TL;DR Summary: Installing Elastic Enterprise Search enables businesses to efficiently search internal documents and control access. This guide details the installation of both Elasticsearch and Enterprise Search, including setup steps and security configurations.
Download and install Elasticsearch.
Open firewall port 3002 for the Enterprise Search web interface.
Elastic.co has a product called Enterprise Search, formerly Swiftype, that’s aimed at businesses. Enterprise Search is like Google Search for internal company documents—an enterprise search tool for internal documents and files. It lets companies control who can access what documents. You can also use it to search public files on Google Drive, Github, Docker, etc., and write your own API to expose documents and files to internal users.
In this blog post, I’ll illustrate how to install Elastic Enterprise Search. In a subsequent post, I’ll talk about how to use it.
Install Elasticsearch
First, you have to download and install Elasticsearch —follow these steps. (Note: Enterprise Search will also install Filebeat. Its config file will be located here /usr/share/elasticsearch/enterprise-search-7.5.0/filebeat/filebeat.yml.)
Elasticsearch does not require a paid license, but Enterprise Search does. Luckily, you can use Enterprise Search for free for 30 days to evaluate it.
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.5.0-amd64.deb
sudo dpkg -i elasticsearch-7.5.0-amd64.deb
Turn on security and bind Elasticsearch to a routable IP address, not localhost, so you could add other machines to the cluster:
sudo vim /etc/elasticsearch/elasticsearch.yml
add:
xpack.security.enabled: true
network.host: 172.31.46.15
Assuming you are logged in as user ubuntu (or change the name to your userid), change all folder permissions to ubuntu. This step is not logical, since you can't run Elasticsearch as root. So, this patches up a step left out of their .deb file.
sudo chown -R ubuntu /usr/share/elasticsearch
sudo chown -R ubuntu /var/log/elasticsearch/
sudo chown -R ubuntu /var/lib/elasticsearch/
sudo chown -R ubuntu /etc/elasticsearch
sudo chown ubuntu /etc/default/elasticsearch
Start Elasticsearch. If you cannot start it as a service, because it throws an error, you can start it this way. Note: you cannot run it as root.
cd /usr/share/elasticsearch/bin
nohup ./elasticsearch&
Run this command to generate passwords for Elasticsearch; save these passwords somewhere.
./elasticsearch-setup-passwords auto
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
The passwords will be randomly generated and printed to the console.
Please confirm that you would like to continue [y/N]y
Changed password for user apm_system
PASSWORD apm_system =XXXXXXXXX
Changed password for user kibana
PASSWORD kibana =XXXXXXXXX
Changed password for user logstash_system
PASSWORD logstash_system = XXXXXXXX
Changed password for user beats_system
PASSWORD beats_system = XXXXXXXXXX
Changed password for user remote_monitoring_user
PASSWORD remote_monitoring_user =XXXXXXXX
Changed password for user elastic
PASSWORD elastic = XXXXXXXXXXXX
Install Enterprise Search
Now, we’ll install Elastic Enterprise Search. Open firewall port 3002 to the public IP address of your server. This is the web interface for Enterprise Search.
wget https://download.elastic.co/downloads/enterprisesearch/enterprise-search-7.5.0.tar.gz
cd /usr/share/elasticsearch
tar xvfx enterprise-search-7.5.0.tar.gz
Make these changes:
cd enterprise-search-7.5.0
vim config/enterprise-search.yml
ent_search.auth.source: standard
elasticsearch.username: elastic
elasticsearch.password: oe4emGR6Wnwp1wEwiRle
allow_es_settings_modification: true
ent_search.listen_host: 172.31.46.15
ent_search.external_url: http://walkercodetutorials.com:3002
Choose a password and start Enterprise Search as shown below. This command looks a little awkward but this is how you both set up an initial password and provide the password on subsequent starts.
ENT_SEARCH_DEFAULT_PASSWORD=password bin/enterprise-search
To run it in the background, e.g., after you have finished the setup, do:
env ENT_SEARCH_DEFAULT_PASSWORD=password nohup bin/enterprise-search&
Now login using:
userid: enterprise_search
password: password
to http://(your server):3002
It's important to look at stdout when you start the server to make sure it echoes this password. If you don't see this message, erase the software and then delete the indexes that Enterprise Search created in Elasticsearch as shown in the Debugging section below.
filebeat.1 | #########################################################
filebeat.1 |
filebeat.1 | *** Default user credentials have been setup. These are only printed once, so please ensure they are recorded. ***
filebeat.1 | username: enterprise_search
filebeat.1 | password: password
filebeat.1 |
filebeat.1 | #########################################################
Here is the login screen:
Here is the landing page:
In the next post, I’ll show how to configure Enterprise Search to query Google Drive, Dropbox, and Github.
Debugging Enterprise Search
If anything goes wrong with the Enterprise Search installation, you must delete the indexes that created in Elasticsearch before you repeat the installation.
You can list those indexes like this. Because you turned on security, you need to enter the userid and password. Use the Elasticsearch password auto generated above, not the Enterprise Search one you made up.
curl -X GET "http://(your server):9200/.ent-search*?pretty" -u elastic:(elasticsearch password, not the enterprise search password)
Then, delete all of them:
curl -X DELETE "http://(your server)9200/.ent-search*" -u
elastic:(elasticsearch password, not the enterprise search password)
Now, reinstall Enterprise Search.
ElasticSearch Guide
- ElasticSearch Tutorial for Beginners: ElasticSearch Basics
- Using Apache Hive with ElasticSearch
- Using ElasticSearch with Apache Spark
- Curl ElasticSearch Commands Cheat Sheet
- Spark ElasticSearch Hadoop Update and Upsert Example and Explanation
- How To Write Apache Spark Data to ElasticSearch Using Python
- ElasticSearch Search Syntax and Boolean and Aggregation Searches
- ElasticSearch Nested Queries: How to Search for Embedded Documents
- ElasticSearch Joins: Has_Child, Has_parent query
- How to Setup up an Elastic Version 7 Cluster
- How to Configure Filebeat for nginx and ElasticSearch
- Using Beats and Logstash to Send Logs to ElasticSearch
- How to Load CSV File into ElasticSearch with Logstash
- ElasticSearch Aggregations Explained
- What is the ELK Stack?
- Logstash 101: Using Logstash in a Data Processing Pipeline
- Using Kibana to Execute Queries in ElasticSearch using Lucene and Kibana Query Language
- ElasticSearch Machine Learning
- How to Install Elastic Enterprise Search
- How To Use Elastic Enterprise Search with GitHub
These postings are my own and do not necessarily represent BMC's position, strategies, or opinion.