本文不講elk的安裝，只說如何在現有elk環境下新增searchguard功能。

bin/elasticsearch-plugin install -b com.floragunn:search-guard-5:5.5.2-16

線上安裝可能不成功，可以下載離線安裝包安裝
bin/elasticsearch-plugin install -b file:///path/to/search-guard-5-<version>.zip
安裝過程中，提示輸入y/n。按y通過即可
3.安裝完成後，更改elasticsearch.yml（每個節點）
（我們先按官方給的例子做一遍，第二章再將如何定義自己的證書）
停止 Elasticsearch
cd into <Elasticsearch directory>/plugins/search-guard-5/tools

執行./install_demo_configuration.sh, 這個指令碼幫我們在es的配置目錄生成了下面三個檔案：
truststore.jks—the root CA and intermediate/signing CA.
keystore.jks—the node certificate.
kirk.jks—the admin certificate required for running sgadmin
並且在elasticsearch.yml檔案中添加了以下類似內容（下面是我改過的了，先按預設就可以）

searchguard.ssl.transport.keystore_filepath:
 
 CN=node1-keystore.jks
searchguard.ssl.transport.keystore_password: d38bc22059de78ebd105
searchguard.ssl.transport.truststore_filepath: truststore.jks
searchguard.ssl.transport.truststore_password: 62ef1c559f6ba96e4ca1
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.http.enabled:
 
 true
searchguard.ssl.http.keystore_filepath: CN=node1-keystore.jks
searchguard.ssl.http.keystore_password: d38bc22059de78ebd105 
searchguard.ssl.http.truststore_filepath: truststore.jks
searchguard.ssl.http.truststore_password: 62ef1c559f6ba96e4ca1
searchguard.authcz.admin_dn:
  - CN=sgadmin

其實還有兩行是配置叢集name和監聽地址的，因為我們已經配置過了，這裡又給加上了，直接刪掉就可以，否則會啟動失敗
4.初始化sg(es叢集中任意一臺即可)
確保整個叢集是正常的
進入cd <Elasticsearch directory>/plugins/search-guard-5/tools
執行./sgadmin_demo.sh（我們先按官方給的預設配置來做，但是這個檔案中指定的叢集名字跟我們es叢集的名字不一樣，就會報錯）
我們先把 -cn my-application改成自己的叢集名字再執行
看到下面資訊說明初始化成功了

WARNING: JAVA_HOME not set, will use 
/usr/bin/java
Search Guard Admin v5
Will connect to localhost:9300 ... done

### LICENSE NOTICE Search Guard ###

If you use one or more of the following features in production
make sure you have a valid Search Guard license
(See https://floragunn.com/searchguard-validate-license)

* Kibana Multitenancy
* LDAP authentication/authorization
* Active Directory authentication/authorization
* REST Management API
* JSON Web Token (JWT) authentication/authorization
* Kerberos authentication/authorization
* Document- and Fieldlevel Security (DLS/FLS)
* Auditlogging

In case of any doubt mail to <[email protected]>
###################################
Contacting elasticsearch cluster 'elasticsearch' and wait for YELLOW clusterstate ...
Clustername: my-application
Clusterstate: GREEN
Number of nodes: 3
Number of data nodes: 3
searchguard index already exists, so we do not need to create one.
Populate config from /usr/share/elasticsearch/plugins/search-guard-5/sgconfig
Will update 'config' with ../sgconfig/sg_config.yml
   SUCC: Configuration for 'config' created or updated
Will update 'roles' with ../sgconfig/sg_roles.yml
   SUCC: Configuration for 'roles' created or updated
Will update 'rolesmapping' with ../sgconfig/sg_roles_mapping.yml
   SUCC: Configuration for 'rolesmapping' created or updated
Will update 'internalusers' with ../sgconfig/sg_internal_users.yml
   SUCC: Configuration for 'internalusers' created or updated
Will update 'actiongroups' with ../sgconfig/sg_action_groups.yml
   SUCC: Configuration for 'actiongroups' created or updated
Done with success

如果是其他資訊，可能是叢集狀態還沒正常，稍等一會兒看看
5.驗證

Using curl
Execute curl --insecure -u admin:admin 'https://localhost:9200/_searchguard/authinfo?pretty'
This will print out information about the user admin in JSON format on the console.

Using a browser
Open https://<hostname>:9200/_searchguard/authinfo.
Accept the self-signed demo TLS certificate.
In the HTTP Basic Authentication dialogue, use admin as username and admin as password.我
This will print out information about the user admin in JSON format.

