搭建spring boot+elasticsearch+activemq服务

目前时间是：2017-01-24

本文不涉及activemq的安装

需求

activemq实时传递数据至服务 elasticsearch做索引 对外开放查询接口 完成全文检索

环境

jdk：1.8

spirng boot：1.4.3.RELEASE

elasticsearch：2.4.3

activemq：5.13.2

ES插件

head：版本好像无太大差别 能查数据就行

analysis-ik：1.10.3

search-guard-2：2.4.3.9

search-guard-ssl：2.4.3.19

注意

作者遇到的最大问题就是版本兼容 网上资料少且版本较低 故列出以下版本矩阵 方便查阅

spring boot与elasticsearch：

Spring Boot Version (x)	Spring Data Elasticsearch Version (y)	Elasticsearch Version (z)
x <= 1.3.5	y <= 1.3.4	z <= 1.7.2*
x >= 1.4.x	2.0.0 <=y < 5.0.0**	2.0.0 <= z < 5.0.0**

矩阵来源以及更多版本兼容：https://github.com/spring-projects/spring-data-elasticsearch

elasticsearch与ik：我的ES版本为2.x 对应如下

IK version	ES version
master	2.4.0 -> master
1.10.3	2.4.3
1.9.5	2.3.5
1.9.4	2.3.4
1.9.3	2.3.3
1.9.0	2.3.0
1.8.1	2.2.1
1.7.0	2.1.1
1.5.0	2.0.0
1.2.6	1.0.0
1.2.5	0.90.x
1.1.3	0.20.x
1.0.0	0.16.2 -> 0.19.0

矩阵来源以及更多版本兼容：https://github.com/medcl/elasticsearch-analysis-ik

elasticsearch与search-guard以及search-guard-ssl：

Elasticsearch Version	Latest Search Guard Version	Search Guard SSL Version	Commercial support available
1.x.y	not available	-	-
2.0.x	not available	-	-
2.1.x	not available	-	-
2.2.0	2.2.0.7	2.2.0.16	Yes
2.3.1	available upon request	-	-
2.3.2	available upon request	-	-
2.3.3	2.3.3.10	2.3.3.19	YES
2.3.4	2.3.4.10	2.3.4.19	YES
2.3.5	2.3.5.10	2.3.5.19	YES
2.4.0	2.4.0.10	2.4.0.19	YES
2.4.1	2.4.1.10	2.4.1.19	YES
2.4.2	2.4.2.10	2.4.2.19	YES
2.4.3	2.4.3.10	2.4.3.19	YES
2.4.4	2.4.4.10	2.4.4.19	YES
5.0.0	5.0.0-10	(comes bundled since SG 5)	YES
5.0.1	5.0.1-10	(comes bundled since SG 5)	YES
5.0.2	5.0.2-10	(comes bundled since SG 5)	YES
5.1.1	5.1.1-10	(comes bundled since SG 5)	YES
5.1.2	5.1.2-10	(comes bundled since SG 5)	YES

矩阵来源以及更多版本兼容：https://github.com/floragunncom/search-guard/wiki

开始

安装elasticsearch

我的安装目录：/usr/local

注意：elasticsearch不能用root用户运行 所以创建你的用户组和用户 切换到新用户再安装 如何创建切换 请自行搜索

wget https://download.elastic.co/elasticsearch/release/org/elasticsearch/distribution/tar/elasticsearch/2.4.3/elasticsearch-2.4.3.tar.gz

