Elasticsearch Configuration and Installation
Download and Install Elasticsearch

Download and install the public signing key:

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

Create Elasticsearch repository congifuration file

sudo vi /etc/yum.repos.d/elasticsearch.repo

Paste the following into the file:

[elasticsearch]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gppcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
type=rpm-md

Create congifuration file for Elasticsearch repository
sudo yum install --enablerepo=elasticsearch elasticsearch

**yum will check size and ask “Is this ok?” It will not proceed until you answer [y]es

References:

Detailed instructions for installing Elastic Search in Ubuntu can be found here:

Installing Elasticsearch | Elasticsearch Guide [8.3] | Elastic

The following instructions follow the instructions available at the following link which documents installing with the Debian package:

Install Elasticsearch with Debian Package | Elasticsearch Guide [8.3] | Elastic

Instructions:

The most common install is to manually download the installation files that are for Debian and install it.

Download and add the Elastic Search key:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

Now download the needed installation files

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.0.0-amd64.deb

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.0.0-amd64.deb.sha512

shasum -a 512 -c elasticsearch-8.0.0-amd64.deb.sha512

sudo dpkg -i elasticsearch-8.0.0-amd64.deb

Note: If previous command gives you an error then attempt to run

sudo rm /var/lib/dpkg/lock-frontend

Copy the entire Security autoconfiguration information in to a text file called README.txt

Example:

-------------------------- Security autoconfiguration information ------------------------------ Authentication and authorization are enabled. TLS for the transport and HTTP layers is enabled and configured. The generated password for the elastic built-in superuser is : If this node should join an existing cluster, you can reconfigure this with '/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token ' after creating an enrollment token on your existing cluster. You can complete the following actions at any time: Reset the password of the elastic built-in superuser with '/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'. Generate an enrollment token for Kibana instances with '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'. Generate an enrollment token for Elasticsearch nodes with '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'. -----------------------------------------------

Now enable the elasticsearch service and set it to run automatically for us

sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
sudo systemctl start elasticsearch.service
✔️Ensure elastic is running by navigating to https://localhost:9200 in a browser or by running the command:

NOte: use journalctl -u elasticsearch.service if you need to see the status.

default username will be: elastic

wget -qO- https://saltminer:9200/

this needs to be edited

FYI on File locations:

The following is just an FYI, there is no more work to be done in this section.

The default location for the configuration files will be in: /etc/elasticsearch

The Debian package places config files, logs, and the data directory in the appropriate locations for a Debian-based system:

Type

Description

Default Location

Setting

Type

Description

Default Location

Setting

home

Elasticsearch home directory or $ES_HOME

/usr/share/elasticsearch

bin

Binary scripts including elasticsearch to start a node and elasticsearch-plugin to install plugins

/usr/share/elasticsearch/bin

conf

Configuration files including elasticsearch.yml

/etc/elasticsearch

ES_PATH_CONF

conf

Environment variables including heap size, file descriptors.

/etc/default/elasticsearch

data

The location of the data files of each index / shard allocated on the node.

/var/lib/elasticsearch

path.data

jdk

The bundled Java Development Kit used to run Elasticsearch. Can be overridden by setting the ES_JAVA_HOME environment variable in /etc/default/elasticsearch.

/usr/share/elasticsearch/jdk

logs

Log files location.

/var/log/elasticsearch

path.logs

plugins

Plugin files location. Each plugin will be contained in a subdirectory.

/usr/share/elasticsearch/plugins

repo

Shared file system repository locations. Can hold multiple locations. A file system repository can be placed in to any subdirectory of any directory specified here.

Not configured

path.repo

SaltMiner: Our Solution for Enterprise Application Security ManagementLearn More
+ +