Elasticsearch：使用 Elasticsearch Java client 8.0 来连接带有 HTTPS 的集群_Elastic 中国社区官方

网络投稿 02-07 7847

在我之前的教程 “Elasticsearch：使用最新的 Elasticsearch Java client 8.0 来创建索引并搜索”，我详述了如何使用 Java client 8.0 来连接一个 Elasticsearch 8.x 的集群。在那个例子中，我们的 Elasticsearch 集群是不带有 HTTPS 的安全设置的。在 Elasticsearch 8.x 的安装中，HTTPS 的配置是默认的，而且它的证书是自签名的。我们该如何修改我们的 Java 客户端代码来进行含有证书的连接呢？

如果你还没有安装好自己的 Elasticsearch 集群，你可以参考我之前的文章 “如何在 Linux，MacOS 及 Windows 上进行安装 Elasticsearch” 来进行安装。

在接下来的示例中，我将使用 Elasticsearch 8.1.1 来进行展示。为了大家更好地理解我下面的代码，我把代码放到 github 上。你可以通过如下的命令来进行下载：

git clone https://github.com/liu-xiao-guo/elasticsearchjava-search8-https

在这篇文章中，我着重来讲一下和 Elasticsearch 的连接部分。其它的展示和之前的文章??“Elasticsearch：使用最新的 Elasticsearch Java client 8.0 来创建索引并搜索” 类似。

使用 Elasticsearch Java client 8.0 来连接带有 HTTPS 的集群

使用 Elasticsearch Java client 8.0 来连接带有 HTTPS 的集群_哔哩哔哩_bilibili

使用用户名及密码来进行连接

我们可以使用自己账号的用户名及密码来进行连接。在我们的展示中，我使用超级用户 elastic 来进行展示：

private static synchronized void makeConnection_https() throws CertificateException, IOException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException { final CredentialsProvider credentialsProvider = new BasicCredentialsProvider(); credentialsProvider.setCredentials(AuthScope.ANY, new UsernamePasswordCredentials("elastic", "FW5S2hBXhCNZDZ7BX9O-")); Path caCertificatePath = Paths.get("/Users/liuxg/test/elasticsearch-8.1.2/config/certs/http_ca.crt"); CertificateFactory factory = CertificateFactory.getInstance("X.509"); Certificate trustedCa; try (InputStream is = Files.newInputStream(caCertificatePath)) { trustedCa = factory.generateCertificate(is); } KeyStore trustStore = KeyStore.getInstance("pkcs12"); trustStore.load(null, null); trustStore.setCertificateEntry("ca", trustedCa); SSLContextBuilder sslContextBuilder = SSLContexts.custom() .loadTrustMaterial(trustStore, null); final SSLContext sslContext = sslContextBuilder.build(); RestClientBuilder builder = RestClient.builder( new HttpHost("localhost", 9200, "https")) .setHttpClientConfigCallback(new RestClientBuilder.HttpClientConfigCallback() { @Override public HttpAsyncClientBuilder customizeHttpClient( HttpAsyncClientBuilder httpClientBuilder) { return httpClientBuilder.setSSLContext(sslContext) .setDefaultCredentialsProvider(credentialsProvider); } }); RestClient restClient = builder.build(); // Create the transport with a Jackson mapper ElasticsearchTransport transport = new RestClientTransport( restClient, new JacksonJsonpMapper()); client = new ElasticsearchClient(transport); asyncClient = new ElasticsearchAsyncClient(transport); }

如上所示，我们需要修改账号 elastic 的密码以及证书的路径。一旦 client 及 asyncClient 被创建，那么我们就可以使用它们来进行操作。

使用 API key 来进行访问

我们创建如下的?makeConnection_token() 方法来进行连接：

private static synchronized void makeConnection_token() throws CertificateException, IOException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException { Path caCertificatePath = Paths.get("/Users/liuxg/test/elasticsearch-8.1.2/config/certs/http_ca.crt"); CertificateFactory factory = CertificateFactory.getInstance("X.509"); Certificate trustedCa; try (InputStream is = Files.newInputStream(caCertificatePath)) { trustedCa = factory.generateCertificate(is); } KeyStore trustStore = KeyStore.getInstance("pkcs12"); trustStore.load(null, null); trustStore.setCertificateEntry("ca", trustedCa); SSLContextBuilder sslContextBuilder = SSLContexts.custom() .loadTrustMaterial(trustStore, null); final SSLContext sslContext = sslContextBuilder.build(); RestClientBuilder builder = RestClient.builder( new HttpHost("localhost", 9200, "https")) .setHttpClientConfigCallback(new RestClientBuilder.HttpClientConfigCallback() { @Override public HttpAsyncClientBuilder customizeHttpClient( HttpAsyncClientBuilder httpClientBuilder) { return httpClientBuilder.setSSLContext(sslContext); } }); // String apiKeyId = "SY6uOoABwRrDJxOdlx78"; // String apiKeySecret = "E8Ae8-FgScqT-nXCSBN0ew"; // String apiKeyAuth = // Base64.getEncoder().encodeToString( // (apiKeyId + ":" + apiKeySecret) // .getBytes(StandardCharsets.UTF_8)); // Header[] defaultHeaders = // new Header[]{new BasicHeader("Authorization", // "ApiKey " + apiKeyAuth)}; // builder.setDefaultHeaders(defaultHeaders); Header[] defaultHeaders = new Header[]{new BasicHeader("Authorization", "ApiKey U1k2dU9vQUJ3UnJESnhPZGx4Nzg6RThBZTgtRmdTY3FULW5YQ1NCTjBldw==")}; builder.setDefaultHeaders(defaultHeaders); RestClient restClient = builder.build(); // Create the transport with a Jackson mapper ElasticsearchTransport transport = new RestClientTransport( restClient, new JacksonJsonpMapper()); client = new ElasticsearchClient(transport); asyncClient = new ElasticsearchAsyncClient(transport); }

有关如何创建这个 API key，你可以参阅我之前的文章 “Elasticsearch：创建 API key 接口访问 Elasticsearch”。如果你不想手动来创建，那么你可以使用如下的 Kibana UI 来创建：

其它的操作和之前的文章介绍的是一样的。这里就不再累述了。?

参考：

【1】Other authentication methods | Elasticsearch Java API Client [8.1] | Elastic

【2】Encrypted communication | Elasticsearch Java API Client [8.1] | Elastic