本次安装使用3台服务器：

172.16.200.10

172.16.200.11

172.16.200.12

从官方网站下载rpm包

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.3.3-x86_64.rpm

安装rpm包

[root@es-10 ~]# rpm -ivh elasticsearch-8.3.3-x86_64.rpm 
warning: elasticsearch-8.3.3-x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY
Preparing...                          ################################# [100%]
Creating elasticsearch group... OK
Creating elasticsearch user... OK
Updating / installing...
   1:elasticsearch-0:8.3.3-1          ################################# [100%]
--------------------------- Security autoconfiguration information ------------------------------

Authentication and authorization are enabled.
TLS for the transport and HTTP layers is enabled and configured.

The generated password for the elastic built-in superuser is : XXXXXXXXXXX #此处是默认elastic账户的密码

If this node should join an existing cluster, you can reconfigure this with
'/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <token-here>'
after creating an enrollment token on your existing cluster.

You can complete the following actions at any time:

Reset the password of the elastic built-in superuser with 
'/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'.

Generate an enrollment token for Kibana instances with 
 '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'.

Generate an enrollment token for Elasticsearch nodes with 
'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'.

-------------------------------------------------------------------------------------------------
### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd
 sudo systemctl daemon-reload
 sudo systemctl enable elasticsearch.service
### You can start elasticsearch service by executing
 sudo systemctl start elasticsearch.service

将elasticsearch设置为开机启动

[root@es-10 elasticsearch]# systemctl daemon-reload
[root@es-10 elasticsearch]# systemctl enable elasticsearch.service
Created symlink from /etc/systemd/system/multi-user.target.wants/elasticsearch.service to /usr/lib/systemd/system/elasticsearch.service.

修改第一个节点（172.16.200.10）配置文件/etc/elasticsearch/elasticsearch.yml

cluster.name: my-es-cluster
node.name: es-10.elk.com         #修改集群名
path.data: /elk/elasticsearch   #修改数据目录
path.logs: /elk/logs/elasticsearch   #修改日志目录
network.host: 172.16.200.10    #设置本机IP
http.port: 9200    #设置端口，默认就是9200
discovery.seed_hosts: ["172.16.200.10", "172.16.200.11", "172.16.200.12"]   #新增其他两个节点IP，默认通信端口为9300，用来发现其他集群节点
---以下配置无需修改---
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
cluster.initial_master_nodes: ["es-10.elk.com"]   #会获取主机名自动生成
http.host: 0.0.0.0

启动第一个节点（172.16.200.10）上的ES服务

[root@es-10 elasticsearch]# systemctl start elasticsearch

在第一个节点（172.16.200.10）生成集群注册token

[root@es-10 elasticsearch]# /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node
eyJ2ZXIiOiI4LjMuMyIsImFkciI6WyIxNzIuMjYuMTAwLjQ3OjkyMDAiXSwiZmdyIjoiYzQ0ZDFiODIyOTVhZDk4YTM0NGZhOTBjYmU2ZTk1NWI2YWFhMDhiMGU3NGMzYmQ5N2U2OWI0OGU1ZDcwOTcwNSIsImtleSI6ImRfOGFhSUlCMWQxS2xpYThTYjRQOkVLdGRyUUs0U2Y2M2t3ZGlMLWJCWXcifQ==

在第二个节点（172.16.200.11）执行加入集群，token为上面生成的，切记第二个节点ES不要启动，必须在启动之前加入集群

[root@es-11 ~]# /usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token eyJ2ZXIiOiI4LjMuMyIsImFkciI6WyIxNzIuMjYuMTAwLjQ3OjkyMDAiXSwiZmdyIjoiYzQ0ZDFiODIyOTVhZDk4YTM0NGZhOTBjYmU2ZTk1NWI2YWFhMDhiMGU3NGMzYmQ5N2U2OWI0OGU1ZDcwOTcwNSIsImtleSI6ImRfOGFhSUlCMWQxS2xpYThTYjRQOkVLdGRyUUs0U2Y2M2t3ZGlMLWJCWXcifQ==

This node will be reconfigured to join an existing cluster, using the enrollment token that you provided.
This operation will overwrite the existing configuration. Specifically: 
  - Security auto configuration will be removed from elasticsearch.yml
  - The [certs] config directory will be removed
  - Security auto configuration related secure settings will be removed from the elasticsearch.keystore
Do you want to continue with the reconfiguration process [y/N]y
[root@es-11 ~]#

第三个节点（172.16.200.12）同样加入集群，步骤与（172.16.200.11）一样执行即可。

[root@es-12 ~]# /usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token eyJ2ZXIiOiI4LjMuMyIsImFkciI6WyIxNzIuMjYuMTAwLjQ3OjkyMDAiXSwiZmdyIjoiYzQ0ZDFiODIyOTVhZDk4YTM0NGZhOTBjYmU2ZTk1NWI2YWFhMDhiMGU3NGMzYmQ5N2U2OWI0OGU1ZDcwOTcwNSIsImtleSI6ImRfOGFhSUlCMWQxS2xpYThTYjRQOkVLdGRyUUs0U2Y2M2t3ZGlMLWJCWXcifQ==

This node will be reconfigured to join an existing cluster, using the enrollment token that you provided.
This operation will overwrite the existing configuration. Specifically: 
  - Security auto configuration will be removed from elasticsearch.yml
  - The [certs] config directory will be removed
  - Security auto configuration related secure settings will be removed from the elasticsearch.keystore
Do you want to continue with the reconfiguration process [y/N]y
[root@es-12 ~]#

修改配置第二个节点（172.16.200.11）配置

cluster.name: my-es-cluster     #配置集群名
node.name:  es-11.elk.com       #配置节点名
path.data: /elk/elasticsearch   #修改数据目录
path.logs: /elk/logs/elasticsearch  #修改日志目录
network.host: 172.16.200.11     #配置本机IP
http.port: 9200                 #配置端口，默认就是9200
---以下配置无需修改---
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
discovery.seed_hosts: ["172.16.200.10", "172.16.200.11", "172.16.200.12"]   #新增其他两个节点IP，默认通信端口为9300，用来发现其他集群节点
http.host: 0.0.0.0
transport.host: 0.0.0.0

启动第二个节点（172.16.200.11）上ES服务

[root@es-11 elasticsearch]# systemctl start elasticsearch

修改配置第三个节点（172.16.200.12）配置

cluster.name: my-es-cluster     #配置集群名
node.name:  es-12.elk.com       #配置节点名
path.data: /elk/elasticsearch   #修改数据目录
path.logs: /elk/logs/elasticsearch  #修改日志目录
network.host: 172.16.200.12     #配置本机IP
http.port: 9200                 #配置端口，默认就是9200
---以下配置无需修改---
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
discovery.seed_hosts: ["172.16.200.10", "172.16.200.11", "172.16.200.12"]   #新增其他两个节点IP，默认通信端口为9300，用来发现其他集群节点
http.host: 0.0.0.0
transport.host: 0.0.0.0

启动第三个节点（172.16.200.12）上ES服务

[root@es-12 elasticsearch]# systemctl start elasticsearch

至此，ES集群安装完成，检查集群状态，node节点数为3个则正常

[root@es-10 elasticsearch]# curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic  https://localhost:9200/_cat/health?v
Enter host password for user 'elastic':
epoch      timestamp cluster        status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1659665849 02:17:29  my-es-cluster green           3         3      4   2    0    0        0             0                  -                100.0%

注意：elastic密码为安装步骤中自动生成的密码，每个节点生成的密码都不一样，如果忘记密码可执行重置密码命令

[root@es-10 elasticsearch]# /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic