- Elastic Cloud Enterprise - Elastic Cloud on your Infrastructure: other versions:
- Introducing Elastic Cloud Enterprise
- Preparing your installation
- Installing Elastic Cloud Enterprise
- Identify the deployment scenario
- Install ECE with Ansible
- Install ECE on a public cloud
- Install ECE on your own premises
- Log into the Cloud UI
- Install ECE on additional hosts
- Post-installation steps
- Configuring your installation
- Securing your installation
- Monitoring your installation
- Administering your installation
- Getting started with deployments
- Administering deployments
- Change your deployment configuration
- Stop routing requests or pause nodes
- Terminate a deployment
- Restart a deployment
- Restore a deployment
- Delete a deployment
- Migrate to index lifecycle management
- Access the Elasticsearch API console
- Work with snapshots
- Upgrade versions
- Upgrade App Search to Enterprise Search
- Editing your user settings
- Configure Beats and Logstash with Cloud ID
- Keep your clusters healthy
- Secure your clusters
- Reset the password for the
elastic
user - Manage users and roles in X-Pack
- Manage users and roles in Shield
- Configure the Java Transport client
- Secure your settings
- Secure your 7.x clusters with LDAP
- Secure your 7.x clusters with Active Directory
- Secure your 5.x and 6.x clusters with LDAP
- Secure your 5.x and 6.x clusters with Active Directory
- Secure your clusters with SAML
- Secure your clusters with OpenID Connect
- Secure your clusters with Kerberos
- Reset the password for the
- Traffic Filtering
- Manage your Kibana instance
- Manage your APM Server
- Enable Graph (versions before 5.0)
- Enable logging and monitoring
- Connect to your cluster
- Enable cross-cluster search
- Enable App Search
- Enable Enterprise Search
- Troubleshooting
- RESTful API
- Authentication
- API calls
- Access the API from the Command Line
- Create an API client
- API examples
- Setting up your environment
- A first API call: What deployments are there?
- Create a first deployment: Just an Elasticsearch cluster
- Create a Deployment: Elasticsearch Cluster and Kibana instance
- Updating a deployment: Resize and add high availability
- Updating a deployment: Checking on progress
- Applying a new deployment configuration: Upgrade
- Enable more stack features: Add Kibana to a deployment
- Dipping a toe into platform automation: Generate a roles token
- Customize your deployment
- Remove unwanted deployment templates and instance configurations
- Secure your settings
- API reference
- API - Base Url
- APM routes
- App Search - Read-only
- Authentication
- User authentication information
- Disable elevated permissions
- Enable elevated permissions
- Login to ECE
- Logout from ECE
- Refresh authentication token
- Delete API keys
- Get all API keys
- Create API key
- Delete API keys of multiple users
- Get all API keys for all users
- Delete API key
- Get API key
- Available authentication methods
- Re-authenticate to generate a token
- SAML callback
- Initiate SAML protocol
- Delete API keys for a user
- Get all API keys for a user
- Delete an API key for a user
- Get a user API key
- Clusters - Apm - CRUD
- Clusters - Apm - CRUD - Configuration
- Clusters - Apm - Commands
- Resynchronize clusters
- Search clusters
- Restart cluster
- Resynchronize cluster
- Shut down cluster
- Upgrade cluster
- Move instances (advanced)
- Start all instances
- Stop all instances
- Start maintenance mode all instances
- Stop maintenance mode all instances
- Move instances
- Start instances
- Stop instances
- Start maintenance mode
- Stop maintenance mode
- Clusters - Elasticsearch - CRUD
- Clusters - Elasticsearch - CRUD - Configuration
- Get cross-cluster search clusters
- Get remote clusters for cross-cluster search
- Set remote clusters for cross-cluster search
- Get cluster curation settings
- Update cluster curation settings
- Set settings overrides (all instances)
- Set settings overrides
- Get settings from this cluster’s keystore
- Add or remove settings from the cluster keystore
- Set cluster name
- Get cluster metadata
- Set cluster metadata
- Get cluster metadata settings
- Update cluster metadata settings
- Cancel monitoring
- Set monitoring
- Get plan
- Update plan
- Migrate plan
- Get plan activity
- Cancel pending plan
- Get pending plan
- Set legacy security settings
- Get cluster snapshot settings
- Update cluster snapshot settings
- Clusters - Elasticsearch - Commands
- Resynchronize clusters
- Search clusters
- Restart cluster
- Resynchronize cluster
- Shut down cluster
- Take snapshot
- Move instances (advanced)
- Start all instances
- Stop all instances
- Start maintenance mode all instances
- Stop maintenance mode all instances
- Move instances
- Start instances
- Stop instances
- Start maintenance mode
- Stop maintenance mode
- Clusters - Elasticsearch - Proxy
- Clusters - Elasticsearch - Support
- Clusters - Kibana - CRUD
- Clusters - Kibana - CRUD - Configuration
- Clusters - Kibana - Commands
- Resynchronize clusters
- Search clusters
- Restart cluster
- Resynchronize cluster
- Shut down cluster
- Upgrade cluster
- Move instances (advanced)
- Start all instances
- Stop all instances
- Start maintenance mode all instances
- Stop maintenance mode all instances
- Move instances
- Start instances
- Stop instances
- Start maintenance mode
- Stop maintenance mode
- Clusters - Kibana - Proxy
- Clusters - Search
- Comments
- Deployment - CRUD
- Deployment - Commands
- Search Deployments
- Migrate Elasticsearch resource to use ILM
- Migrate Elasticsearch resource to use SLM
- Reset elastic user password
- Restart Deployment Elasticsearch Resource
- Shutdown Deployment Elasticsearch Resource
- Start all instances
- Stop all instances
- Start maintenance mode (all instances)
- Stop maintenance mode (all instances)
- Start instances
- Stop instances
- Start maintenance mode
- Stop maintenance mode
- Restart Deployment Stateless Resource
- Shutdown Deployment Stateless Resource
- Upgrade Kibana, APM, AppSearch inside Deployment
- Deployment - Info
- Deployment - Remote Clusters
- Deployment - resync
- Deployment Resources - CRUD
- Deployments - Extensions
- Deployments - IP Filtering - CRUD
- Deployments - Notes
- Deployments - Templates
- Deployments - Traffic Filter - Associations
- Deployments - Traffic Filter - CRUD
- Networking - Deployment Domain Names
- Platform
- Platform - Adminconsoles
- Platform - Allocators
- Get allocators
- Resynchronize allocators
- Search allocators
- Delete allocator
- Get allocator
- Resynchronize allocator
- Move clusters
- Move clusters by type
- Delete allocator logging settings
- Get allocator logging settings
- Update allocator logging settings
- Set allocator logging settings
- Start maintenance mode
- Stop maintenance mode
- Get allocator metadata
- Set allocator metadata
- Delete allocator metadata item
- Set allocator metadata item
- Get allocator settings
- Update allocator settings
- Set allocator settings
- Platform - Configuration - Instances - CRUD
- Platform - Configuration - Security
