{"id":758,"date":"2026-01-16T17:55:11","date_gmt":"2026-01-16T14:55:11","guid":{"rendered":"https:\/\/oraclius.com.tr\/?p=758"},"modified":"2026-04-07T11:26:16","modified_gmt":"2026-04-07T08:26:16","slug":"linux-uzerinde-2-nodelu-elasticsearch-8-1-3-cluster-kurulum-rehberi","status":"publish","type":"post","link":"https:\/\/oraclius.com.tr\/tr\/linux-uzerinde-2-nodelu-elasticsearch-8-1-3-cluster-kurulum-rehberi\/","title":{"rendered":"Linux \u00dczerinde 2 Node’lu Elasticsearch 8.1.3 Cluster Kurulum Rehberi"},"content":{"rendered":"\n

Merhaba! Bug\u00fcn kurumsal ortamlarda en s\u0131k kullan\u0131lan Linux da\u011f\u0131t\u0131mlar\u0131ndan biri olan RHEL 7.9 (Red Hat Enterprise Linux)<\/strong> \u00fczerinde, y\u00fcksek performansl\u0131 ve \u00f6zelle\u015ftirilmi\u015f bir Elasticsearch 8.1.3 Cluster<\/strong> kurulumunu ele alaca\u011f\u0131z.<\/p>\n\n\n\n

Bu rehberde, varsay\u0131lan kurulumlar\u0131n d\u0131\u015f\u0131na \u00e7\u0131karak; \u00f6zel veri yollar\u0131, SSL’siz (HTTP) ileti\u015fim ve spesifik node rolleri ile ger\u00e7ek bir \u00fcretim (production) senaryosu kurgulayaca\u011f\u0131z.<\/p>\n\n\n\n

\n
Oracle Linux 7.9 Kurulum Rehberi<\/a><\/div>\n<\/div>\n\n\n\n
\n\n\n\n

1. Haz\u0131rl\u0131k ve Network Aray\u00fcz\u00fc Tespiti<\/h2>\n\n\n\n

Bu rehberde, y\u00fcksek trafikli blog siteleri veya kurumsal veri analiti\u011fi ihtiya\u00e7lar\u0131 i\u00e7in ideal olan, y\u00fcksek eri\u015filebilir (High Availability)<\/strong> bir ELK Stack yap\u0131s\u0131 kuraca\u011f\u0131z. Sadece yaz\u0131l\u0131m\u0131 y\u00fcklemekle kalmayacak, sistemin neden bu ayarlara ihtiya\u00e7 duydu\u011funu da \u00f6\u011frenece\u011fiz.<\/p>\n\n\n\n

<\/p>\n\n\n\n

1.1. Genel Bak\u0131\u015f ve Mimari Plan\u0131<\/h3>\n\n\n\n

Kuraca\u011f\u0131m\u0131z yap\u0131 2 adet Elasticsearch node’undan olu\u015facak. Bu iki sunucu birbiriyle s\u00fcrekli ileti\u015fim halinde kalarak verilerinizin g\u00fcvenli\u011fini ve arama h\u0131z\u0131n\u0131 garanti alt\u0131na alacak.<\/p>\n\n\n\n

Sunucu Ad\u0131<\/strong><\/td>IP Adresi<\/strong><\/td>Rol\u00fc<\/strong><\/td>\u0130\u015fletim Sistemi<\/strong><\/td><\/tr><\/thead>
oraclius-el1<\/strong><\/td>150.150.150.150<\/td>Master \/ Data Node<\/td>RHEL\/Oracle Linux 7.9<\/td><\/tr>
oraclius-el2<\/strong><\/td>150.150.150.151<\/td>Data Node<\/td>RHEL\/Oracle Linux 7.9<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Elasticsearch:<\/strong> Verilerimizin sakland\u0131\u011f\u0131 ve arand\u0131\u011f\u0131 ana motor.<\/p>\n\n\n\n

Kibana:<\/strong> Verileri g\u00f6rselle\u015ftirdi\u011fimiz ve k\u00fcmemizi y\u00f6netti\u011fimiz web aray\u00fcz\u00fc.<\/p>\n\n\n\n

Logstash:<\/strong> Verileri toplay\u0131p, i\u015fleyip Elasticsearch’e g\u00f6nderen boru hatt\u0131.<\/p>\n\n\n\n

