From 2d2e7cf8fe4f610f21235cdcf53e100be34d8582 Mon Sep 17 00:00:00 2001 From: Charlotte Hoblik Date: Sun, 16 Mar 2025 20:16:40 +0100 Subject: [PATCH 01/13] add elasticsearch settings page --- .../auding-settings.md | 26 +++---- .../circuit-breaker-settings.md | 2 +- ...level-shard-allocation-routing-settings.md | 2 +- .../ece-elasticsearch-settings.md | 39 ---------- ...cloud-serverless-elasticsearch-settings.md | 4 +- .../elasticsearch-settings.md | 76 +++++++++++++++++++ .../machine-learning-settings.md | 2 +- .../networking-settings.md | 4 +- .../watcher-settings.md | 2 +- docs/reference/toc.yml | 2 +- 10 files changed, 99 insertions(+), 60 deletions(-) delete mode 100644 docs/reference/elasticsearch/configuration-reference/ece-elasticsearch-settings.md create mode 100644 docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md diff --git a/docs/reference/elasticsearch/configuration-reference/auding-settings.md b/docs/reference/elasticsearch/configuration-reference/auding-settings.md index d4300e6fd4657..ed35718e38848 100644 --- a/docs/reference/elasticsearch/configuration-reference/auding-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/auding-settings.md @@ -20,7 +20,7 @@ If configured, auditing settings must be set on every node in the cluster. Stati $$$xpack-security-audit-enabled$$$ -`xpack.security.audit.enabled` +`xpack.security.audit.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Set to `true` to enable auditing on the node. The default value is `false`. This puts the auditing events in a dedicated file named `_audit.json` on each node. If enabled, this setting must be configured in `elasticsearch.yml` on all nodes in the cluster. @@ -33,17 +33,17 @@ The events and some other information about what gets logged can be controlled b $$$xpack-sa-lf-events-include$$$ -`xpack.security.audit.logfile.events.include` +`xpack.security.audit.logfile.events.include` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies the [kind of events](/reference/elasticsearch/elasticsearch-audit-events.md) to print in the auditing output. In addition, `_all` can be used to exhaustively audit all the events, but this is usually discouraged since it will get very verbose. The default list value contains: `access_denied, access_granted, anonymous_access_denied, authentication_failed, connection_denied, tampered_request, run_as_denied, run_as_granted, security_config_change`. $$$xpack-sa-lf-events-exclude$$$ -`xpack.security.audit.logfile.events.exclude` +`xpack.security.audit.logfile.events.exclude` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Excludes the specified [kind of events](/reference/elasticsearch/elasticsearch-audit-events.md) from the include list. This is useful in the case where the `events.include` setting contains the special value `_all`. The default is the empty list. $$$xpack-sa-lf-events-emit-request$$$ -`xpack.security.audit.logfile.events.emit_request_body` +`xpack.security.audit.logfile.events.emit_request_body` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the full request body from REST requests as an attribute of certain kinds of audit events. This setting can be used to [audit search queries](docs-content://deploy-manage/monitor/logging-configuration/auditing-search-queries.md). The default value is `false`, so request bodies are not printed. @@ -58,22 +58,22 @@ $$$xpack-sa-lf-events-emit-request$$$ $$$xpack-sa-lf-emit-node-name$$$ -`xpack.security.audit.logfile.emit_node_name` +`xpack.security.audit.logfile.emit_node_name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the [node name](docs-content://deploy-manage/deploy/self-managed/important-settings-configuration.md#node-name) as a field in each audit event. The default value is `false`. $$$xpack-sa-lf-emit-node-host-address$$$ -`xpack.security.audit.logfile.emit_node_host_address` +`xpack.security.audit.logfile.emit_node_host_address` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the node’s IP address as a field in each audit event. The default value is `false`. $$$xpack-sa-lf-emit-node-host-name$$$ -`xpack.security.audit.logfile.emit_node_host_name` +`xpack.security.audit.logfile.emit_node_host_name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the node’s host name as a field in each audit event. The default value is `false`. $$$xpack-sa-lf-emit-node-id$$$ -`xpack.security.audit.logfile.emit_node_id` +`xpack.security.audit.logfile.emit_node_id` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the node id as a field in each audit event. Unlike [node name](docs-content://deploy-manage/deploy/self-managed/important-settings-configuration.md#node-name), whose value might change if the administrator changes the setting in the config file, the node id will persist across cluster restarts and the administrator cannot change it. The default value is `true`. @@ -83,27 +83,27 @@ The following settings affect the [ignore policies](docs-content://deploy-manage $$$xpack-sa-lf-events-ignore-users$$$ -`xpack.security.audit.logfile.events.ignore_filters..users` +`xpack.security.audit.logfile.events.ignore_filters..users` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of user names or wildcards. The specified policy will not print audit events for users matching these values. $$$xpack-sa-lf-events-ignore-realms$$$ -`xpack.security.audit.logfile.events.ignore_filters..realms` +`xpack.security.audit.logfile.events.ignore_filters..realms` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of authentication realm names or wildcards. The specified policy will not print audit events for users in these realms. $$$xpack-sa-lf-events-ignore-actions$$$ -`xpack.security.audit.logfile.events.ignore_filters..actions` +`xpack.security.audit.logfile.events.ignore_filters..actions` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of action names or wildcards. Action name can be found in the `action` field of the audit event. The specified policy will not print audit events for actions matching these values. $$$xpack-sa-lf-events-ignore-roles$$$ -`xpack.security.audit.logfile.events.ignore_filters..roles` +`xpack.security.audit.logfile.events.ignore_filters..roles` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of role names or wildcards. The specified policy will not print audit events for users that have these roles. If the user has several roles, some of which are **not** covered by the policy, the policy will **not** cover this event. $$$xpack-sa-lf-events-ignore-indices$$$ -`xpack.security.audit.logfile.events.ignore_filters..indices` +`xpack.security.audit.logfile.events.ignore_filters..indices` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of index names or wildcards. The specified policy will not print audit events when all the indices in the event match these values. If the event concerns several indices, some of which are **not** covered by the policy, the policy will **not** cover this event. diff --git a/docs/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md b/docs/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md index 7c5a593d178de..c1d1d0fa25a26 100644 --- a/docs/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md @@ -89,7 +89,7 @@ Poorly written regular expressions can degrade cluster stability and performance $$$script-painless-regex-enabled$$$ -`script.painless.regex.enabled` +`script.painless.regex.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Enables regex in Painless scripts. Accepts: `limited` (Default) diff --git a/docs/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md b/docs/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md index 3ff51e090548b..977724c565b59 100644 --- a/docs/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md @@ -165,7 +165,7 @@ You can use the following settings to control disk-based allocation: $$$cluster-routing-disk-threshold$$$ -`cluster.routing.allocation.disk.threshold_enabled` +`cluster.routing.allocation.disk.threshold_enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Defaults to `true`. Set to `false` to disable the disk allocation decider. Upon disabling, it will also remove any existing `index.blocks.read_only_allow_delete` index blocks. $$$cluster-routing-watermark-low$$$ diff --git a/docs/reference/elasticsearch/configuration-reference/ece-elasticsearch-settings.md b/docs/reference/elasticsearch/configuration-reference/ece-elasticsearch-settings.md deleted file mode 100644 index 8942989b0397b..0000000000000 --- a/docs/reference/elasticsearch/configuration-reference/ece-elasticsearch-settings.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -mapped_pages: - - https://www.elastic.co/guide/en/cloud-enterprise/current/ece-add-user-settings.html#ece-change-user-settings-examples ---- - -# ECE Elasticsearch settings [ece-add-user-settings] - -Change how Elasticsearch runs by providing your own user settings. User settings are appended to the `elasticsearch.yml` configuration file for your cluster and provide custom configuration options. Elastic Cloud Enterprise supports many of the user settings for the version of Elasticsearch that your cluster is running. - -::::{tip} -Some settings that could break your cluster if set incorrectly are blocked, such as certain zen discovery and security settings. For examples of a few of the settings that are generally safe in cloud environments, check [Edit stack settings](docs-content://deploy-manage/deploy/cloud-enterprise/edit-stack-settings.md) for {{ece}} and [Edit stack settings](docs-content://deploy-manage/deploy/elastic-cloud/edit-stack-settings.md) for the {{ecloud}} hosted offering. -:::: - - -To add user settings: - -1. [Log into the Cloud UI](docs-content://deploy-manage/deploy/cloud-enterprise/log-into-cloud-ui.md). -2. On the **Deployments** page, select your deployment. - - Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters. - -3. From your deployment menu, go to the **Edit** page. -4. In the **Elasticsearch** section, select **Edit elasticsearch.yml**. For deployments with existing user settings, you may have to expand the **User setting overrides** caret