리눅스 서버에 Elasticsearch 설치 및 기본 설정

# GPG 키 추가 및 저장소 설정
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

cat > /etc/yum.repos.d/elasticsearch.repo << 'EOF'
[elasticsearch]
name=Elasticsearch repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

# 설치
dnf install elasticsearch -y

# GPG 키 추가
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | \
  gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg

# 저장소 추가
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] \
  https://artifacts.elastic.co/packages/8.x/apt stable main" | \
  tee /etc/apt/sources.list.d/elastic-8.x.list

# 설치
apt update && apt install elasticsearch -y

# /etc/elasticsearch/jvm.options.d/heap.options
cat > /etc/elasticsearch/jvm.options.d/heap.options << 'EOF'
# 서버 RAM의 50% 할당 (최대 32GB)
# 16GB RAM 서버:
-Xms8g
-Xmx8g
EOF

# 시스템 최대 파일 디스크립터 설정 (필수)
cat >> /etc/security/limits.conf << 'EOF'
elasticsearch soft nofile 65536
elasticsearch hard nofile 65536
EOF

# 가상 메모리 맵 설정 (필수)
sysctl -w vm.max_map_count=262144
echo "vm.max_map_count=262144" >> /etc/sysctl.conf

# 서비스 시작
systemctl daemon-reload
systemctl enable elasticsearch
systemctl start elasticsearch

# 상태 확인
systemctl status elasticsearch

# 초기 비밀번호 확인 (최초 설치 시)
/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic

# 클러스터 상태 (보안 비활성화 환경)
curl -X GET "localhost:9200/_cluster/health?pretty"

# 인증 포함
curl -u elastic:password -X GET "localhost:9200/_cluster/health?pretty"

# 출력 예시:
# {
#   "cluster_name" : "my-cluster",
#   "status" : "green",
#   "number_of_nodes" : 1,
#   "active_shards" : 10
# }

# 노드 정보
curl -u elastic:password "localhost:9200/_cat/nodes?v"

# 인덱스 목록
curl -u elastic:password "localhost:9200/_cat/indices?v"

# 인덱스 생성
curl -u elastic:password -X PUT "localhost:9200/logs-2026.01" \
  -H "Content-Type: application/json" -d '{
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 0,
    "index.refresh_interval": "30s"
  },
  "mappings": {
    "properties": {
      "@timestamp": { "type": "date" },
      "level": { "type": "keyword" },
      "message": { "type": "text" },
      "host": { "type": "keyword" }
    }
  }
}'

# 문서 삽입
curl -u elastic:password -X POST "localhost:9200/logs-2026.01/_doc" \
  -H "Content-Type: application/json" -d '{
  "@timestamp": "2026-01-12T10:00:00Z",
  "level": "ERROR",
  "message": "Connection timeout to database",
  "host": "web01"
}'

# 검색
curl -u elastic:password -X GET "localhost:9200/logs-2026.01/_search?pretty" \
  -H "Content-Type: application/json" -d '{
  "query": {
    "match": { "level": "ERROR" }
  }
}'

# 30일 후 Hot → Warm, 90일 후 삭제하는 정책
curl -u elastic:password -X PUT "localhost:9200/_ilm/policy/log-policy" \
  -H "Content-Type: application/json" -d '{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_age": "7d",
            "max_size": "50gb"
          }
        }
      },
      "warm": {
        "min_age": "30d",
        "actions": {
          "shrink": { "number_of_shards": 1 },
          "forcemerge": { "max_num_segments": 1 }
        }
      },
      "delete": {
        "min_age": "90d",
        "actions": { "delete": {} }
      }
    }
  }
}'

# 파일 시스템 저장소 등록
curl -u elastic:password -X PUT "localhost:9200/_snapshot/my_backup" \
  -H "Content-Type: application/json" -d '{
  "type": "fs",
  "settings": {
    "location": "/var/backups/elasticsearch"
  }
}'

# 스냅샷 생성
curl -u elastic:password -X PUT "localhost:9200/_snapshot/my_backup/snapshot-$(date +%Y%m%d)?wait_for_completion=true"

# 스냅샷 목록
curl -u elastic:password "localhost:9200/_snapshot/my_backup/_all?pretty"