<\/p>\n\n\n\n

1.2. Kullan\u0131lacak Yaz\u0131l\u0131m Versiyonlar\u0131 ve Kaynaklar<\/h3>\n\n\n\n

Uyumsuzluk sorunlar\u0131n\u0131 \u00f6nlemek i\u00e7in t\u00fcm bile\u015fenlerin ayn\u0131 versiyon (8.1.3) olmas\u0131 kritik \u00f6nem ta\u015f\u0131r. Bu rehberde kullan\u0131lan paketler resmi Elastic.co<\/strong> depolar\u0131ndan al\u0131nm\u0131\u015ft\u0131r.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n
Elasticsearch 8.1.3<\/strong><\/a><\/div>\n<\/div>\n\n\n\n
\n
Kibana 8.1.3<\/strong><\/a><\/div>\n<\/div>\n\n\n\n
\n
Logstash 8.1.3<\/strong><\/a><\/div>\n<\/div>\n\n\n\n
\n\n\n\n

2. Kurulum \u00d6ncesi Sunucu Optimizasyonu (Production Ready)<\/h2>\n\n\n\n

Elasticsearch’\u00fc kurmadan \u00f6nce Linux i\u015fletim sistemine “Bu uygulama \u00e7ok yo\u011fun \u00e7al\u0131\u015facak, ona engel olma” dememiz gerekiyor. Bu ayarlar, ger\u00e7ek bir \u00fcretim senaryosunda<\/strong> sistemin kilitlenmesini \u00f6nleyen hayati dokunu\u015flard\u0131r.<\/p>\n\n\n\n

\u00d6nemli:<\/strong> Bu ad\u0131mlar\u0131n tamam\u0131 hem Node-1 (150.150.150.150)<\/strong> hem de Node-2 (150.150.150.15<\/strong>1)<\/strong> sunucular\u0131nda uygulanmal\u0131d\u0131r.<\/p><\/blockquote><\/figure>\n\n\n\n

2.1. A\u011f Aray\u00fcz\u00fc ve IP Sabitleme<\/h3>\n\n\n\n

\u00dcretim ortam\u0131nda sunucular\u0131n IP adreslerinin de\u011fi\u015fmemesi gerekir. Ayr\u0131ca Elasticsearch konfig\u00fcrasyonunda kullanmak \u00fczere IP’nizin ba\u011fl\u0131 oldu\u011fu aray\u00fcz ismini<\/strong> bilmelisiniz.<\/p>\n\n\n\n

