.ds-.logs-deprecation.elasticsearch-default-2025.03.05-000001 0 r STARTED           192.168.1.1 node-1
.ds-.logs-deprecation.elasticsearch-default-2025.03.05-000001 0 p STARTED           192.168.1.1 node-2
.ds-ilm-history-5-2025.03.05-000001 0 p STARTED           192.168.1.1 node-1
.ds-ilm-history-5-2025.03.05-000001 0 r STARTED           192.168.1.1 node-2
pro_002                                                       0 p STARTED  2 13.4kb 192.168.1.1 node-1
32.ES监控用户需要具备的角色
kibana->stack_management-->安全-->用户。
(1)创建监控用户
自定义用户。
es_monitor/es_monitor
(2)角色。
remote_monitoring_agent,remote_monitoring_collector;
33.修改用户密码
修改用户的密码。
curl -X POST "http://192.168.1.1:9200/_security/user/pro_rw/_password" -H "Content-Type: application/json" -d '{
  "password" : "pro#123"
}' -u elastic:elastic
{}

34.查看用户角色
[root@192.168.1.1 ~]# 查看用户和角色信息
curl -u elastic:elastic -k -X GET http://192.168.1.1:9200/_security/user?pretty
{
  "elastic" : {
    "username" : "elastic",
    "roles" : [
      "superuser"
    ],
    "full_name" : null,
    "email" : null,
    "metadata" : {
      "_reserved" : true
    },
    "enabled" : true
  },
  "kibana" : {
    "username" : "kibana",
    "roles" : [
      "kibana_system"
    ],
    "full_name" : null,
    "email" : null,
    "metadata" : {
      "_deprecated" : true,
      "_deprecated_reason" : "Please use the [kibana_system] user instead.",
      "_reserved" : true
    },
    "enabled" : true
  },
  "kibana_system" : {
    "username" : "kibana_system",
    "roles" : [
      "kibana_system"
    ],
    "full_name" : null,
    "email" : null,
    "metadata" : {
      "_reserved" : true
    },
    "enabled" : true
  },
  "logstash_system" : {
    "username" : "logstash_system",
    "roles" : [
      "logstash_system"
    ],
    "full_name" : null,
    "email" : null,
    "metadata" : {
      "_reserved" : true
    },
    "enabled" : true
  },
  "beats_system" : {
    "username" : "beats_system",
    "roles" : [
      "beats_system"
    ],
    "full_name" : null,
    "email" : null,
    "metadata" : {
      "_reserved" : true
    },
    "enabled" : true
  },
  "apm_system" : {
    "username" : "apm_system",
    "roles" : [
      "apm_system"
    ],
    "full_name" : null,
    "email" : null,
    "metadata" : {
      "_reserved" : true
    },
    "enabled" : true
  },
  "remote_monitoring_user" : {
    "username" : "remote_monitoring_user",
    "roles" : [
      "remote_monitoring_collector",
      "remote_monitoring_agent"
    ],
    "full_name" : null,
    "email" : null,
    "metadata" : {
      "_reserved" : true
    },
    "enabled" : true
  },
  "readonly_user" : {
    "username" : "readonly_user",
    "roles" : [
      "reader"
    ],
    "full_name" : "read_xsq",
    "email" : null,
    "metadata" : { },
    "enabled" : true
  },
  "read_xsq" : {
    "username" : "read_xsq",
    "roles" : [
      "read_only"
    ],
    "full_name" : null,
    "email" : null,
    "metadata" : { },
    "enabled" : true
  },
  "pro_rw" : {
    "username" : "pro_rw",
    "roles" : [
      "pro_rw"
    ],
    "full_name" : null,
    "email" : null,
    "metadata" : { },
    "enabled" : true
  }
}
35.查看单个用户信息
curl -X GET "192.168.1.1:9200/_security/user/pro_rw" -u elastic:elastic
{"pro_rw":{"username":"pro_rw","roles":["pro_rw"],"full_name":null,"email":null,"metadata":{},"enabled":true}}
36.ealsticsearch_exporter的启动命令
./elasticsearch_exporter --es.all \
 --es.indices --es.cluster_settings --es.indices_settings --es.shards \
 --es.ssl-skip-verify --es.timeout=10s \
 --es.uri=https://elastic:elastic@192.168.1.1:9201
37.ES的后台启动命令
/opt/elasticsearch-7.17.0/bin/elasticsearch -d >/dev/null 2>&1
23.ES为什么在重置密码时失败?
1).设置认证证书
./elasticsearch-certutil ca
./elasticsearch-certutil cert --ca elastic-stack-ca.p12
2).https模式启动ES（初始化）;
vim elasticsearch.yml 
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.client_authentication: required
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
xpack.security.audit.enabled: true
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: elastic-certificates.p12
xpack.security.http.ssl.truststore.path: elastic-certificates.p12

3).注释如下三个参数并重启ES
vim elasticsearch.yml  
#xpack.security.http.ssl.enabled: true
#xpack.security.http.ssl.keystore.path: elastic-certificates.p12
#xpack.security.http.ssl.truststore.path: elastic-certificates.p12

4).设置密码
elasticsearch-setup-passwords interactive

5).取消注释如下三个参数并重启。
vim elasticsearch.yml  
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: elastic-certificates.p12
xpack.security.http.ssl.truststore.path: elastic-certificates.p12

重启:
kill $(ps -ef | grep elasticsearch | grep java |grep -v yace | awk '{print $2}')
elasticsearch -d