在破解x-pack前，先确认ELK 6.5.4集群运行是否正常

替换 x-pack-core-6.5.4.jar

创建破解文件夹，拷贝出以下文件到该文件夹内：

[root@k8s-node02 ~]# mkdir ~/x-pack-crack
[root@k8s-node02 ~]# cp -rf /usr/local/elasticsearch-6.5.4/modules/x-pack-core/x-pack-core-6.5.4.jar ~/x-pack-crack/
[root@k8s-node02 ~]# cp -rf /usr/local/elasticsearch-6.5.4/lib/lucene-core-7.5.0.jar ~/x-pack-crack/
[root@k8s-node02 ~]# cp -rf /usr/local/elasticsearch-6.5.4/lib/elasticsearch-core-6.5.4.jar ~/x-pack-crack/
[root@k8s-node02 ~]# cp -rf /usr/local/elasticsearch-6.5.4/lib/elasticsearch-6.5.4.jar ~/x-pack-crack/

新建LicenseVerifier.java 和 XPackBuild.java

[root@k8s-node02 ~]# vi ~/x-pack-crack/LicenseVerifier.java
package org.elasticsearch.license;
import java.nio.*; import java.util.*;
import java.security.*;
import org.elasticsearch.common.xcontent.*;
import org.apache.lucene.util.*;
import org.elasticsearch.common.io.*;
import java.io.*;

public class LicenseVerifier {
    public static boolean verifyLicense(final License license, final byte[] encryptedPublicKeyData) {
        return true;
    }

    public static boolean verifyLicense(final License license)     {
        return true;
    }
}
[root@k8s-node02 ~]# vi ~/x-pack-crack/XPackBuild.java
package org.elasticsearch.xpack.core;
import org.elasticsearch.common.io.*;
import java.net.*;
import org.elasticsearch.common.*;
import java.nio.file.*;
import java.io.*;
import java.util.jar.*;
public class XPackBuild {
    public static final XPackBuild CURRENT;
    private String shortHash;
    private String date;
    @SuppressForbidden(reason = "looks up path of xpack.jar directly") static Path getElasticsearchCodebase() {
        final URL url = XPackBuild.class.getProtectionDomain().getCodeSource().getLocation();
        try { return PathUtils.get(url.toURI()); }
        catch (URISyntaxException bogus) {
            throw new RuntimeException(bogus); }
        }

    XPackBuild(final String shortHash, final String date) {
            this.shortHash = shortHash;
            this.date = date;
            }

    public String shortHash() {
        return this.shortHash;
        }
    public String date(){
        return this.date;
        }

    static {
        final Path path = getElasticsearchCodebase();
        String shortHash = null;
        String date = null;
        Label_0157: { shortHash = "Unknown"; date = "Unknown";
    }

    CURRENT = new XPackBuild(shortHash, date);
    }
}

编译 LicenseVerifier.java 和 XPackBuild.java

[root@k8s-node02 ~]# cd ~/x-pack-crack/
[root@k8s-node02 x-pack-crack]# javac -cp "~/x-pack-crack/elasticsearch-6.5.4.jar:~/x-pack-crack/lucene-core-7.5.0.jar:~/x-pack-crack/x-pack-core-6.5.4.jar" LicenseVerifier.java
[root@k8s-node02 x-pack-crack]# javac -cp "~/x-pack-crack/elasticsearch-6.5.4.jar:~/x-pack-crack/lucene-core-7.5.0.jar:~/x-pack-crack/x-pack-core-6.5.4.jar:~/x-pack-crack/elasticsearch-core-6.5.4.jar"  XPackBuild.java

重新打包 x-pack-core-6.5.4.jar

编译完成后，替换 x-pack-core-6.5.4.jar 中的 LicenseVerifier.class 和 XPackBuild.class，重新打包 x-pack-core-6.5.4.jar。

mkdir ~/tempJar
cp ~/x-pack-crack/x-pack-core-6.5.4.jar ~/tempJar/
jar -xf ~/tempJar/x-pack-core-6.5.4.jar
cp ~/x-pack-crack/LicenseVerifier.class ~/tempJar/org/elasticsearch/license/
cp ~/x-pack-crack/XPackBuild.class ~/tempJar/org/elasticsearch/xpack/core/
rm ~/tempJar/x-pack-core-6.5.4.jar
jar -cvf ~/tempJar/x-pack-core-6.5.4.jar ~/tempJar/*

作者已经做好了x-pack-core-6.5.4.jar，针对于6.5.4可以直接下载使用
下载链接：https://pan.baidu.com/s/1mdIOOXTfIvQI8AP0KgPpgQ
提取码：hhgk

替换 x-pack-core-6.5.4.jar

[root@k8s-node02 ~]# mv /usr/local/elasticsearch-6.5.4/modules/x-pack-core/x-pack-core-6.5.4.jar  ~
[root@k8s-node02 ~]# cp ~/tempJar/x-pack-core-6.5.4.jar /usr/local/elasticsearch-6.5.4/modules/x-pack-core/

重启ES、Kibana、Logstash。

官网申请 license 证书

链接：https://license.elastic.co/registration
1、邮箱认真填写，用来接收json文件
2、country选择china，其他都可以随便写
3、点击申请后邮箱马上会收到一个证书JSON文件，把他下载下来。

修改收到的json文件：

• “type”:“basic” 替换为 “type”:“platinum” # 基础版变更为铂金版
• “expiry_date_in_millis”:1561420799999 替换为 “expiry_date_in_millis”:3107746200000 # 1个月变为50年

修改完成之后上传json文件

[root@k8s-node02 ~]# curl -XPUT  'http://172.16.3.225:9200/_xpack/license' -H "Content-Type: application/json" -d @license.json

返回结果如下：

{“error”:{“root_cause”:[{“type”:“illegal_argument_exception”,“reason”:“failed to parse license source”}],“type”:“illegal_argument_exception”,“reason”:“failed to parse license source”,“caused_by”:{“type”:“json_parse_exception”,“reason”:“Unrecognized token ‘license’: was expecting (‘true’, ‘false’ or ‘null’)\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@31271e62; line: 1, column: 9]”}},“status”:400}

破解的时候，需要关闭权限认证（所有的机器都要修改）

[root@k8s-node02 ~]# vi /usr/local/elasticsearch/conf/es.yml ，修改为false，重启ES。
xpack.security.enabled: false

如果通过 curl 上传 json 失败，可以通过登录kibana，访问【Management】->【Elasticsearch】->【License Management】

传成功后显示Your license will expire on June 24, 2068 2:50 PM CST

开启权限认证，重启ES

[root@k8s-node02 ~]# vi /usr/local/elasticsearch/conf/es.yml ，修改为true
xpack.security.enabled: true
[root@k8s-node02 elasticsearch-6.5.4]$ bin/elasticsearch-setup-passwords interactive  # 手动创建密码
[root@k8s-node02 elasticsearch-6.5.4]$ bin/elasticsearch-setup-passwords auto		  # 自动生成

重启ES。

启动过程中报错：

ERROR: [1] bootstrap checks failed
[1]: Transport SSL must be enabled for setups with production licenses. Please set [xpack.security.transport.ssl.enabled] to [true] or disable security by setting [xpack.security.enabled] to [false]

需要配置SSL。

这里就不讲这么配置SSL了如果想看这么配置SSL请看：

https://blog.csdn.net/qq_43164571/article/details/114979227?spm=1001.2014.3001.5502