# IP adresinizin hangi aray\u00fczde (ens192, ens33 vb.) oldu\u011funu kontrol edin:\nip a | grep \"150.150.150\" -B2<\/code><\/pre>\n\n\n\n
\u00c7\u0131kt\u0131da inet 150.150.150.x<\/code> sat\u0131r\u0131n\u0131n \u00fczerindeki ismi (\u00f6rne\u011fin: ens192<\/code>) not al\u0131n.<\/p>\n\n\n\n
<\/p>\n\n\n\n
Linux Seviyesinde IPv6’y\u0131 Ge\u00e7ici Olarak Kapat (Opsiyonel ama Garanti)<\/p>\n\n\n\n
Bash<\/p>\n\n\n\n
sysctl -w net.ipv6.conf.all.disable_ipv6=1\nsysctl -w net.ipv6.conf.default.disable_ipv6=1<\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
\u015eu ad\u0131mlar\u0131 takip ederek IPv6’y\u0131 kal\u0131c\u0131 olarak devre d\u0131\u015f\u0131 b\u0131rakabilirsin: \/etc\/sysctl.conf<\/p>\n\n\n\n
sudo bash -c 'cat << EOF >> \/etc\/sysctl.conf\nnet.ipv6.conf.all.disable_ipv6 = 1\nnet.ipv6.conf.default.disable_ipv6 = 1\nnet.ipv6.conf.lo.disable_ipv6 = 1\nEOF'<\/code><\/pre>\n\n\n\n
Dosyaya yazd\u0131ktan sonra ayarlar\u0131n hemen okunmas\u0131 i\u00e7in \u015fu komutu \u00e7al\u0131\u015ft\u0131r:<\/p>\n\n\n\n
sudo sysctl -p<\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
2.2. Sanal Bellek Limiti (vm.max_map_count<\/code>)<\/h3>\n\n\n\n
Neden 262144?<\/strong> Elasticsearch, verileri diskten \u00e7ok h\u0131zl\u0131 okumak i\u00e7in “mmap” (memory map) denilen bir y\u00f6ntem kullan\u0131r. Her bir veri par\u00e7as\u0131 (shard) i\u00e7in i\u015fletim sisteminden bir “harita” alan\u0131 ister.<\/p>\n\n\n\n
    \n
  • Varsay\u0131lan De\u011fer:<\/strong> \u00c7o\u011fu Linux sisteminde bu limit 65530<\/strong>‘dur.<\/li>\n\n\n\n
  • Neden Art\u0131r\u0131yoruz?<\/strong> Elasticsearch b\u00fcy\u00fcd\u00fck\u00e7e bu harita alanlar\u0131 yetmez ve sistem “Out of Memory” (Bellek Yetersiz) hatas\u0131 vererek \u00e7\u00f6ker. 262144<\/strong>, Elastic m\u00fchendislerinin stabil bir \u00e7al\u0131\u015fma i\u00e7in belirledi\u011fi “alt s\u0131n\u0131r” de\u011feridir.<\/li>\n\n\n\n
  • <\/li>\n<\/ul>\n\n\n\n
    # De\u011feri kal\u0131c\u0131 olarak sisteme i\u015fle\necho \"vm.max_map_count=262144\" >> \/etc\/sysctl.conf\n# De\u011fi\u015fikli\u011fi hemen aktif et\nsysctl -p<\/code><\/pre>\n\n\n\n
    <\/p>\n\n\n\n
    2.3. Dosya ve Bellek Limitleri (limits.conf<\/code>)<\/h3>\n\n\n\n
    Linux, g\u00fcvenli\u011fi sa\u011flamak i\u00e7in bir uygulaman\u0131n ayn\u0131 anda ka\u00e7 dosya a\u00e7abilece\u011fini veya ne kadar RAM “kilitleyebilece\u011fini” k\u0131s\u0131tlar.<\/p>\n\n\n\n
      \n
    • nofile (Number of Open Files):<\/strong> Elasticsearch binlerce k\u00fc\u00e7\u00fck veri dosyas\u0131yla \u00e7al\u0131\u015f\u0131r. Standart limit olan 1024, yo\u011fun kullan\u0131mda sistemin kilitlenmesine neden olur. Biz bunu 65535<\/strong> yaparak yolu a\u00e7\u0131yoruz.<\/li>\n\n\n\n
    • memlock (Memory Lock):<\/strong> \u0130\u015fletim sistemi bazen RAM’deki veriyi bo\u015falt\u0131p diske (Swap) yazar. Bu, Elasticsearch i\u00e7in “felaket” demektir \u00e7\u00fcnk\u00fc disk RAM’den binlerce kat yava\u015ft\u0131r. unlimited<\/code> diyerek sistemin Elasticsearch’\u00fcn RAM’ine dokunmas\u0131n\u0131 yasakl\u0131yoruz.<\/li>\n<\/ul>\n\n\n\n
