Create an Elasticsearch Cluster element

The Elasticsearch Cluster element defines the settings for contacting the Elasticsearch cluster. You can create one Elasticsearch Cluster element.

Before you begin

You must already have an Elasticsearch cluster deployed and configured in your environment.
You must create a TLS Profile element if you want to use an imported certificate to secure the connection between the Log Server or Management Server and the Elasticsearch cluster.

Important: Forwarding log data to an Elasticsearch cluster is an advanced feature that requires knowledge of how to configure Elasticsearch. You must already have an Elasticsearch cluster deployed and configured in your environment.

For more details about the product and how to configure features, click Help or press F1.

Steps

In the Management Client, select Configuration, then browse to Network Elements.
Browse to Servers.
Right-click Servers, then select New > Elasticsearch Cluster.
Configure the settings, then click OK.

Elasticsearch Cluster Properties dialog box

Use this dialog box to configure an Elasticsearch Cluster element.

Option	Definition
General tab
Name	The name of the element.
IP Address	Enter the fully qualified domain name (FQDN) or IP addresses of the Elasticsearch cluster. Separate multiple IP addresses with commas.
Location (Optional)	Specifies the location to which the server belongs if there is a NAT device between the server and other Secure SD-WAN Manager components.
Contact Addresses section (All optional settings)
Default	Used by default when a component that belongs to another Location connects to this server.
Exceptions	Allows you to define exceptions to the default contact address. Opens the Exceptions dialog box.
Port (Optional)	The port number on which the Elasticsearch cluster communicates. The default port is 9200.
Retention Period (Optional)	Specifies the maximum length of time for which log data is kept on the Elasticsearch cluster. Log data older than the specified period is deleted from the Elasticsearch cluster.
Number of Shards (Optional)	The number of shards for the Elasticsearch index in which logs and alerts are stored. When the value is Auto, the number of shards is synchronized with the number of data nodes in the cluster. Changes are applied when future daily indexes are created.
Number of Replicas (Optional)	The number of replicas for all indexes. Changes are applied immediately.
Enable Cluster Sniffer (Optional)	When selected, the Elasticsearch cluster sniffer tracks changes in the cluster topology and adapts automatically.
Category (Optional)	Includes the element in predefined categories. Click Select to select a category.
Comment (Optional)	A comment for your own reference.

Option	Definition
Security tab
TLS Profile (Optional)	The TLS Profile element that defines the trusted certificate authorities.
Client Authentication Settings	Defines how the connection between SMC servers and the Elasticsearch cluster is secured.
TLS Certificate	Specifies the TLS certificate that is used to secure the connection between the Secure SD-WAN Manager Server and the Elasticsearch cluster. Use Internal Certificate — Each Secure SD-WAN Manager server uses its own internal certificate. Use Imported Certificate — All Secure SD-WAN Manager servers use the specified external certificate. No Client Authentication — The connection is not authenticated.

Option	Definition
NAT tab (All optional settings)
Firewall	Shows the selected firewall.
NAT Type	Shows the NAT translation type: Static or Dynamic.
Private IP Address	Shows the Private IP Address.
Public IP Address	Shows the defined Public IP Address.
Port Filter	Shows the selected Port Filters.
Comment	An optional comment for your own reference.
Add NAT Definition	Opens the NAT Definition Properties dialog box.
Edit NAT Definition	Opens the NAT Definition Properties dialog box for the selected definition.
Remove NAT Definition	Removes the selected NAT definition from the list.