- Platform - Configuration - Security - Extra Certificates - CRUD
- Platform - Configuration - Security Deployment
- Platform - Configuration - Security Realms
- List security realm configurations
- Reorder security realms
- Create Active Directory configuration
- Delete Active Directory configuration
- Get Active Directory configuration
- Update Active Directory configuration
- Create LDAP configuration
- Delete LDAP configuration
- Get LDAP configuration
- Update LDAP configuration
- Create SAML configuration
- Delete SAML configuration
- Get SAML configuration
- Update SAML configuration
- Platform - Configuration - TLS
- Platform - Constructors
- Platform - License
- Platform - Repository - CRUD
- Platform - Runners
- Platform - configuration - Store
- Platform - proxies
- Roles
- Stack - Instance Types - CRUD
- Stack - Versions - CRUD
- Telemetry
- Templates - Deployments - Global
- Templates - Deployments - Legacy
- Users
- Definitions
AbsoluteRefId
AccountTrustRelationship
ActiveDirectoryGroupSearch
ActiveDirectorySecurityRealmLoadBalance
ActiveDirectorySecurityRealmRoleMappingRule
ActiveDirectorySecurityRealmRoleMappingRules
ActiveDirectorySettings
ActiveDirectoryUserSearch
AdminconsoleInfo
AdminconsolesOverview
AllocatedInstancePlansInfo
AllocatedInstanceStatus
AllocatorBuildInfo
AllocatorCapacity
AllocatorCapacityMemory
AllocatorHealthStatus
AllocatorInfo
AllocatorMoveRequest
AllocatorOverview
AllocatorSettings
AllocatorZoneInfo
AllocatorsSummary
AllocatorsZoneSummary
ApiBaseUrlData
ApiKeyResponse
ApiKeysResponse
Apm
ApmConfiguration
ApmCrudResponse
ApmInfo
ApmPayload
ApmPlan
ApmPlanControlConfiguration
ApmPlanInfo
ApmPlansInfo
ApmResourceInfo
ApmSettings
ApmSubInfo
ApmSystemSettings
ApmTopologyElement
ApmsInfo
AppSearch
AppSearchConfiguration
AppSearchInfo
AppSearchNodeTypes
AppSearchPayload
AppSearchPlan
AppSearchPlanControlConfiguration
AppSearchPlanInfo
AppSearchPlansInfo
AppSearchResourceInfo
AppSearchSettings
AppSearchSubInfo
AppSearchSystemSettings
AppSearchTopologyElement
AuthenticationInfo
AutodetectStrategyConfig
AvailableAuthenticationMethods
BasicFailedReply
BasicFailedReplyElement
Blessing
Blessings
BlessingsWithMeta
BoolQuery
CapacityConstraintsResource
ChangeSourceInfo
ClusterCommandResponse
ClusterCredentials
ClusterCrudResponse
ClusterCurationSettings
ClusterCurationSpec
ClusterInfo
ClusterInstanceConfigurationInfo
ClusterInstanceDiskInfo
ClusterInstanceInfo
ClusterInstanceMemoryInfo
ClusterLicenseInfo
ClusterMetadataCpuResourcesSettings
ClusterMetadataInfo
ClusterMetadataPortInfo
ClusterMetadataResourcesSettings
ClusterMetadataSettings
ClusterPlanMigrationResponse
ClusterPlanStepInfo
ClusterPlanStepLogMessageInfo
ClusterSnapshotRepositoryDefault
ClusterSnapshotRepositoryInfo
ClusterSnapshotRepositoryReference
ClusterSnapshotRepositoryStatic
ClusterSnapshotRequest
ClusterSnapshotResponse
ClusterSnapshotRetention
ClusterSnapshotSettings
ClusterSystemAlert
ClusterTopologyInfo
ClusterUpgradeInfo
ClustersInfo
Comment
CommentCreateRequest
CommentUpdateRequest
CommentWithMeta
CommentsWithMetas
CompatibleNodeTypesResource
CompatibleVersionResource
ConfigStoreOption
ConfigStoreOptionData
ConfigStoreOptionList
ConstructorHealthStatus
ConstructorInfo
ConstructorOverview
ContainerConfigHostConfig
ContainerSetSummary
ContainerSetsSummary
ContainersEntry
ContainersEntryOptions
ContainersEntryOptionsACL
ContainersEntryOptionsAuth
ContainersEntryOptionsContainerConfig
ContainersEntryOptionsOverrides
CoordinatorSummary
CoordinatorsSummary
CreateApiKeyRequest
CreateApmInCreateElasticsearchRequest
CreateApmRequest