for each node type instead. -5. Update the user settings. -6. Select **Save changes**. - - ::::{warning} - If you encounter the **Edit elasticsearch.yml** carets, be sure to make your changes on all Elasticsearch node types. - :::: - - - -## Enable email notifications from Gmail [ece_enable_email_notifications_from_gmail] - -You can configure email notifications to Gmail for a user that you specify. For details, refer to [Configuring email actions](docs-content://explore-analyze/alerts-cases/watcher/actions-email.md). - -::::{warning} -Before you add the `xpack.notification.email*` setting in Elasticsearch user settings, make sure you add the account SMTP password to the keystore as a [secret value](docs-content://deploy-manage/security/secure-settings.md). -:::: diff --git a/docs/reference/elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md b/docs/reference/elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md index 5999856ece77c..499808d5e4214 100644 --- a/docs/reference/elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md @@ -1,7 +1,9 @@ --- -navigation_title: "Serverless differences" +navigation_title: "{{es}} settings {{serverless-short}}" mapped_pages: - https://www.elastic.co/guide/en/serverless/current/elasticsearch-differences.html +applies_to: + serverless: --- # Differences from other {{es}} offerings [elasticsearch-differences] diff --git a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md new file mode 100644 index 0000000000000..4df8ee94933a8 --- /dev/null +++ b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md @@ -0,0 +1,76 @@ +--- +navigation_title: "{{es}} settings for ECH and ECE" +mapped_pages: + - https://www.elastic.co/guide/en/cloud/current/ec-add-user-settings.html#ec-es-elasticsearch-settings + - https://www.elastic.co/guide/en/cloud-enterprise/current/ece-add-user-settings.html#ece-change-user-settings-examples +applies_to: + deployment: + ess: + ece: +--- + +# Elasticsearch settings [add-user-settings] + +Change how {{es}} runs by providing your own user settings. Elasticsearch Service appends these settings to each node’s `elasticsearch.yml` configuration file. + +Elasticsearch Service automatically rejects `elasticsearch.yml` settings that could break your cluster. For a list of supported settings, check [Supported {{es}} settings](#TODO). + +::::{tip} +Some settings that could break your cluster if set incorrectly are blocked, such as certain zen discovery and security settings. For examples of a few of the settings that are generally safe in cloud environments, check [Edit stack settings](docs-content://deploy-manage/deploy/cloud-enterprise/edit-stack-settings.md) for {{ece}} and [Edit stack settings](docs-content://deploy-manage/deploy/elastic-cloud/edit-stack-settings.md) for the {{ech}} offering. +:::: + +::::{warning} +You can also update [dynamic cluster settings](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting) using {{es}}'s [update cluster settings API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings). However, Elasticsearch Service doesn’t reject unsafe setting changes made using this API. Use with caution. +:::: + +## Add or edit user settings for {{ech}}: +```{applies_to} + deployment: + ess: +``` + +1. Log in to the [Elasticsearch Service Console](https://cloud.elastic.co?page=docs&placement=docs-body). +2. Find your deployment on the home page in the Elasticsearch Service card and select **Manage** to access it directly. Or, select **Hosted deployments** to go to the deployments page to view all of your deployments. + + On the deployments page you can narrow your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. + +3. From your deployment menu, go to the **Edit** page. +4. In the **Elasticsearch** section, select **Manage user settings and extensions**. +5. Update the user settings. +6. Select **Save changes**. + +::::{note} +In some cases, you may get a warning saying "User settings are different across Elasticsearch instances". To fix this issue, ensure that your user settings (including the comments sections and whitespaces) are identical across all Elasticsearch nodes (not only the data tiers, but also the Master, Machine Learning, and Coordinating nodes). +:::: + +## Add or edit user settings for {{ece}}: +```{applies_to} + deployment: + ece: +``` + +1. [Log into the Cloud UI](docs-content://deploy-manage/deploy/cloud-enterprise/log-into-cloud-ui.md). +2. On the **Deployments** page, select your deployment. + + Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters. + +3. From your deployment menu, go to the **Edit** page. +4. In the **Elasticsearch** section, select **Edit elasticsearch.yml**. For deployments with existing user settings, you may have to expand the **User setting overrides** caret for each node type instead. +5. Update the user settings. +6. Select **Save changes**. + + ::::{warning} + If you encounter the **Edit elasticsearch.yml** carets, be sure to make your changes on all Elasticsearch node types. + :::: + +### Enable email notifications