      cat <<EOF >> \/etc\/security\/limits.conf\nelasticsearch soft memlock unlimited\nelasticsearch hard memlock unlimited\nelasticsearch soft nofile 65535\nelasticsearch hard nofile 65535\nEOF<\/code><\/pre>\n\n\n\n
      <\/p>\n\n\n\n
      2.4. Swap (Takas Alan\u0131) Neden Kapat\u0131lmal\u0131?<\/h3>\n\n\n\n
      Soru:<\/strong> “Bilgisayar\u0131m h\u0131zlans\u0131n diye swap a\u00e7maz m\u0131y\u0131z?” Cevap:<\/strong> Normal bilgisayarda evet, ama Elasticsearch gibi devasa verileri RAM’de tutan sistemlerde hay\u0131r.<\/strong> Elasticsearch, ihtiyac\u0131 olan verinin RAM’de oldu\u011funu varsayar. \u0130\u015fletim sistemi bu veriyi \u00e7akt\u0131rmadan diske (swap) ta\u015f\u0131rsa, Elasticsearch o veriye ula\u015fmaya \u00e7al\u0131\u015ft\u0131\u011f\u0131nda sistem donar. Bu y\u00fczden swapoff -a<\/code> komutuyla bunu engelliyoruz.<\/p>\n\n\n\n
      # Swap'\u0131 anl\u0131k olarak kapat:\nswapoff -a\n\n# Kal\u0131c\u0131 hale getirmek i\u00e7in \/etc\/fstab i\u00e7indeki swap sat\u0131r\u0131n\u0131 bulup ba\u015f\u0131na # ekleyin:\nvi \/etc\/fstab<\/code><\/pre>\n\n\n\n
      <\/p>\n\n\n\n
      2.5. Disk Yap\u0131s\u0131 Haz\u0131rl\u0131\u011f\u0131<\/h3>\n\n\n\n
      Verilerin \/var\/lib\/elasticsearch<\/code> (sistem diski) yerine ayr\u0131 bir \/data<\/code> dizininde tutulmas\u0131, ileride disk yetmedi\u011finde sistemi bozmadan yeni bir disk eklemenizi sa\u011flar.<\/p>\n\n\n\n
      # Veri ve Log klas\u00f6rlerini olu\u015ftur\nmkdir -p \/data\/elasticsearch\/data\nmkdir -p \/data\/elasticsearch\/logs<\/code><\/pre>\n\n\n\n
      <\/p>\n\n\n\n
      2.6. Systemd Servis Optimizasyonu (Memory Lock \u0130\u00e7in)<\/h3>\n\n\n\n
      Belle\u011fi kilitlemek (memlock<\/code>) sadece limits.conf<\/code> ile bitmez. Linux servis y\u00f6neticisine (systemd) bu yetkiyi \u00f6zel olarak vermeliyiz. Bu ad\u0131m genellikle atlan\u0131r ve en \u00e7ok hata buradan \u00e7\u0131kar.<\/strong><\/p>\n\n\n\n
      Hen\u00fcz Elasticsearch y\u00fckl\u00fc olmad\u0131\u011f\u0131 i\u00e7in bu dosyay\u0131 \u015fimdi olu\u015fturamayabiliriz, ancak y\u00fcklemeden hemen sonra yapaca\u011f\u0131m\u0131z ilk i\u015f bu olacak.<\/em><\/p>\n\n\n\n
      <\/p>\n\n\n\n
      \n\n\n\n
      3. Ad\u0131m: Elasticsearch 8.1.3 Kurulumu ve “Cluster” Yap\u0131land\u0131rmas\u0131<\/h2>\n\n\n\n
      Sunucular\u0131m\u0131z\u0131 optimize ettik. \u015eimdi ana motorumuzu kurma ve iki sunucuyu birbiriyle konu\u015fturma vakti. Bu b\u00f6l\u00fcmde yapaca\u011f\u0131m\u0131z ayarlar, sistemi SSL karma\u015fas\u0131ndan kurtar\u0131p do\u011frudan veri i\u015flemeye odaklanmas\u0131n\u0131 sa\u011flayacak.<\/p>\n\n\n\n
      <\/p>\n\n\n\n
      3.1. Elasticsearch Yaz\u0131l\u0131m\u0131n\u0131n Sunuculara Y\u00fcklenmesi<\/h3>\n\n\n\n
      Bu ad\u0131m\u0131 her iki sunucuda da (Node-1 ve Node-2<\/strong>) s\u0131rayla yap\u0131n.<\/p>\n\n\n\n
      sudo rpm -ivh elasticsearch-8.1.3-x86_64.rpm<\/code><\/pre>\n\n\n\n