CreateAppSearchRequest
CreateElasticsearchClusterRequest
CreateEnterpriseSearchRequest
CreateExtensionRequest
CreateKibanaInCreateElasticsearchRequest
CreateKibanaRequest
Creates
CrossClusterSearchClusters
CrossClusterSearchInfo
CrossClusterSearchSettings
DeleteApiKeysRequest
DeleteUsersApiKeysRequest
DeploymentCreateMetadata
DeploymentCreateRequest
DeploymentCreateResources
DeploymentCreateResponse
DeploymentCreateSettings
DeploymentDeleteResponse
DeploymentDiagnostics
DeploymentDomainName
DeploymentGetResponse
DeploymentLogging
DeploymentLoggingSettings
DeploymentMetadata
DeploymentMetrics
DeploymentMetricsSettings
DeploymentObservability
DeploymentObservabilitySettings
DeploymentResource
DeploymentResourceCommandResponse
DeploymentResourceCrudResponse
DeploymentResourceUpgradeResponse
DeploymentResources
DeploymentRestoreResponse
DeploymentSearchResponse
DeploymentSettings
DeploymentShutdownResponse
DeploymentTemplateDefinitionRequest
DeploymentTemplateInfo
DeploymentTemplateInfoV2
DeploymentTemplateMigrateResponse
DeploymentTemplateReference
DeploymentTemplateRequestBody
DeploymentUpdateMetadata
DeploymentUpdateRequest
DeploymentUpdateResources
DeploymentUpdateResponse
DeploymentUpdateSettings
DeploymentsListResponse
DeploymentsListingData
DeploymentsSearchResponse
DeprecatedElasticsearchClusterSettings
DiscreteSizes
Elasticsearch
ElasticsearchClusterBlockingIssueElement
ElasticsearchClusterBlockingIssues
ElasticsearchClusterInfo
ElasticsearchClusterInstanceSettingsOverrides
ElasticsearchClusterPlan
ElasticsearchClusterPlanInfo
ElasticsearchClusterPlansInfo
ElasticsearchClusterRole
ElasticsearchClusterSecurityInfo
ElasticsearchClusterSettings
ElasticsearchClusterTopologyElement
ElasticsearchClusterTrustSettings
ElasticsearchClusterUser
ElasticsearchClustersInfo
ElasticsearchConfiguration
ElasticsearchCuration
ElasticsearchDependant
ElasticsearchElasticUserPasswordResetResponse
ElasticsearchInfo
ElasticsearchMasterElement
ElasticsearchMasterInfo
ElasticsearchMonitoringInfo
ElasticsearchNodeType
ElasticsearchPayload
ElasticsearchPlanControlConfiguration
ElasticsearchReplicaElement
ElasticsearchResourceInfo
ElasticsearchScriptTypeSettings
ElasticsearchScriptingUserSettings
ElasticsearchShardElement
ElasticsearchShardsInfo
ElasticsearchSystemSettings
ElasticsearchUserBundle
ElasticsearchUserPlugin
ElevatePermissionsRequest
ElevatedPermissions
EmptyResponse
EnableIlmRequest
EnrollmentTokenRequest
EnterpriseSearch
EnterpriseSearchConfiguration
EnterpriseSearchInfo
EnterpriseSearchNodeTypes
EnterpriseSearchPayload
EnterpriseSearchPlan
EnterpriseSearchPlanControlConfiguration
EnterpriseSearchPlanInfo
EnterpriseSearchPlansInfo
EnterpriseSearchResourceInfo
EnterpriseSearchSettings
EnterpriseSearchSubInfo
EnterpriseSearchSystemSettings
EnterpriseSearchTopologyElement
ExistsQuery
Extension
ExtensionFileMetadata
Extensions
ExternalHyperlink
ExternalTrustRelationship
FilterAssociation
GlobalDeploymentTemplateInfo
GlobalDeploymentTemplateRegion
GrowShrinkStrategyConfig
Hyperlink
IdResponse
IndexPattern
IndexSynchronizationResults
InstanceConfiguration
InstanceConfigurationInfo
InstanceMoveRequest
InstanceTypeResource
IpFilterRule
IpFilterRuleset
IpFilterRulesets
IpFilteringSettings
KeystoreContents
KeystoreSecret
Kibana
KibanaClusterInfo
KibanaClusterPlan
KibanaClusterPlanInfo
KibanaClusterPlansInfo
KibanaClusterSettings
KibanaClusterTopologyElement
KibanaClustersInfo
KibanaConfiguration
KibanaDeeplink
KibanaPayload
KibanaPlanControlConfiguration
KibanaResourceInfo
KibanaSubClusterInfo
KibanaSystemSettings
