12.2 Installing and Configuring Elasticsearch

To install and configure Elasticsearch:

1. Install the JDK version supported by Elasticsearch.

2. Ensure that the Elasticsearch user has access to Java.

3. Download the certified version of Elasticsearch RPM. For more information about the certified version of Elasticsearch and the download URL, see the Sentinel System Requirements page.

4. Install Elasticsearch:

   rpm -ivh elasticsearch-<version>.rpm

5. Complete the tasks as mentioned on-screen in the RPM post-installation instructions.

6. Configure the /etc/elasticsearch/elasticsearch.yml file by updating or adding the following information:

   Property and Value	Notes
   discovery.seed_hosts: [<IP of the master eligible elasticsearch node in the cluster>,<IP of the master eligible elasticsearch node in the cluster>, <IP of the master eligible elasticsearch node in the cluster>, and so on]
   cluster.name: <Elasticsearch _cluster_name>	The cluster name that you specify must be same for all the nodes.
   node.name: <node_name>	The node name must be unique for each node.
   network.host: _<networkInterface>:ipv4_	If you are using hostname instead of IP address, make sure that the hostname is resolvable by all the nodes in the Elasticsearch cluster and the Sentinel server.
   thread_pool.write.queue_size: 300
   thread_pool.search.queue_size: 10000	Once the search queue size reaches its limit, Elasticsearch discards any pending search requests in queue. You can increase the search queue size based on the below calculation:threadpool.search.queue_size = Average number of widget queries per user for a dashboard x number of shards (per day index) x number of days (search duration)
   index.codec: best_compression
   path.data: ["/<es1>", "/<es2>"]	Spread data across multiple independent disks or locations to reduce the disk I/O latency. Configure multiple paths for storing Elasticsearch data. For example /es1, /es2, and so on. For best performance and manageability, mount each path to a separate physical disk (JBOD).

7. Repeat all of the above steps on each external Elasticsearch nodes of the Elasticsearch cluster.

8. In the Sentinel server Elasticsearch node, configure the <sentinel_installation_path>/opt/novell/sentinel/3drparty/elasticsearch/config/elasticsearch.yml as follows:

   1. Ensure that the values of cluster.name and discovery.seed_hosts in the elasticsearch.yml file are same as the elasticsearch.yml file in external Elasticsearch node.

9. (Conditional) For Sentinel with traditional storage, add the external Elasticsearch nodes IP addresses to the ServerList property in the <sentinel_installation_path>/etc/opt/novell/sentinel/config/elasticsearch-index.properties file.

   For example: ServerList=<Elasticsearch_IP1>:<Port>,<Elasticsearch IP2>:<Port>

10. Restart Sentinel:

    rcsentinel restart

11. Restart each external Elasticsearch node:

    /etc/init.d/elasticsearch restart

12. Verify that the ES cluster is formed:

     curl -X GET http://<Elasticsearch_IP_of_the_Sentinel_server>:<Port>/_cat/nodes?v

13. Ensure that all the existing alert data and event data (if available), it must be moved to the external Elasticsearch nodes.

14. For optimal performance and stability of the Sentinel server, configure the Elasticsearch node in the Sentinel server as a dedicated master-eligible node so that all the event visualization data is indexed in external Elasticsearch nodes:

    1. Stop the internal node (Sentinel server)

        rcsentinel stopES

    2. Set the following in the internal node:

       node.master: true 
       node.data: false 
       node.ingest: false 

    3. Run elasticsearch-node repurpose to clean all the shards

       <sentinel_installation_path>/opt/novell/sentinel/
       3rdparty/elasticsearch/bin/elasticsearch-node -v 
       repurpose

    4. Start the internal Elasticsearch node

       rcsentinel startES

    5. Restart each external Elasticsearch node:

       /etc/init.d/elasticsearch restart

15. Proceed with Securing Data in Elasticsearch.