      <\/p>\n\n\n\n
      3.2. Dosya Yetkilerinin Verilmesi (\u00c7ok Kritik!)<\/h3>\n\n\n\n
      B\u00f6l\u00fcm 2’de olu\u015fturdu\u011fumuz \/data<\/code> klas\u00f6rleri \u015fu an “root” kullan\u0131c\u0131s\u0131na ait. Ancak Elasticsearch kendi kullan\u0131c\u0131s\u0131yla (elasticsearch<\/code>) \u00e7al\u0131\u015f\u0131r. E\u011fer yetki vermezsek servis ba\u015flamaz ve “Permission Denied” hatas\u0131 al\u0131rs\u0131n\u0131z.<\/p>\n\n\n\n
      Her iki sunucuda \u00e7al\u0131\u015ft\u0131r\u0131n:<\/strong><\/p>\n\n\n\n
      # Veri ve Log klas\u00f6rlerinin anahtar\u0131n\u0131 Elasticsearch'e teslim ediyoruz\nchown -R elasticsearch:elasticsearch \/data\/elasticsearch<\/code><\/pre>\n\n\n\n
      <\/p>\n\n\n\n
      3.3. Node-1 (Master) Yap\u0131land\u0131rmas\u0131 (150.150.150.150)<\/h3>\n\n\n\n
      \u015eimdi ilk sunucumuzu “Y\u00f6netici (Master)” olarak tan\u0131mlayaca\u011f\u0131z. \/etc\/elasticsearch\/elasticsearch.yml<\/code> dosyas\u0131n\u0131 d\u00fczenleyece\u011fiz.<\/p>\n\n\n\n
      \n
      \u0130pucu:<\/strong> Dosyadaki her \u015feyi silip a\u015fa\u011f\u0131daki temiz yap\u0131land\u0131rmay\u0131 yap\u0131\u015ft\u0131rabilirsiniz.<\/p>\n<\/blockquote>\n\n\n\n
      cat <<EOF >> cat \/etc\/elasticsearch\/elasticsearch.yml\n# --- CLUSTER VE NODE AYARLARI ---\ncluster.name: elastic-cluster\nnode.name: elastic1  # (Node-2'de bunu elastic2 yapmay\u0131 unutma)\npath.data: \/data\/elasticsearch\/data\npath.logs: \/data\/elasticsearch\/logs\nbootstrap.memory_lock: true\n\n# --- A\u011e AYARLARI (D\u0131\u015f eri\u015fim i\u00e7in en temiz hali) ---\nnetwork.host: 0.0.0.0\nhttp.host: [_local_, _ens34_]\ntransport.host: [_local_, _ens34_]\n\n# Port ayarlar\u0131n\u0131 sabitleyelim\nhttp.port: 9200\ntransport.port: 9300\n\n# --- G\u00dcVENL\u0130K AYARLARI (HTTP Modu) ---\nxpack.security.enabled: false\nxpack.security.enrollment.enabled: false\nxpack.security.http.ssl.enabled: false\nxpack.security.transport.ssl.enabled: false\n\n# --- PERFORMANS ARTTIRICI PARAMETRELER ---\n# RAM'in ne kadar\u0131n\u0131n indeksleme i\u015flemine ayr\u0131laca\u011f\u0131n\u0131 belirler (Varsay\u0131lan %10'dur, biz %20 yap\u0131yoruz)\nindices.memory.index_buffer_size: 20%\n\n# Sorgular s\u0131ras\u0131nda RAM \u015fi\u015fmesini \u00f6nleyen koruma ayar\u0131\nindices.breaker.total.use_real_memory: true\nindices.fielddata.cache.size: 40%\n\n# Disk doluluk oranlar\u0131n\u0131 y\u00f6netelim (Disk %90 dolunca veri yazmay\u0131 keser)\ncluster.routing.allocation.disk.threshold_enabled: true\ncluster.routing.allocation.disk.watermark.low: \"85%\"\ncluster.routing.allocation.disk.watermark.high: \"90%\"\n\n# --- CLUSTER Y\u00d6NET\u0130M\u0130 ---\n# Node-1'de bu ismi yaz\u0131n:\ncluster.initial_master_nodes: [\"elastic1\"]\n\n\n# Node Rolleri ( viewer silindi, do\u011fru roller eklendi)\nnode.roles: [ master, data, ingest, remote_cluster_client ]\n\n# --- D\u0130\u011eER ---\nhttp.max_content_length: 500mb\n\nEOF<\/code><\/pre>\n\n\n\n