from Gmail [ece_enable_email_notifications_from_gmail] +```{applies_to} + deployment: + ece: +``` + +You can configure email notifications to Gmail for a user that you specify. For details, refer to [Configuring email actions](docs-content://explore-analyze/alerts-cases/watcher/actions-email.md). + +::::{warning} +Before you add the `xpack.notification.email*` setting in Elasticsearch user settings, make sure you add the account SMTP password to the keystore as a [secret value](docs-content://deploy-manage/security/secure-settings.md). +:::: \ No newline at end of file diff --git a/docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md b/docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md index 1fb8b85491662..fdac65c8a68bd 100644 --- a/docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md @@ -54,7 +54,7 @@ To control memory usage used by {{ml}} jobs, you can use the [machine learning c $$$xpack-interference-model-ttl$$$ `xpack.ml.inference_model.time_to_live` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") -: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The time to live (TTL) for trained models in the inference model cache. The TTL is calculated from last access. Users of the cache (such as the inference processor or inference aggregator) cache a model on its first use and reset the TTL on every use. If a cached model is not accessed for the duration of the TTL, it is flagged for eviction from the cache. If a document is processed later, the model is again loaded into the cache. To update this setting in {{ess}}, see [Add {{es}} user settings](/reference/elasticsearch/configuration-reference/elastic-cloud-hosted-elasticsearch-settings.md). Defaults to `5m`. +: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The time to live (TTL) for trained models in the inference model cache. The TTL is calculated from last access. Users of the cache (such as the inference processor or inference aggregator) cache a model on its first use and reset the TTL on every use. If a cached model is not accessed for the duration of the TTL, it is flagged for eviction from the cache. If a document is processed later, the model is again loaded into the cache. To update this setting in {{ess}}, see [Add {{es}} user settings](/reference/elasticsearch/configuration-reference/elasticsearch-settings.md). Defaults to `5m`. `xpack.ml.max_inference_processors` : ([Dynamic](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings)) The total number of `inference` type processors allowed across all ingest pipelines. Once the limit is reached, adding an `inference` processor to a pipeline is disallowed. Defaults to `50`. diff --git a/docs/reference/elasticsearch/configuration-reference/networking-settings.md b/docs/reference/elasticsearch/configuration-reference/networking-settings.md index d82f10d15c4fb..c7bdc9ddf3c31 100644 --- a/docs/reference/elasticsearch/configuration-reference/networking-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/networking-settings.md @@ -337,7 +337,7 @@ Use the following advanced settings to configure the transport interface indepen $$$transport-settings-compress$$$ -`transport.compress` +`transport.compress` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting), string) Determines which transport requests are compressed before sending them to another node. {{es}} will compress transport responses if and only if the corresponding request was compressed. See also `transport.compression_scheme`, which specifies the compression scheme which is used. Accepts the following values: `false` @@ -352,7 +352,7 @@ $$$transport-settings-compress$$$ $$$transport-settings-compression-scheme$$$ -`transport.compression_scheme` +`transport.compression_scheme` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting), string) Configures the compression scheme for requests which are selected for compression by to the `transport.compress` setting. Accepts either `deflate` or `lz4`, which offer different trade-offs between compression ratio and CPU usage. {{es}} will use the same compression scheme for responses as for the corresponding requests. Defaults to `lz4`. `transport.tcp.keep_alive` diff --git a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md index b20c210cd1805..bd9e1f88833b6 100644 --- a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md @@ -94,7 +94,7 @@ You can configure the following TLS/SSL settings. Defaults to `full`. -`xpack.http.ssl.cipher_suites` +`xpack.http.ssl.cipher_suites` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported cipher suites vary depending on which version of Java you use. For example, for version 12 the default value is `TLS_AES_256_GCM_SHA384`, `TLS_AES_128_GCM_SHA256`, `TLS_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`, `TLS_RSA_WITH_AES_256_GCM_SHA384`, `TLS_RSA_WITH_AES_128_GCM_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_128_CBC_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA`, `TLS_RSA_WITH_AES_128_CBC_SHA`. For more information, see Oracle’s [Java