True Elasticsearch documentation

[howsTricks]

Is there any documentation on how to implement the usage of a "true" elasticsearch cluster. Reading between the lines in various comments/pull requests/issues seems like there is support to have Security Onion use an Elasticsearch cluster instead of the single node/cross cluster design that is the default setup. I'm wondering if there is any documentation on using a true Elasticsearch cluster or how to implement this?

[linsecnet]

We are looking for the same thing @howsTricks, but outside of the clustering, we are also looking for moving the location of the logs and a backup as well.

[dougburks]

We plan to have more documentation around this soon. What is your goal in moving to elasticsearch clustering?

[howsTricks]

Ah key things are:

• Consolidation of similar resources. We have Elasticsearch clusters already, would like to not have one specific to just security onion
• Consistency in management/design. While I can appreciate the bespoke nature of the SO ELK stack, troubleshooting and tuning is a bit hard to map as we're used to a different Elasticsearch design.
• Data sharing. Under the same area as consolidation, but would be nice to give access to the Elasticsearch data without going through the SOC.

[dougburks]

We may be talking about different things here. It seems like you are wanting to use an external cluster. The upcoming documentation that I referred to above is around how to configure Security Onion's internal Elastic stack to use Elastic clustering.

[Git-Me-Some-Hub]

I am interested in what you are talking about, do you have a bit more information on what this documentation will include?