Elasticsearch multi-node cluster

Prerequisites

Adding the Elastic Stack repository

The addition of Elastic Stack repository must be done in all Elasticsearch cluster nodes.

Elasticsearch installation and configuration

Install the Elasticsearch package:

YumAPTZYpp

# yum install elasticsearch-7.9.3

Once Elasticsearch is installed it has to be configured by downloading and editing the file /etc/elasticsearch/elasticsearch.yml as follows:

# curl -so /etc/elasticsearch/elasticsearch.yml https://raw.githubusercontent.com/wazuh/wazuh-documentation/4.0/resources/elastic-stack/elasticsearch/7.x/elasticsearch_cluster_initial_node.yml

The file /etc/elasticsearch/elasticsearch.yml has to be edited:

network.host: <elasticsearch_ip>
node.name: elasticsearch-1
cluster.name: elasticsearch_cluster
cluster.initial_master_nodes:
        - elasticsearch-1
        - elasticsearch-2
        - elasticsearch-3
discovery.seed_hosts:
        - <elasticsearch_ip_node1>
        - <elasticsearch_ip_node2>
        - <elasticsearch_ip_node3>

Depending on the node type, some parameters may vary between nodes. cluster.initial_master_nodes and discovery.seed_hosts are lists of all the master-eligible nodes in the cluster. The parameter node.master: false must be included in every Elasticsearch node that will not be configured as master.

Values to be replaced:

• <elasticsearch_ip>: the host's IP. E.g.: 10.0.0.2.

• <elasticsearch_ip_nodeX> Elasticsearch cluster master-eligible nodes IP. E.g.: 10.0.0.3.

Certificates creation and deployment

1. This step implies the selection of the Wazuh cluster mode. Choose between Wazuh single-node cluster, if having only one Wazuh server, and Wazuh multi-node cluster in case of having two or more Wazuh servers.

   Wazuh single-node clusterWazuh multi-node cluster

   The instances file /usr/share/elasticsearch/instances.yml can be created as follows:

   cat > /usr/share/elasticsearch/instances.yml <<\EOF
   instances:
   - name: "elasticsearch-1"
     ip:
     - "10.0.0.2"
   - name: "elasticsearch-2"
     ip:
     - "10.0.0.3"
   - name: "elasticsearch-3"
     ip:
     - "10.0.0.4"
   - name: "filebeat"
     ip:
     - "10.0.0.5"
   - name: "kibana"
     ip:
     - "10.0.0.6"
   EOF
   

   Every name section corresponds to one host in the Wazuh - Elastic Stack environment. In this example, the file describes:

   • A filebeat instance with IP 10.0.0.5. It is a Wazuh single-node cluster.

   • Three elasticsearch instances, #1, #2 and #3 with their respective IPs 10.0.0.2, 10.0.0.3 and 10.0.0.4. All belong to three Elasticsearch cluster nodes. In case of configuring an Elasticsearch multi-node cluster with four or more nodes, more name sections can be defined with their respective names and IPs.

   • A kibana instance with IP 10.0.0.6. If Kibana will be installed in the same server as Elasticsearch, the same IP may be used.

   Replace the IPs with the corresponding addresses for each instance in your environment.

   Create the certificates using the elasticsearch-certutil tool:

   # /usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in instances.yml --keep-ca-key --out ~/certs.zip
   

   The resulting file certs.zip contains a directory for each instance included in instances.yml. Each directory contains a certificate and a private key necessary to secure communications.

2. Copy ~/certs.zip to all the servers of the distributed deployment. This can be done by using, for example, scp..

3. The next step is to create the directory /etc/elasticsearch/certs, and then copy the CA file, the certificate and the key there.