      <\/p>\n\n\n\n
      3.4. Node-2 (Data) Yap\u0131land\u0131rmas\u0131 (150.150.150.151)<\/h3>\n\n\n\n
      \u0130kinci sunucumuz verileri depolayacak. Yap\u0131land\u0131rma \u00e7ok benzer ama ufak farklar var.<\/p>\n\n\n\n
      cat <<EOF >> cat \/etc\/elasticsearch\/elasticsearch.yml\ncluster.name: elastic-cluster\nnode.name: elastic2\npath.data: \/data\/elasticsearch\/data\npath.logs: \/data\/elasticsearch\/logs\nbootstrap.memory_lock: true\n\nnetwork.host: 0.0.0.0\nhttp.port: 9200\ntransport.port: 9300\n\nhttp.host: [_local_, _ens34_]\ntransport.host: [_local_, _ens34_]\n\ndiscovery.seed_hosts: [\"150.150.150.150:9300\"]\n\nxpack.security.enabled: false\nxpack.security.http.ssl.enabled: false\nxpack.security.transport.ssl.enabled: false\n\nindices.memory.index_buffer_size: 20%\nindices.breaker.total.use_real_memory: true\nindices.fielddata.cache.size: 40%\nhttp.max_content_length: 500mb\n\nnode.roles: [ data, ingest, remote_cluster_client ]\n\nEOF<\/code><\/pre>\n\n\n\n
      <\/p>\n\n\n\n
      3.5. Bellek (RAM) Kilidi \u0130\u00e7in Son Dokunu\u015f<\/h3>\n\n\n\n
      B\u00f6l\u00fcm 2’de konu\u015ftu\u011fumuz “Memory Lock” olay\u0131n\u0131n tam \u00e7al\u0131\u015fmas\u0131 i\u00e7in servis dosyas\u0131n\u0131 d\u00fczenlemeliyiz.<\/p>\n\n\n\n
      Her iki sunucuda yap\u0131n:<\/strong><\/p>\n\n\n\n
        \n
      1. systemctl edit elasticsearch<\/code> komutunu yaz\u0131n.<\/li>\n\n\n\n
      2. A\u00e7\u0131lan bo\u015f ekrana \u015funu yap\u0131\u015ft\u0131r\u0131n ve kaydedip \u00e7\u0131k\u0131n (Ctrl+O, Enter, Ctrl+X):<\/li>\n<\/ol>\n\n\n\n
        <\/p>\n\n\n\n
        3.6. Servisleri Ba\u015flatma ve “Merhaba” Testi<\/h3>\n\n\n\n
        Her \u015fey haz\u0131r! \u015eimdi motorlar\u0131 \u00e7al\u0131\u015ft\u0131ral\u0131m.<\/p>\n\n\n\n
        # \u00d6nce Node-1'de, sonra Node-2'de \u00e7al\u0131\u015ft\u0131r\u0131n:\nsystemctl daemon-reload\nsystemctl enable elasticsearch\nsystemctl start elasticsearch<\/code><\/pre>\n\n\n\n
        <\/p>\n\n\n\n
        Nas\u0131l Kontrol Ederim?<\/strong> Taray\u0131c\u0131n\u0131zdan veya terminalden \u015fu adrese gidin: http:\/\/150.150.150.150:9200\/_cluster\/health?pretty<\/code><\/p>\n\n\n\n
        E\u011fer ekranda \u015funlar\u0131 g\u00f6r\u00fcyorsan\u0131z ba\u015fard\u0131n\u0131z:<\/p>\n\n\n\n
          \n
        • \"status\": \"green\"<\/code> veya \"yellow\"<\/code> (2 node’da ye\u015fil olmas\u0131 beklenir).<\/li>\n\n\n\n
        • \"number_of_nodes\": 2<\/code> (\u0130ki sunucu el s\u0131k\u0131\u015fm\u0131\u015f demektir).<\/li>\n<\/ul>\n\n\n\n
          curl -X GET \"http:\/\/150.150.150.150:9200\/\"\n{\n  \"name\" : \"elastic1\",\n  \"cluster_name\" : \"elastic-cluster\",\n  \"cluster_uuid\" : \"grVC1yn_SvmOj9oDC_9knQ\",\n  \"version\" : {\n    \"number\" : \"8.1.3\",\n    \"build_flavor\" : \"default\",\n    \"build_type\" : \"rpm\",\n    \"build_hash\" : \"39afaa3c0fe7db4869a161985e240bd7182d7a07\",\n    \"build_date\" : \"2022-04-19T08:13:25.444693396Z\",\n    \"build_snapshot\" : false,\n    \"lucene_version\" : \"9.0.0\",\n    \"minimum_wire_compatibility_version\" : \"7.17.0\",\n    \"minimum_index_compatibility_version\" : \"7.0.0\"\n  },\n  \"tagline\" : \"You Know, for Search\"\n}<\/code><\/pre>\n\n\n\n