tar -zxvf elasticsearch-2.4.3.tar.gz

cd elasticsearch-2.4.3/config/

vim elasticsearch.yml

# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please see the documentation for further information on configuration options:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration.html>
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
  cluster.name: 你的集群名称
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
# node.name: node-1
#
# Add custom attributes to the node:
#
# node.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
# path.data: /path/to/data
#
# Path to log files:
#
# path.logs: /path/to/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
# bootstrap.memory_lock: true
#
# Make sure that the `ES_HEAP_SIZE` environment variable is set to about half the memory
# available on the system and that the owner of the process is allowed to use this limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
  network.host: 0.0.0.0
#
# Set a custom port for HTTP:
#
# http.port: 9200
#
# For more information, see the documentation at:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html>
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
# discovery.zen.ping.unicast.hosts: ["host1", "host2"]
#
# Prevent the "split brain" by configuring the majority of nodes (total number of nodes / 2 + 1):
#
# discovery.zen.minimum_master_nodes: 3
#
# For more information, see the documentation at:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-discovery.html>
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
# gateway.recover_after_nodes: 3
#
# For more information, see the documentation at:
# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-gateway.html>
#
# ---------------------------------- Various -----------------------------------
#
# Disable starting multiple nodes on a single system:
#
# node.max_local_storage_nodes: 1
#
# Require explicit names when deleting indices:
#
# action.destructive_requires_name: true

我修改了两个地方 cluster.name和network.host

cd ../bin/

./elasticsearch

[2017-01-24 10:02:49,627][INFO ][node                     ] [Ariel] version[2.4.3], pid[23274], build[d38a34e/2016-12-07T16:28:56Z]
[2017-01-24 10:02:49,628][INFO ][node                     ] [Ariel] initializing ...
[2017-01-24 10:02:50,259][INFO ][plugins                  ] [Ariel] modules [reindex, lang-expression, lang-groovy], plugins [], sites []
[2017-01-24 10:02:50,279][INFO ][env                      ] [Ariel] using [1] data paths, mounts [[/ (overlay)]], net usable_space [75.3gb], net total_space [113.9gb], spins? [possibly], types [overlay]
[2017-01-24 10:02:50,279][INFO ][env                      ] [Ariel] heap size [990.7mb], compressed ordinary object pointers [true]
[2017-01-24 10:02:52,051][INFO ][node                     ] [Ariel] initialized
[2017-01-24 10:02:52,051][INFO ][node                     ] [Ariel] starting ...
[2017-01-24 10:02:52,110][INFO ][transport                ] [Ariel] publish_address {127.0.0.1:9300}, bound_addresses {[::1]:9300}, {127.0.0.1:9300}
[2017-01-24 10:02:52,116][INFO ][discovery                ] [Ariel] elasticsearch/MI21JVBWSbKfj9nC1V6N9w
[2017-01-24 10:02:55,166][INFO ][cluster.service          ] [Ariel] new_master {Ariel}{MI21JVBWSbKfj9nC1V6N9w}{127.0.0.1}{127.0.0.1:9300}, reason: zen-disco-join(elected_as_master, [0] joins received)
[2017-01-24 10:02:55,197][INFO ][http                     ] [Ariel] publish_address {127.0.0.1:9200}, bound_addresses {[::1]:9200}, {127.0.0.1:9200}
[2017-01-24 10:02:55,197][INFO ][node                     ] [Ariel] started

出现类似这样的信息 说明安装成功

安装head插件

elasticsearch根目录执行

bin/plugin install mobz/elasticsearch-head

注意：2.0以下版本应该是 -install

访问地址：http://ip:9200/_plugin/head/

安装analysis-ik插件

下载地址：https://github.com/medcl/elasticsearch-analysis-ik/tree/v1.10.3

使用maven打包：mvn clean package

生成的zip包在target/releases下

在elasticsearch-2.4.3/plugins下创建ik目录

将zip包放到该目录下并解压 解压出如下文件

编辑elasticsearch-2.4.3/config/elasticsearch.yml配置文件 添加如下内容

index:
      analysis:
        analyzer:
          ik:
              alias: [ik_analyzer]
              type: org.elasticsearch.index.analysis.IkAnalyzerProvider
          ik_max_word:
              type: ik
              use_smart: false
          ik_smart:
              type: ik
              use_smart: true

或者

index.analysis.analyzer.ik.type : “ik”