6.至此，es中安裝sg就全部完成了，現在es已經不能使用http訪問，必須使用https。使用者的配置資訊放在
/usr/share/elasticsearch/plugins/search-guard-5/sgconfig下
的sg_internal_users.yml中。使用者名稱密碼都在，密碼可以使用tools資料夾下的hash自己加密。更改sgconfig下的檔案，需要重新初始化sg。再次執行5中的命令即可

  cd into your Kibana installaton directory.

執行:

  bin/kibana-plugin install file:///path/to/searchguard-kibana-<version>.zip.

2.配置kibana連線es
如果你安裝了xpack，sg可能更xpack的report功能衝突，這裡直接禁用掉report

xpack.reporting.enabled: false
searchguard.basicauth.enabled: true
searchguard.cookie.secure: false
searchguard.cookie.name: "searchguard_authentication"
searchguard.cookie.password: "searchguard_cookie_default_password"
searchguard.session.keepalive: true

配置使用者名稱，密碼（這裡我們使用自帶的最高許可權連線es）
elasticsearch.username: “admin”
elasticsearch.password: “admin”
配置url：
elasticsearch.url: “https://localhost:9200”
關閉證書驗證：
elasticsearch.ssl.verificationMode: none

3.啟動kinana沒有報錯，說明配置成功，可以在瀏覽器中看到

使用者密碼還是sg_config中的，這裡使用不同使用者，可以訪問的許可權也就不同了。

3.logstash連線es
logstash並不需要安裝sg外掛，只是因為現在es只能使用https訪問，所以logstash output必須使用https連線，這裡也是最麻煩的地方。（還要再說一點，如果你在logstash也安裝了xpack，請在logstash.yml關掉xpack.monitoring.enabled: false）
首先看一下配置：

output {
     elasticsearch {
        user => admin
        password => admin
        ssl => true
        ssl_certificate_verification => true
        truststore => "/etc/logstash/truststore.jks"
        truststore_password => "62ef1c559f6ba96e4ca1"
        hosts => [ "node1:9200","node2:9200","node3:9200" ]
        index => "mysql-%{+YYYY.MM.dd}"
     }
}

user登入使用者名稱，這裡為了避免許可權問題，先一如既往的使用admin使用者
password：密碼
ssl 是否開啟ssl，我們要使用https，必須設為true
ssl_certificate_verification 這個引數設定我們想像kinana那樣設定成fasle是不行的，還是會報錯，也就是必須設定成true，這樣一來下面的truststore和truststore_password 必須配置（ps:這裡我去作者github上看過issue了，沒有解決辦法，而且作者在原始碼中的注視中已經說明這個引數一直不正常，所以遺棄。）

        truststore => "/etc/logstash/truststore.jks"
        truststore_password => "62ef1c559f6ba96e4ca1"

下面說一下truststore 和truststore_password 如何配置。
truststore 這裡我們還是先使用es下的這個truststore.jks，你可以向我一樣cp到logstash的目錄下，我這裡logstash和一臺es是在一臺機器上的。
truststore_password這個密碼是changeit，因為我們使用的官方給的預設的truststore.jks檔案。

到此還有最關鍵一步，連線的hosts
hosts => [ “node1:9200”,”node2:9200”,”node3:9200” ]
官方的授信檔案中只有一個主機名，也就是node-0.example.com
所以你只能配置成：
hosts => [ “node-0.example.com:9200”]
然後修改系統的/etc/hosts檔案指向具體的ip地址。也就是說只能有一臺es可以用，就是hosts檔案中對應node-0.example.com的這個。
啟動logstash，沒有報錯，顯示如下資訊說明成功

 [2017-09-13T15:17:51,166][INFO ][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"template"=>"logstash-*", "version"=>50001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"_default_"=>{"_all"=>{"enabled"=>true, "norms"=>false}, "dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date", "include_in_all"=>false}, "@version"=>{"type"=>"keyword", "include_in_all"=>false}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}
[2017-09-13T15:17:51,176][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//node1:9200", "//node2:9200", "//node3:9200"]}
[2017-09-13T15:17:51,288][INFO ][logstash.pipeline        ] Starting pipeline {"id"=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>250}
[2017-09-13T15:17:52,314][INFO ][logstash.inputs.beats    ] Beats inputs: Starting input listener {:address=>"0.0.0.0:5044"}
[2017-09-13T15:17:52,378][INFO ][logstash.inputs.beats    ] Beats inputs: Starting input listener {:address=>"0.0.0.0:5045"}
[2017-09-13T15:17:52,390][INFO ][logstash.pipeline        ] Pipeline main started
[2017-09-13T15:17:52,488][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}

現在，我們的elk整合sg就全部配置完成了，我們下一章再講如何配置自己的授權證書