1、elasticsearch安装xpack插件

离线安装xpack：

/usr/local/elasticsearch-5.4.0/bin/elasticsearch-plugin install file:///usr/local/software/x-pack-5.4.0.zip

卸载xpack：

/usr/local/elasticsearch-5.4.0/bin/elasticsearch-plugin remove x-pack

 Downloading file:///usr/local/software/x-pack-5.4.0.zip
[=================================================] 100%  
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@     WARNING: plugin requires additional permissions     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
* java.io.FilePermission \\.\pipe\* read,write
* java.lang.RuntimePermission accessClassInPackage.com.sun.activation.registries
* java.lang.RuntimePermission getClassLoader
* java.lang.RuntimePermission setContextClassLoader
* java.lang.RuntimePermission setFactory
* java.security.SecurityPermission createPolicy.JavaPolicy
* java.security.SecurityPermission getPolicy
* java.security.SecurityPermission putProviderProperty.BC
* java.security.SecurityPermission setPolicy
* java.util.PropertyPermission * read,write
* java.util.PropertyPermission sun.nio.ch.bugLevel write
* javax.net.ssl.SSLPermission setHostnameVerifier
See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html
for descriptions of what these permissions allow and the associated risks.

Continue with installation? [y/N]y
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@        WARNING: plugin forks a native controller        @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
This plugin launches a native controller that is not subject to the Java
security manager nor to system call filters.

Continue with installation? [y/N]y
-> Installed x-pack

更改密码，初始密码changeme

curl -XPUT -u elastic '192.168.1.101:9200/_xpack/security/user/elastic/_password' -H "Content-Type: application/json" -d '{
  "password" : "123456"
}'

更改kibana密码，此时密码为上一步刚改的es的密码

curl -XPUT -u elastic '192.168.1.101:9200/_xpack/security/user/kibana/_password' -H "Content-Type: application/json" -d '{
  "password" : "123456"
}'

新创建角色

curl -XPOST -u elastic '192.168.1.101:9200/_xpack/security/role/events_admin' -H "Content-Type: application/json" -d '{
  "indices" : [
    {
      "names" : [ "events*" ],
      "privileges" : [ "all" ]
    },
    {
      "names" : [ ".kibana*" ],
      "privileges" : [ "manage", "read", "index" ]
    }
  ]
}'

新创建账户

curl -XPOST -u elastic '192.168.1.101:9200/_xpack/security/user/admin' -H "Content-Type: application/json" -d '{
  "password" : "111111",
  "full_name" : "administrator",
  "email" : "admin@anony.mous",
  "roles" : [ "events_admin" ]
}'

2、kibana安装xpack插件：

离线安装xpack：
/usr/local/kibana-5.4.0-linux-x86_64/bin/kibana-plugin install file:///usr/local/software/x-pack-5.4.0.zip

    Retrieving metadata from plugin archive
    Extracting plugin archive
    Extraction complete
    Optimizing and caching browser bundles...（此步时间较长，耐心等待）
    Plugin installation complete

修改kibana.yml配置：
vim /usr/local/kibana-5.4.0-linux-x86_64/config/kibana.yml

elasticsearch.username: "elastic"
elasticsearch.password: "123456"

重启kibana：
nohup /usr/local/kibana-5.4.0-linux-x86_64/bin/kibana -c /usr/local/kibana-5.4.0-linux-x86_64/config/kibana.yml> /dev/null 2>&1 &

卸载xpack：
/usr/local/kibana-5.4.0-linux-x86_64/bin/kibana-plugin remove x-pack

进入http://localhost:5601/ ，输入用户名和密码登录，默认分别是 elastic 和 changeme