   # unzip ~/certs.zip -d ~/certs
   # mkdir /etc/elasticsearch/certs/ca -p
   # cp -R ~/certs/ca/ ~/certs/elasticsearch-1/* /etc/elasticsearch/certs/
   # mv /etc/elasticsearch/certs/elasticsearch-1.crt /etc/elasticsearch/certs/elasticsearch.crt
   # mv /etc/elasticsearch/certs/elasticsearch-1.key /etc/elasticsearch/certs/elasticsearch.key
   # chown -R elasticsearch: /etc/elasticsearch/certs
   # chmod -R 500 /etc/elasticsearch/certs
   # chmod 400 /etc/elasticsearch/certs/ca/ca.* /etc/elasticsearch/certs/elasticsearch.*
   # rm -rf ~/certs
   

4. If Kibana will be installed in this node, keep the certificates file. Otherwise, if the file has been copied already to all the instances of the distributed deployment, remove it to increase security rm -f ~/certs.zip.

5. Enable and start the Elasticsearch service:

   SystemdSysV Init

   # systemctl daemon-reload
   # systemctl enable elasticsearch
   # systemctl start elasticsearch
   

Prerequisites

Adding the Elastic Stack repository

The addition of Elastic Stack repository must be done in all Elasticsearch cluster nodes.

Elasticsearch installation and configuration

1. Install the Elasticsearch package:

YumAPTZYpp

# yum install elasticsearch-7.9.3

Once Elasticsearch is installed it has to be configured by downloading and editing the file /etc/elasticsearch/elasticsearch.yml as follows:

# curl -so /etc/elasticsearch/elasticsearch.yml https://raw.githubusercontent.com/wazuh/wazuh-documentation/4.0/resources/elastic-stack/elasticsearch/7.x/elasticsearch_cluster_subsequent_nodes.yml

The file /etc/elasticsearch/elasticsearch.yml has to be edited:

network.host: <elasticsearch_ip>
node.name: <elasticsearch-X>
cluster.name: elasticsearch_cluster
cluster.initial_master_nodes:
        - elasticsearch-1
        - elasticsearch-2
        - elasticsearch-3
discovery.seed_hosts:
        - <elasticsearch_ip_node1>
        - <elasticsearch_ip_node2>
        - <elasticsearch_ip_node3>

Depending on the node type, some parameters may vary between nodes. cluster.initial_master_nodes and discovery.seed_hosts are lists of all the master-eligible nodes in the cluster. The parameter node.master: false must be included in every Elasticsearch node that will not be configured as master.

Values to be replaced:

• <elasticsearch_ip>: the host's IP. E.g.: 10.0.0.2.

• <node_name>: The node name, change the X for your node number. E.g.: elasticsearch-2.

• <elasticsearch_ip_nodeX> Elasticsearch cluster master-eligible nodes IP. E.g.: 10.0.0.3.

For more information, please see important discovery and cluster formation settings.

Certificates deployment

1. The next step is to create the directory /etc/elasticsearch/certs, and then copy the CA file, the certificate and the key there. The X must be replaced according to the defined data in instances.yml file:

   # unzip ~/certs.zip -d ~/certs
   # rm -f ~/certs/ca/ca.key
   # mkdir /etc/elasticsearch/certs/ca -p
   # cp -R ~/certs/ca/ ~/certs/elasticsearch-X/* /etc/elasticsearch/certs/
   # mv /etc/elasticsearch/certs/elasticsearch-X.crt /etc/elasticsearch/certs/elasticsearch.crt
   # mv /etc/elasticsearch/certs/elasticsearch-X.key /etc/elasticsearch/certs/elasticsearch.key
   # chown -R elasticsearch: /etc/elasticsearch/certs
   # chmod -R 500 /etc/elasticsearch/certs
   # chmod 400 /etc/elasticsearch/certs/ca/ca.* /etc/elasticsearch/certs/elasticsearch.*
   # rm -rf ~/certs
   

2. If Kibana will be installed in this node, keep the certificates file. Otherwise, remove it to increase security rm -f ~/certs.zip.

3. Enable and start the Elasticsearch service:

   SystemdSysV Init

   # systemctl daemon-reload
   # systemctl enable elasticsearch
   # systemctl start elasticsearch