LdapGroupSearch
LdapSecurityRealmLoadBalance
LdapSecurityRealmRoleMappingRule
LdapSecurityRealmRoleMappingRules
LdapSettings
LdapUserSearch
LegacySecuritySettings
LicenseInfo
LicenseObject
ListEnrollmentTokenElement
ListEnrollmentTokenReply
LoggingSettings
LoginRequest
LoginState
ManagedMonitoringSettings
MatchAllQuery
MatchNoneQuery
MatchQuery
Metadata
MetadataItem
MetadataItemValue
MetadataItems
ModelVersionIndexSynchronizationResults
MoveApmClusterConfiguration
MoveApmClusterDetails
MoveAppSearchConfiguration
MoveAppSearchDetails
MoveClustersCommandResponse
MoveClustersDetails
MoveClustersRequest
MoveElasticsearchClusterConfiguration
MoveElasticsearchClusterDetails
MoveEnterpriseSearchConfiguration
MoveEnterpriseSearchDetails
MoveKibanaClusterConfiguration
MoveKibanaClusterDetails
NestedQuery
NodeTypeResource
Note
Notes
ObservabilityIssue
Orphaned
OrphanedElasticsearch
PendingState
PendingStates
PendingStatesWithMeta
PlanStrategy
PlatformInfo
PlatformResourcesSummary
PlatformServiceImageInfo
PlatformServiceInfo
PortBinding
PrefixQuery
ProxiesAllocationsInfo
ProxiesFilter
ProxiesFilteredGroup
ProxiesFilteredGroupHealth
ProxiesHealth
ProxiesHttpSettings
ProxiesSSOSettings
ProxiesSettings
ProxiesSummary
ProxyAllocationCounts
ProxyAllocationInfo
ProxyInfo
ProxyOverview
ProxySummary
PublicCertChain
PublicCertChainCollection
QueryContainer
QueryStringQuery
RangeQuery
ReAuthenticationRequest
ReAuthenticationResponse
ReadOnlyRequest
ReadOnlyResponse
RegionInfo
RemoteClusterInfo
RemoteClusterRef
RemoteResourceRef
RemoteResources
ReplyWarning
RepositoryConfig
RepositoryConfigs
RequestEnrollmentTokenReply
RestartPolicy
RestoreSnapshotApiConfiguration
RestoreSnapshotConfiguration
RestoreSnapshotRepoConfiguration
Role
RoleAggregate
RoleAggregateCreateData
RoleAggregates
RoleWithMeta
RollingGrowShrinkStrategyConfig
RollingStrategyConfig
RuleSetResponse
RulesetAssociations
RunnerBuildInfo
RunnerContainerInfo
RunnerInfo
RunnerOverview
RunnerRoleInfo
RunnerRolesInfo
RunnersSummary
SamlAttributeSettings
SamlIdpSettings
SamlSecurityRealmRoleMappingRule
SamlSecurityRealmRoleMappingRules
SamlSettings
SamlSpSettings
SearchRequest
SecurityDeployment
SecurityDeploymentCreateRequest
SecurityDeploymentTopology
SecurityDeploymentUpdateRequest
SecurityRealmInfo
SecurityRealmInfoList
SecurityRealmsReorderRequest
SnapshotRepositoryConfiguration
SnapshotStatusInfo
SsoAuthenticationMethodInfo
StackVersionApmConfig
StackVersionAppSearchConfig
StackVersionArchiveProcessingError
StackVersionArchiveProcessingResult
StackVersionConfig
StackVersionConfigPost
StackVersionConfigs
StackVersionElasticsearchConfig
StackVersionEnterpriseSearchConfig
StackVersionInstanceCapacityConstraint
StackVersionKibanaConfig
StackVersionMetadata
StackVersionNodeType
StackVersionTemplateFileHash
StackVersionTemplateInfo
TargetElasticsearchCluster
TelemetryConfig
TelemetryConfigRequest
TermQuery
TiebreakerTopologyElement
TlsPublicCertChain
TokenResponse
TopologySize
TrafficFilterRule
TrafficFilterRulesetInfo
TrafficFilterRulesetRequest
TrafficFilterRulesetResponse
TrafficFilterRulesets
TrafficFilterSettings
TransientApmPlanConfiguration
TransientAppSearchPlanConfiguration
TransientElasticsearchPlanConfiguration
TransientEnterpriseSearchPlanConfiguration
TransientKibanaPlanConfiguration
UnreachableRegionInfo
UpdateExtensionRequest
Updates
UsageStats
User
UserApiKey
UserList
UserMetadata
UserSecurity
UserSecurityRealm
ZookeeperNodeInfo
ZookeeperSummary
- Script reference
- Glossary
- Release notes
- Elastic Cloud Enterprise 2.8.1
