12.2 Installing and Configuring Elasticsearch

You must install Elasticsearch and the required plug-ins on each node of the Elasticsearch cluster.

To install and configure Elasticsearch:

  1. Install the JDK version supported by Elasticsearch.

  2. Download the certified version of Elasticsearch RPM. For information about the certified version of Elasticsearch and the download URL, see the Technical Information for Sentinel page.

  3. Install Elasticsearch:

    rpm -i elasticsearch-<version>.rpm

  4. Complete the tasks as mentioned on-screen in the RPM post-installation instructions.

  5. Ensure that the Elasticsearch user has access to Java.

  6. Configure the /etc/elasticsearch/elasticsearch.yml file by updating or adding the following information:

    Property and Value

    Notes

    cluster.name: <Elasticsearch _cluster_name>

    The cluster name that you specify must be same for all the nodes.

    node.name: <node_name>

    The node name must be unique for each node.

    network.host: _<networkInterface>:ipv4_

     

    discovery.zen.ping.unicast.hosts: [<FQDN of the elasticsearch node in the Sentinel server>,<FQDN of elasticsearch node1>, <FQDN of elasticsearch node2>, and so on]

     

    thread_pool.bulk.queue_size: 300

     

    thread_pool.search.queue_size: 10000

    Once the search queue size reaches its limit, Elasticsearch discards any pending search requests in queue.

    You can increase the search queue size based on the below calculation:threadpool.search.queue_size = Average number of widget queries per user for a dashboard x number of shards (per day index) x number of days (search duration)

    index.codec: best_compression 

     

    path.data: ["/<es1>", "/<es2>"]

    Spread data across multiple independent disks or locations to reduce the disk I/O latency.

    Configure multiple paths for storing Elasticsearch data. For example /es1, /es2, and so on.

    For best performance and manageability, mount each path to a separate physical disk (JBOD).

  7. Update the default Elasticsearch heap size in the /etc/elasticsearch/jvm.options file.

    The heap size must be 50% of the server memory. For example, on a 24 GB Elasticsearch node, allocate 12 GB as the heap size for optimal performance.

  8. Repeat all of the above steps on each node of the Elasticsearch cluster.

  9. In the Sentinel server Elasticsearch node, configure the /opt/novell/sentinel/3drparty/elastcisearch/config/elasticsearch.yml as follows:

    1. Ensure that the values of cluster.name and discovery.zen.ping.unicast.hosts in the elasticsearch.yml file are same as the elasticsearch.yml file in external Elasticsearch node.

    2. Specify the localhost IP address followed by the IP address of the local Elasticsearch node in the network.host property as follows:

      network.host: ["127.0.0.1","<IP address of the Elasticsearch node in Sentinel>"]

  10. (Conditional) For Sentinel with traditional storage, add the external Elasticsearch nodes IP addresses to the ServerList property in the/etc/opt/novell/sentinel/config/elasticsearch-index.properties file.

    For example: ServerList=<Elasticsearch IP1>:<Port>,<Elasticsearch IP2>:<Port>

  11. Restart Sentinel:

    rcsentinel restart

  12. Restart each Elasticsearch node:

    /etc/init.d/elasticsearch start

  13. For optimal performance and stability of the Sentinel server, configure the Elasticsearch node in the Sentinel server as a dedicated master-eligible node so that all the event visualization data is indexed in external Elasticsearch nodes:

    1. Log in to the Sentinel server as novell user.

    2. Ensure that all the existing alert data has been moved to external Elasticsearch nodes.

    3. Open the file and/opt/novell/sentinel/3drparty/elastcisearch/config/elasticsearch.yml add the following information:

      node.master: true 
node.data: false 
node.ingest: false 
search.remote.connect: false

    4. Restart Elasticsearch:

      rcsentinel stopSIdb

      rcsentinel startSIdb

  14. Proceed with Securing Data in Elasticsearch.