elasticsearch版本：8.17.4

配置文件：elasticsearch.yml

主要内容：

# Enable security features
xpack.security.enabled: true

xpack.security.enrollment.enabled: true

# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12

# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
# Create a new cluster with the current node only
# Additional nodes can still join the cluster later
cluster.initial_master_nodes: ["my-node"]

# Allow HTTP API connections from anywhere
# Connections are encrypted and require user authentication
http.host: 0.0.0.0

# Allow other nodes to join the cluster from anywhere
# Connections are encrypted and mutually authenticated
#transport.host: 0.0.0.0
# 集群名称（默认：elasticsearch）
cluster.name: my-cluster

# 节点名称（默认随机生成）
node.name: node-1

# 绑定地址（0.0.0.0表示允许所有IP访问）
network.host: 0.0.0.0

# HTTP端口（默认：9200）
http.port: 9200

# 跨域访问配置（如使用Head插件需开启）
http.cors.enabled: true
http.cors.allow-origin: "*"

kibana-8.17.4：

配置文件：kibana.yml

主要配置：

# 配置本机ip，注意只能填写服务器的 IP 地址
server.host: "127.0.0.1"
 
# Kibana is served by a back end server. This setting specifies the port to use.
server.port: 5601
 
# The Kibana server's name.  This is used for display purposes.
server.name: "kibana-server"

elasticsearch.username: "kibana"
elasticsearch.password: "rWtHpciePUfn5pYylpB+"  # 替换为Elasticsearch的密码
elasticsearch.hosts: ["https://localhost:9200"]

#server.ssl.enabled: true
#server.ssl.certificate: certs/kibana.crt
#server.ssl.key: certs/kibana.key
elasticsearch.ssl.certificateAuthorities: certs/http_ca.crt

启动elasticsearch服务：执行elasticsearch.bat

启动kibana服务：kibana.bat

搭建问题：

1，elastic 用户密码重置

dos进入：F:\深圳\elasticsearch\elasticsearch-8.17.4\bin>

执行：elasticsearch-reset-password -u elastic

返回密码重置结果：

Password for the [elastic] user successfully reset.
New value: zo7ULdy*kXItsR*NZviU

执行：elasticsearch-reset-password -u kibana

New value:rWtHpciePUfn5pYylpB+

2，elastic用户不能作为kibana连接elasticsearch的用户

3，elasticsearch启动时调整内存占用：

报错：There is insufficient memory for the Java Runtime Environment to continue.

打开config/jvm.options文件，根据系统内存调整JVM堆大小：
-Xms1g
-Xmx1g
默认是4g，改成1g

4，kibana连接的时候，需要elasticsearch的crt证书：

将elasticsearch的config\certs下的http_ca.crt 拷贝到kibana:bin\certs

elasticsearch.ssl.certificateAuthorities: certs/http_ca.crt

如果路径错了，按文件夹路径对一下就可以了。

elasticsearch启动：

kibana启动：

postman测试：

设置用户密码：

前台登录kibana:

网址：http://127.0.0.1:5601   

用户名密码：elastic/zo7ULdy*kXItsR*NZviU

展示结果：