- Elastic Cloud Enterprise 2.8.0
- Elastic Cloud Enterprise 2.7.2
- Elastic Cloud Enterprise 2.7.1
- Elastic Cloud Enterprise 2.7.0
- Elastic Cloud Enterprise 2.6.2
- Elastic Cloud Enterprise 2.6.1
- Elastic Cloud Enterprise 2.6.0
- Elastic Cloud Enterprise 2.5.1
- Elastic Cloud Enterprise 2.5.0
- Elastic Cloud Enterprise 2.4.3
- Elastic Cloud Enterprise 2.4.2
- Elastic Cloud Enterprise 2.4.1
- Elastic Cloud Enterprise 2.4.0
- Elastic Cloud Enterprise 2.3.2
- Elastic Cloud Enterprise 2.3.1
- Elastic Cloud Enterprise 2.3.0
- Elastic Cloud Enterprise 2.2.3
- Elastic Cloud Enterprise 2.2.2
- Elastic Cloud Enterprise 2.2.1
- Elastic Cloud Enterprise 2.2.0
- Elastic Cloud Enterprise 2.1.1
- Elastic Cloud Enterprise 2.1.0
- Elastic Cloud Enterprise 2.0.1
- Elastic Cloud Enterprise 2.0.0
- Elastic Cloud Enterprise 1.1.5
- Elastic Cloud Enterprise 1.1.4
- Elastic Cloud Enterprise 1.1.3
- Elastic Cloud Enterprise 1.1.2
- Elastic Cloud Enterprise 1.1.1
- Elastic Cloud Enterprise 1.1.0
- Elastic Cloud Enterprise 1.0.2
- Elastic Cloud Enterprise 1.0.1
- Elastic Cloud Enterprise 1.0.0
- What’s new with the Elastic Stack
- About this product
It is time to say goodbye: This version of Elastic Cloud Enterprise has reached end-of-life (EOL) and is no longer supported.
The documentation for this version is no longer being maintained. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Add custom bundles and plugins to your deployment
editAdd custom bundles and plugins to your deployment
editFollow these steps to upload custom bundles and plugins to your Elasticsearch clusters, so that it uses your custom bundles or plugins.
- Update your Elasticsearch cluster in the advanced configuration editor:
-
For bundles, modify the
resources.elasticsearch.plan.cluster_topology.elasticsearch.user_bundles
JSON attribute of each Elasticsearch instance type. -
For plugins, modify the
resources.elasticsearch.plan.cluster_topology.elasticsearch.user_plugins
JSON attribute of each Elasticsearch instance type.
We’ve provided some examples, including LDAP bundles, SAML bundles, and adding a JVM trustore.
Add custom plugins to your deployment
editCustom plugins can include the official Elasticsearch plugins not provided with Elastic Cloud Enterprise, any of the community-sourced plugins, or plugins that you write yourself.
- Log into the Cloud UI.
-
From the Deployments page, select your deployment.
Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters.
- From your deployment menu, select Edit then go to the bottom of the page and click advanced Elasticsearch configuration.
-
Within the plan find the
user_plugins
section of each Elasticsearch instance type. If you don’t find it, you can add it within the Elasticsearch umbrella as shown in the following examples.{ ... "resources": { "elasticsearch": [ ... "plan": { ... "cluster_topology": [ ... "elasticsearch": { ... "user_bundles": [ { .... } ] , "user_plugins": [ { "url" : "<some static non_expirable url>", "name" : "plugin_name", "elasticsearch_version" : "<es_version>" }, { "url": "http://www.MYURL.com/my-custom-plugin.zip", "name": "my-custom-plugin", "elasticsearch_version": "7.13.1" } ] }
The URL for the plugin must be always available. Make sure you host the plugin artifacts internally in a highly available environment.
The version must match exactly your Elasticsearch version, such as 6.4.2. Wildcards (*) are not allowed.
If the plugin URL becomes unreachable (if the URL changes at remote end, or connectivity to the remote web server has issues) you might encounter boot loops.