测试：http://ip:9200/_analyze?analyzer=ik&pretty=true&text=我是中国人

安装searchguard

elasticsearch根目录执行

bin/plugin install -b com.floragunn/search-guard-2/2.4.3.9

bin/plugin install -b com.floragunn/search-guard-ssl/2.4.3.19

下载 searchguard-ssl 的包，里面包含自动创建证书的脚本：

wget https://github.com/floragunncom/search-guard-ssl/archive/v2.4.3.19.zip

unzip v2.4.3.19.zip

cd search-guard-ssl-2.4.3.19/example-pki-scripts/

有三个脚本

gen_client_node_cert.sh 创建客户端证书
gen_node_cert.sh        创建节点证书
gen_root_ca.sh          创建根证书

编辑脚本 vim example.sh

#!/bin/bash
set -e
./clean.sh
./gen_root_ca.sh password password
./gen_node_cert.sh 0 password  password
./gen_node_cert.sh 1 password  password
./gen_client_node_cert.sh admin password password
cp truststore.jks node-0-keystore.jks /usr/local/elasticsearch-2.4.3/config/
cp truststore.jks admin-keystore.jks /usr/local/elasticsearch-2.4.3/plugins/search-guard-2/sgconfig/

./example.sh

可以发现 最后两句就是将证书cp到相应目录

编辑elasticsearch-2.4.3/config/elasticsearch.yml配置文件 添加如下内容

#############################################################################################
#                                     SEARCH GUARD                                          #
#                                     Configuration                                         #
#############################################################################################
  security.manager.enabled: false
  searchguard.authcz.admin_dn:
   - "CN=admin, OU=client, O=client, L=Test, C=DE"

#############################################################################################
#                                     SEARCH GUARD SSL                                      #
#                                       Configuration                                       #
#############################################################################################

#############################################################################################
# Transport layer SSL                                                                       #
#                                                                                           #
#############################################################################################
# Enable or disable node-to-node ssl encryption (default: true)
# searchguard.ssl.transport.enabled: true
# JKS or PKCS12 (default: JKS)
#searchguard.ssl.transport.keystore_type: PKCS12
# Relative path to the keystore file (mandatory, this stores the server certificates), must be placed under the config/ dir
  searchguard.ssl.transport.keystore_filepath: node-0-keystore.jks
# Alias name (default: first alias which could be found)
#searchguard.ssl.transport.keystore_alias: my_alias
# Keystore password (default: changeit)
  searchguard.ssl.transport.keystore_password: password
# JKS or PKCS12 (default: JKS)
#searchguard.ssl.transport.truststore_type: PKCS12
# Relative path to the truststore file (mandatory, this stores the client/root certificates), must be placed under the config/ dir
  searchguard.ssl.transport.truststore_filepath: truststore.jks
# Alias name (default: first alias which could be found)
#searchguard.ssl.transport.truststore_alias: my_alias
# Truststore password (default: changeit)
  searchguard.ssl.transport.truststore_password: password
# Enforce hostname verification (default: true)
# searchguard.ssl.transport.enforce_hostname_verification: true
# If hostname verification specify if hostname should be resolved (default: true)
# searchguard.ssl.transport.resolve_hostname: true
# Use native Open SSL instead of JDK SSL if available (default: true)
# searchguard.ssl.transport.enable_openssl_if_available: false

在elasticsearch根目录 执行命令 将配置插入

./plugins/search-guard-2/tools/sgadmin.sh -cn 集群名称 -h hostname -cd plugins/search-guard-2/sgconfig -ks plugins/search-guard-2/sgconfig/admin-keystore.jks -kspass password -ts plugins/search-guard-2/sgconfig/truststore.jks -tspass password -nhnv

注意：elasticsearch的服务必须是运行状态

elasticsearch-2.4.3/plugins/search-guard-2/sgconfig下的配置文件是管理用户角色的

安装配置成功后 任何客户端访问elasticsearch 需提供用户名及密码

至此服务端安装结束

客户端将以源码方式提供 为公司信息安全着想 仅提供关键性代码供参考 无法运行

elasticsearch download