Elasticsearch 8.17.10 Installation on Ubuntu Operating System

# Elasticsearch user is created and authorized
sudo adduser elasticsearch
sudo usermod -aG sudo elasticsearch

# Switch to the user to continue operations
sudo su - elasticsearch

# It is recommended that the following tools be installed on all servers
sudo apt update
sudo apt install -y curl wget net-tools gnupg2 software-properties-common apt-transport-https ca-certificates

# Firewall is disabled
sudo systemctl stop ufw
sudo systemctl disable ufw

# Swap is disabled and the swap line in /etc/fstab file is deleted to prevent it from restarting
sudo swapoff -a
sudo vi /etc/fstab
# Then close the vi file (:wq)

sudo vi /etc/security/limits.conf
elasticsearch   -   nofile   65535
elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited

sudo sysctl -w vm.swappiness=1
sudo sysctl -w vm.max_map_count=262144

sudo vi /etc/sysctl.conf
vm.max_map_count=262144 elasticsearch

sudo sysctl -p
sudo sysctl vm.max_map_count

sudo mkdir /opt/elasticsearch
cd /opt/elasticsearch
sudo wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.17.10-linux-x86_64.tar.gz

sudo tar -xzf elasticsearch-8.17.10-linux-x86_64.tar.gz

sudo chown -R elasticsearch:elasticsearch /opt/elasticsearch
sudo chmod -Rf 775 /opt/elasticsearch

##At this point, pay attention to where the appropriate disk is mounted or ask system administrators to add the disk to the following path
#The following commands can be used for this check
df -h
lsblk

sudo mkdir /data
sudo mkdir /data/elastic-data/
sudo mkdir /data/elastic-snapdata/

sudo chown -Rf elasticsearch:elasticsearch /data/elastic-*
sudo chmod -Rf 775 /data/elastic-*

sudo vi /opt/elasticsearch/elasticsearch-8.17.10/config/elasticsearch.yml

cluster.name: ApinizerEsCluster
node.name: "<NODE_IP>"
network.host: "<NODE_IP>"
http.port: 9200

node.roles: ["master","data"]

cluster.initial_master_nodes: ["<NODE_IP>"]

discovery.seed_hosts: []
path.data: /data/elastic-data/
path.repo: ["/data/elastic-snapdata"]

# Security
xpack.security.enabled: true
xpack.security.enrollment.enabled: true

#xpack.security.http.ssl:
#  enabled: true
#  keystore.path: certs/elastic-certificates.p12
#  truststore.path: certs/elastic-certificates.p12

# Transport SSL:
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/elastic-certificates.p12
  truststore.path: certs/elastic-certificates.p12

# CORS settings
http.cors.enabled: true
http.cors.allow-origin: "*"
http.cors.allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
http.cors.allow-headers: X-Requested-With, X-Auth-Token, Content-Type, Content-Length

sudo vi /opt/elasticsearch/elasticsearch-8.17.10/config/jvm.options

-Xms8g
-Xmx8g

sudo chmod -Rf 775 /opt/elasticsearch/elasticsearch-8.17.10/*

sudo vi /etc/systemd/system/elasticsearch.service

[Unit]
Description=Elasticsearch 8.17.10
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=elasticsearch
Group=elasticsearch
ExecStart=/opt/elasticsearch/elasticsearch-8.17.10/bin/elasticsearch
Environment=ES_PATH_CONF=/opt/elasticsearch/elasticsearch-8.17.10/config
Restart=on-failure
RestartSec=5
LimitNOFILE=65536
LimitMEMLOCK=infinity
TimeoutStopSec=0

[Install]
WantedBy=multi-user.target

# The following command is used to create certificates. It is not mandatory to protect this file with a password (Not recommended). 
# Adding a password to the p12 file requires additional configuration (Keystore, etc.) for automatic service restarts, which complicates management and is generally not preferred.

cd /opt/elasticsearch/elasticsearch-8.17.10/
./bin/elasticsearch-certutil ca --days 3650
./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --days 3650

# Certificates are moved to the config/certs directory created
mkdir config/certs/
mv elastic-certificates.p12 config/certs/
mv elastic-stack-ca.p12 config/certs/
cd /opt/elasticsearch/elasticsearch-8.17.10/config/certs/
openssl pkcs12 -in elastic-certificates.p12 -nokeys -out elastic-certificates.crt

# Before proceeding, ensure that these certificate files have the same privileges as the Elasticsearch files.
sudo chown -Rf elasticsearch:elasticsearch /opt/elasticsearch
sudo chmod -Rf 775 /opt/elasticsearch

#The following 3 certificates should be displayed under the certs directory:
elastic-certificates.crt  # Contains the trusted Root Certificate (CA) that authenticates this server; thus, other Elastic Stack components (Apinizer, Kibana, Logstash) can trust the server with this certificate.
elastic-certificates.p12 # Used on the server side to encrypt incoming TLS/SSL connections and prove the server's identity by hosting the private key and server certificate.
elastic-stack-ca.p12 # Contains the central Root Certificate Authority (CA) information that provides this entire trust chain and certificate management.

sudo systemctl daemon-reload

sudo systemctl start elasticsearch
sudo systemctl status elasticsearch
sudo systemctl enable elasticsearch

cd /opt/elasticsearch/elasticsearch-8.17.10/
# Run the following command in the Elasticsearch directory to automatically update passwords.
./bin/elasticsearch-setup-passwords auto

#The output it will give will be as follows
Changed password for user elastic
PASSWORD elastic = dd6mjMiemZlAKfOXkUAm

sudo vi /opt/elasticsearch/elasticsearch-8.17.10/config/elasticsearch.yml

xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/elastic-certificates.p12
  truststore.path: certs/elastic-certificates.p12

sudo systemctl restart elasticsearch