          <\/p>\n\n\n\n
          http://150.150.150.150:9200\/_cluster\/health?pretty\n>>\t\n\t\ncluster_name\t\"elastic-cluster\"\nstatus\t\"green\"\ntimed_out\tfalse\nnumber_of_nodes\t2\nnumber_of_data_nodes\t2\nactive_primary_shards\t1\nactive_shards\t2\nrelocating_shards\t0\ninitializing_shards\t0\nunassigned_shards\t0\ndelayed_unassigned_shards\t0\nnumber_of_pending_tasks\t0\nnumber_of_in_flight_fetch\t0\ntask_max_waiting_in_queue_millis\t0\nactive_shards_percent_as_number\t100<\/code><\/pre>\n\n\n\n
          <\/p>\n\n\n\n
          \n\n\n\n
          B\u00f6l\u00fcm 4: Kibana 8.1.3 Kurulumu ve Yap\u0131land\u0131rmas\u0131<\/h2>\n\n\n\n
          Elasticsearch’\u00fc “kasa” olarak d\u00fc\u015f\u00fcn\u00fcrsek, Kibana onun “ekran\u0131” ve “klavyesi”dir.<\/p>\n\n\n\n
          4.1. Kibana Paketinin Kurulmas\u0131<\/h2>\n\n\n\n
          Sadece Node-1<\/strong> terminalinde \u015fu komutlar\u0131 \u00e7al\u0131\u015ft\u0131r:<\/p>\n\n\n\n
          # Paketi y\u00fckleyelim\nsudo rpm -ivh kibana-8.1.3-x86_64.rpm<\/code><\/pre>\n\n\n\n
          <\/p>\n\n\n\n
          4.2. Kibana Yap\u0131land\u0131rmas\u0131 (kibana.yml<\/code>)<\/h3>\n\n\n\n
          Senin Elasticsearch’te kulland\u0131\u011f\u0131n “SSL’siz ve \u015eifresiz” yap\u0131ya uygun olarak Kibana’y\u0131 ayarlayal\u0131m.<\/p>\n\n\n\n
          Node-1<\/strong>‘de \u015fu komutu \u00e7al\u0131\u015ft\u0131rarak dosyay\u0131 en g\u00fcncel ve hatas\u0131z haliyle olu\u015ftural\u0131m:<\/p>\n\n\n\n
          cat <<EOF >> cat \/etc\/kibana\/kibana.yml\nserver.port: 5601\nserver.host: \"0.0.0.0\"\nserver.name: \"blog-kibana\"\n\nserver.publicBaseUrl: \"http:\/\/150.150.150.150:5601\"\n\nelasticsearch.hosts: [\"http:\/\/150.150.150.150:9200\"]\n\nelasticsearch.requestTimeout: 300000\nelasticsearch.shardTimeout: 120000\n\nlogging:\n  appenders:\n    file:\n      type: file\n      fileName: \/var\/log\/kibana\/kibana.log\n      layout:\n        type: json\n    default:\n      type: console\n      layout:\n        type: pattern\n\nserver.compression.enabled: true\n\ni18n.locale: \"en\"\n\nxpack.monitoring.ui.container.elasticsearch.enabled: true\n\nEOF<\/code><\/pre>\n\n\n\n
          <\/p>\n\n\n\n
          4.3. Servisi Ba\u015flatma<\/h3>\n\n\n\n
          Kibana varsay\u0131lan olarak 5601<\/strong> portunu kullan\u0131r.<\/p>\n\n\n\n
          # Kibana servisini ba\u015flatal\u0131m\nsystemctl daemon-reload\nsystemctl enable kibana\nsystemctl start kibana<\/code><\/pre>\n\n\n\n
          <\/p>\n\n\n\n
          4.4. Aray\u00fcze \u0130lk Giri\u015f (Test)<\/h3>\n\n\n\n
          Kibana’n\u0131n aya\u011fa kalkmas\u0131 1-2 dakika s\u00fcrebilir. Servis ba\u015flad\u0131ktan sonra kendi bilgisayar\u0131ndaki taray\u0131c\u0131y\u0131 (Chrome\/Firefox) a\u00e7 ve \u015funu yaz:<\/p>\n\n\n\n
