上一篇我們完成了elk整合sg的配置，但是，我們的logstash只能使用一臺es，這是遠遠不夠的，我們要重新制作自己的授信檔案，幸運的是官網給出了一個工具，並且還給出了一個線上製作的網站，支援10個es節點，這裡我們使用線上製作
url: https://floragunn.com/tls-certificate-generator/

填寫表格，提交就可以了，所有的授信檔案，都會發到你的郵箱裡。注意查收，可能會被扔到垃圾箱裡。
檔名是下面這樣，目錄結構如下，我們把每個es節點都拷貝一份
裡面有一個README.txt檔案儲存了具體的操作步驟，和用到的密碼

search-guard-certificates-<UUID>.tar.gz 
│
└─── client-certificates
│        Contains two
 
 client certificates named 'admin' and 'demouser'
│        The admin certificate can be used with sgadmin and the REST API. 
│        The CN of this certificate is 'sgadmin'. The demouser certificate can be used 
│        for HTTPS client authentication. 
└─── node-certificates
│        Contains the
 
 certificates in jks, p12 and pem format to be used 
│        on your Elasticsearch nodes. You will find certificates for all 
│        hostnames you specified when submitting the form.
└─── root-ca
│        Contains the root CA certificate and private key.
└─── config
│        Same as above, but for
 
 the signing CA
└─── truststore.jks
│        The truststore containing the certificate chain
│        of the root and signing CA. Can be used on all nodes.

先把叢集都停止了
1.拷貝truststore.jks和CN=[hostname]-keystore.jks檔案（每個節點）

* Copy the file 'truststore.jks' to the config directory of your node（替換掉原來的即可）
* Copy the file 'node-certificates/CN=[hostname]-keystore.jks' to the config directory of your node, where [hostname] is the hostname of your Elasticsearch node（es主機名叫什麼，拷貝相應的keystore檔案）

2.重新配置es。更改原來預設的配置為下（每個節點）

######## Start Search Guard Demo Configuration ########
searchguard.ssl.transport.keystore_filepath: CN=[hostname]-keystore.jks
searchguard.ssl.transport.keystore_password: [keystore password for this node]
searchguard.ssl.transport.truststore_filepath: truststore.jks
searchguard.ssl.transport.truststore_password: 62ef1c559f6ba96e4ca1
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.http.enabled: true
searchguard.ssl.http.keystore_filepath: CN=[hostname]-keystore.jks
searchguard.ssl.http.keystore_password: [keystore password for this node]
searchguard.ssl.http.truststore_filepath: truststore.jks
searchguard.ssl.http.truststore_password: 62ef1c559f6ba96e4ca1

searchguard.authcz.admin_dn:                                
  - CN=sgadmin  
######## End Search Guard Demo Configuration ########

3.啟動es，拷貝證書檔案到tools資料夾下（任意一臺es）

* Copy the file 'truststore.jks' to the directory 'plugins/search-guard-5/tools'
* Copy the file 'client-certificates/CN=sgadmin-keystore.jks' to the directory 'plugins/search-guard-5/tools'

4.重新初始化sg（用到的密碼都在README檔案下面，請改成自己的）
./sgadmin.sh -ts truststore.jks -tspass 62ef1c559f6ba96e4ca1 -ks CN=sgadmin-keystore.jks -kspass f0fbad3ec91139f75136 -nhnv -icl -cd ../sgconfig/

至此es上面的配置就完成了，如果我們更改sg_config的使用者的許可權，要重新初始化sg，我們之前說過了，再強調一下。

我們更改es的truststore檔案，相應的logstash也要重新配置。

    elasticsearch {
        user => admin
        password => admin
        ssl => true
        ssl_certificate_verification => true
        truststore => "/etc/logstash/truststore.jks"
        truststore_password => "62ef1c559f6ba96e4ca1"
        hosts => [ "node1:9200","node2:9200","node3:9200" ]
        index => "mysql-%{+YYYY.MM.dd}"
     }

別忘了在/etc/hosts檔案中做好主機名解析工作

貼一個truststore 配置錯誤的報錯

[2017-09-13T15:14:24,265][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://admin:[email protected]:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://admin:[email protected]:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"}