Don’t use the same URL to serve newer versions of the plugin. This may result in different nodes of the same cluster running different plugin versions.
- Save your changes.
-
To verify that all nodes have the plugins installed, use one of these commands:
GET /_nodes/plugins?filter_path=nodes.*.plugins
orGET _cat/plugins?v
Example: Custom LDAP bundle
editThis example adds a custom LDAP bundle for deployment level role-based access control (RBAC). To set platform level RBAC, see Configure RBAC.
-
Prepare a custom bundle as a ZIP file that contains your keystore file with the private key and certificate inside of a
truststore
folder in the same way that you would on Elastic Cloud. This bundle allows all Elasticsearch containers to access the same keystore file through yourssl.truststore
settings. -
In the advanced configuration editor, update your new Elasticsearch cluster with the custom bundle you have just created. Modify the
user_bundles
JSON attribute of each Elasticsearch instance type as shown in the following example:{ ... "resources": { "elasticsearch": [ ... "plan": { ... "cluster_topology": [ ... "elasticsearch": { ... "user_bundles": [ { "name": "ldap-cert", "url": "http://www.MYURL.com/ldapcert.zip", "elasticsearch_version": "*" } ] } ...
The URLs for the bundle ZIP files (
ldapcert.zip
) must be always available. Make sure you host the plugin artifacts internally in a highly available environment.If the bundle URL becomes unreachable (if the URL changes at remote end, or connectivity to the remote web server has issues) you might encounter boot loops.
Don’t use the same URL to serve newer versions of the bundle. This may result in different nodes of the same cluster running different bundle versions.
-
Custom bundles are unzipped in
/app/config/BUNDLE_DIRECTORY_STRUCTURE
, whereBUNDLE_DIRECTORY_STRUCTURE
is the directory structure within the bundle ZIP file itself. These file locations are needed in the next step.$ tree . . └── truststore └── keystore.ks
In this example, the unzipped keystore file gets placed under
/app/config/truststore/keystore.ks
.
Example: Custom SAML bundle
editThis example adds a custom SAML bundle for deployment level role-based access control (RBAC). To set platform level RBAC, see Configure RBAC.
-
If your Identity Provider doesn’t publish its SAML metadata at an HTTP URL, or if your Elasticsearch cluster cannot reach that URL, you can upload the SAML metadata as a file.
-
Prepare a ZIP file with a custom bundle that contains your Identity Provider’s metadata (
metadata.xml
) and store it in thesaml
folder.This bundle allows all Elasticsearch containers to access the metadata file.
-
In the advanced configuration editor, update your Elasticsearch cluster configuration with the bundle you prepared in the previous step. Modify the
user_bundles
JSON attribute of each Elasticsearch instance type as shown in the following example:{ ... "resources": { "elasticsearch": [ ... "plan": { ... "cluster_topology": [ ... "elasticsearch": { ... "user_bundles": [ { "name": "saml-metadata", "url": "http://www.MYURL.com/saml-metadata.zip", "elasticsearch_version": "*" } ] } ...
The URL for the bundle ZIP file must be always available. Make sure you host the plugin artifacts internally in a highly available environment.
If the bundle URL becomes unreachable (if the URL changes at remote end, or connectivity to the remote web server has issues) you might encounter boot loops.
Don’t use the same URL to serve newer versions of the bundle. This may result in different nodes of the same cluster running different bundle versions.
Custom bundles are unzipped in
/app/config/BUNDLE_DIRECTORY_STRUCTURE
, whereBUNDLE_DIRECTORY_STRUCTURE
is the directory structure within the ZIP file itself. These file locations are needed in the next step.In this example, the SAML metadata file is located in the path
/app/config/saml/metadata.xml
:$ tree . . └── saml └── metadata.xml
-
Adjust your
saml
realm configuration accordingly:
-
Example: Custom JVM trust store bundle
editThis functionality is supported for Elasticsearch versions 6.x, starting with 6.8.2, and Elasticsearch 7.x, starting with 7.2.1
If you are using SSL certificates signed by non-public certificate authorities, Elasticsearch is not able to communicate with the services using those certificates unless you import a custom JVM trust store containing the certificates of your signing authority into your Elastic Cloud Enterprise installation. You’ll need the trust store to access snapshot repositories like Minio, for your Elastic Cloud Enterprise proxy, or to reindex from remote.