          http:\/\/150.150.150.150:5601<\/code><\/p>\n\n\n\n
          G\u00f6rmen Gereken:<\/strong> Herhangi bir \u015fifre sormadan do\u011frudan Kibana’n\u0131n ana sayfas\u0131n\u0131n (Welcome to Elastic) a\u00e7\u0131lmas\u0131.<\/p>\n\n\n\n
          <\/p>\n\n\n\n
          \n\n\n\n
          5: Logstash 8.1.3 Kurulumu ve Veri Hatt\u0131 (Pipeline) Olu\u015fturma<\/h2>\n\n\n\n
          Logstash<\/strong>, farkl\u0131 kaynaklardan gelen karma\u015f\u0131k verileri toplar, d\u00f6n\u00fc\u015ft\u00fcr\u00fcr ve Elasticsearch’e d\u00fczenli bir \u015fekilde nakleder. Bu b\u00f6l\u00fcm, blog projenin veriyi i\u015fleme mutfa\u011f\u0131d\u0131r.<\/p>\n\n\n\n
          5.1. Logstash Kurulumu (Node-1)<\/h3>\n\n\n\n
          Logstash’i genellikle Kibana ile ayn\u0131 sunucuya (Node-1) kurmak y\u00f6netim kolayl\u0131\u011f\u0131 sa\u011flar.<\/p>\n\n\n\n
          # Paketi y\u00fckleyelim\nsudo rpm -ivh logstash-8.1.3-x86_64.rpm<\/code><\/pre>\n\n\n\n
          <\/p>\n\n\n\n
          5.2. Logstash Performans ve Sistem Ayarlar\u0131<\/h3>\n\n\n\n
          Logstash bir Java uygulamas\u0131d\u0131r ve bellek (RAM) kullan\u0131m\u0131 kritiktir. K\u00fc\u00e7\u00fck\/Orta \u00f6l\u00e7ekli bir blog projesi i\u00e7in varsay\u0131lan 1GB RAM ayar\u0131 yeterlidir, ancak sunucun k\u0131s\u0131tl\u0131ysa bunu optimize etmelisin.<\/p>\n\n\n\n
          JVM Ayar\u0131:<\/strong> \/etc\/logstash\/jvm.options<\/code> dosyas\u0131nda -Xms1g<\/code> ve -Xmx1g<\/code> de\u011ferlerini sunucunun yar\u0131s\u0131 kadar (veya ba\u015flang\u0131\u00e7 i\u00e7in 512mb) ayarlayabilirsin.<\/p>\n\n\n\n
          cat \/etc\/logstash\/jvm.options |grep \"Xm\"\n# Xms represents the initial size of total heap space\n# Xmx represents the maximum size of total heap space\n-Xms1g\n-Xmx1g<\/code><\/pre>\n\n\n\n
          <\/p>\n\n\n\n
          5.3. \u0130lk Pipeline (Veri Ak\u0131\u015f Hatt\u0131) Olu\u015fturma<\/h3>\n\n\n\n
          Logstash’in \u00e7al\u0131\u015fmas\u0131 i\u00e7in bir Konfig\u00fcrasyon Dosyas\u0131<\/strong> gerekir. Bu dosya 3 ana b\u00f6l\u00fcmden olu\u015fur: Input<\/strong> (Giri\u015f), Filter<\/strong> (Filtre\/D\u00fczenleme) ve Output<\/strong> (\u00c7\u0131k\u0131\u015f).<\/p>\n\n\n\n
          \/etc\/logstash\/conf.d\/logstash-blog.conf<\/code> ad\u0131nda bir dosya olu\u015ftural\u0131m:<\/p>\n\n\n\n
          cat <<EOF > \/etc\/logstash\/conf.d\/logstash-blog.conf\ninput {\n  beats {\n    port => 5044\n  }\n  \n  tcp {\n    port => 5000\n    codec => json\n  }\n}\n\nfilter {\n  # Filtreler buraya gelecek\n}\n\noutput {\n  elasticsearch {\n    hosts => [\"http:\/\/150.150.150.150:9200\"]\n    index => \"blog-loglari-%{+YYYY.MM.dd}\"\n  }\n  \n  stdout { codec => rubydebug }\n}\nEOF<\/code><\/pre>\n\n\n\n
          <\/p>\n\n\n\n
          5.4. Logstash Servisini Ba\u015flatma<\/h3>\n\n\n\n
          # Servisi aktif et ve ba\u015flat\nsystemctl daemon-reload\nsystemctl enable logstash\nsystemctl start logstash<\/code><\/pre>\n\n\n\n
          <\/p>\n\n\n\n
          \n\n\n\n
          <\/p>\n