To import a JVM trust store:
-
Prepare the custom JVM trust store:
-
Pull the certificate from the service you want to make accessible:
- Save it to a file with as a PEM extension.
-
Locate your JRE’s default trust store, and copy it to the current directory:
Default trust store contains certificates of many well known root authorities that are trusted by default. If you only want to include a limited list of CAs to trust, skip this step, and simply import specific certificates you want to trust into an empty store as shown next
-
Use keytool command from your JRE to import certificate(s) into the keystore:
$JAVA_HOME/bin/keytool -keystore cacerts -storepass changeit -noprompt -importcert -file <certificate>.pem -alias <some alias>
The file where you saved the certificate to import, and an alias you assign to it, that is descriptive of the origin of the certificate
We recommend that you keep file name and password for the trust store as JVM defaults (
cacerts
andchangeit
respectively). If you must use different values for these you will need to add extra configuration (see below) in addition to adding the bundle.You can have multiple certificates to the trust store, repeating the same command. There is only one trust store per cluster currently supported. You cannot, for example, add multiple bundles with different trust stores to the same cluster, they will not get merged. Add all certificates to be trusted to the same trust store
-
-
Create the bundle:
A bundle may contain other contents beyond the trust store if you prefer, but we recommend creating separate bundles for different purposes.
-
In the advanced configuration editor, update your Elasticsearch cluster configuration with the bundle you prepared in the previous step. Modify the
user_bundles
JSON attribute of each Elasticsearch instance type as shown in the following example:{ ... "resources": { "elasticsearch": [ ... "plan": { ... "cluster_topology": [ ... "elasticsearch": { ... "user_bundles": [ { "name": "custom-ca-certs", "url": "http://www.MYURL.com/cacerts.zip", "elasticsearch_version": "*" } ] } ...
The URL for the bundle ZIP file must be always available. Make sure you host the plugin artefacts internally in a highly available environment.
Wildcards are allowed here, since the certificates are independent from the Elasticsearch version.
If the bundle URL becomes unreachable (if the URL changes at remote end, or connectivity to the remote web server has issues) you might encounter boot loops.
Don’t use the same URL to serve newer versions of the bundle, i.e. when updating certificates. This may result in different nodes of the same cluster running different bundle versions.
-
If you prefer to use a different file name and/or password for the trust store, you also need to add an additional configuration section to the cluster metadata before adding the bundle. This configuration should be added to the
Elasticsearch cluster data
section of the page:
The name of the trust store must match the filename included into the archive |
|
Password used to create the trust store Use only alphanumeric characters, dashes, and underscores in both file name and password. You do not need to do this step if you are using default filename and password ( |
Example: Custom GeoIP database bundle
edit-
Prepare a ZIP file with a custom bundle that contains a: GeoLite2 database. The folder has to be named
ingest-geoip
, and the file name can be anything that is appended-(City|Country|ASN)
with themmdb
file extension, and it must have a different name than the original nameGeoLite2-City.mmdb
.
Is the ´link` a leftover ? It sounds like that to me.
+
The file my-geoip-file.zip
should look like this:
+
$ tree . . └── ingest-geoip └── MyGeoLite2-City.mmdb
- Copy the ZIP file to a webserver that is reachable from any allocator in your environment.
-
In the advanced configuration editor, update your Elasticsearch cluster configuration with the bundle you prepared in the previous step. Modify the
user_bundles
JSON attribute of each Elasticsearch instance type as shown in the following example.{ ... "resources": { "elasticsearch": [ ... "plan": { ... "cluster_topology": [ ... "elasticsearch": { ... "user_bundles": [ { "name": "custom-geoip-db", "url": "http://www.MYURL.com/my-geoip-file.zip", "elasticsearch_version": "*" } ] }
-
To use this bundle, you can refer it in the GeoIP processor of an ingest pipeline as
MyGeoLite2-City.mmdb
underdatabase_file
such as:... { "geoip": { "field": ... "database_file": "MyGeoLite2-City.mmdb", ... } } ...
On this page