Cryptography Architecture documentation](https://docs.oracle.com/en/java/javase/11/security/oracle-providers.md#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2). diff --git a/docs/reference/toc.yml b/docs/reference/toc.yml index bcb50213e23ff..ad3b78058576c 100644 --- a/docs/reference/toc.yml +++ b/docs/reference/toc.yml @@ -31,7 +31,7 @@ toc: - file: elasticsearch/configuration-reference/thread-pool-settings.md - file: elasticsearch/configuration-reference/watcher-settings.md - file: elasticsearch/configuration-reference/elastic-cloud-hosted-elasticsearch-settings.md - - file: elasticsearch/configuration-reference/ece-elasticsearch-settings.md + - file: elasticsearch/configuration-reference/elasticsearch-settings.md - file: elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md - file: elasticsearch/jvm-settings.md - file: elasticsearch/roles.md From d8fae4864b7eb256e40c43754528b886d39e313e Mon Sep 17 00:00:00 2001 From: Charlotte Hoblik Date: Sun, 16 Mar 2025 20:26:30 +0100 Subject: [PATCH 02/13] add logo to ech applicable settings --- .../elasticsearch-settings.md | 4 +++ .../index-management-settings.md | 32 +++++++++---------- .../security-settings.md | 6 ++-- .../watcher-settings.md | 6 ++-- 4 files changed, 26 insertions(+), 22 deletions(-) diff --git a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md index 4df8ee94933a8..7d2b0d925cc2b 100644 --- a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md @@ -43,6 +43,10 @@ You can also update [dynamic cluster settings](docs-content://deploy-manage/depl In some cases, you may get a warning saying "User settings are different across Elasticsearch instances". To fix this issue, ensure that your user settings (including the comments sections and whitespaces) are identical across all Elasticsearch nodes (not only the data tiers, but also the Master, Machine Learning, and Coordinating nodes). :::: +::::{note} +If your use case depends on the ability to receive CORS requests and you have a cluster that was provisioned prior to January 25th 2019, you must manually set `http.cors.enabled` to `true` and allow a specific set of hosts with `http.cors.allow-origin`. Applying these changes in your Elasticsearch configuration allows cross-origin resource sharing requests. +:::: + ## Add or edit user settings for {{ece}}: ```{applies_to} deployment: diff --git a/docs/reference/elasticsearch/configuration-reference/index-management-settings.md b/docs/reference/elasticsearch/configuration-reference/index-management-settings.md index e96b224ee1bd8..4c9b2da50ef49 100644 --- a/docs/reference/elasticsearch/configuration-reference/index-management-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/index-management-settings.md @@ -66,51 +66,51 @@ $$$reindex-remote-whitelist$$$ `reindex.remote.whitelist` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the hosts that can be [reindexed from remotely](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex). Expects a YAML array of `host:port` strings. Consists of a comma-delimited list of `host:port` entries. Defaults to `["\*.io:*", "\*.com:*"]`. -`reindex.ssl.certificate` +`reindex.ssl.certificate` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : Specifies the path to the PEM encoded certificate (or certificate chain) to be used for HTTP client authentication (if required by the remote cluster) This setting requires that `reindex.ssl.key` also be set. You cannot specify both `reindex.ssl.certificate` and `reindex.ssl.keystore.path`. -`reindex.ssl.certificate_authorities` +`reindex.ssl.certificate_authorities` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : List of paths to PEM encoded certificate files that should be trusted. You cannot specify both `reindex.ssl.certificate_authorities` and `reindex.ssl.truststore.path`. -`reindex.ssl.key` +`reindex.ssl.key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : Specifies the path to the PEM encoded private key associated with the certificate used for client authentication (`reindex.ssl.certificate`). You cannot specify both `reindex.ssl.key` and `reindex.ssl.keystore.path`. -`reindex.ssl.key_passphrase` +`reindex.ssl.key_passphrase` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : Specifies the passphrase to decrypt the PEM encoded private key (`reindex.ssl.key`) if it is encrypted. [7.17.0] Prefer `reindex.ssl.secure_key_passphrase` instead. Cannot be used with `reindex.ssl.secure_key_passphrase`. -`reindex.ssl.keystore.key_password` +`reindex.ssl.keystore.key_password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : The password for the key in the keystore (`reindex.ssl.keystore.path`). Defaults to the keystore password. [7.17.0] Prefer `reindex.ssl.keystore.secure_key_password` instead. This setting cannot be used with `reindex.ssl.keystore.secure_key_password`. -`reindex.ssl.keystore.password` +`reindex.ssl.keystore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : The password to the keystore (`reindex.ssl.keystore.path`). [7.17.0] Prefer `reindex.ssl.keystore.secure_password` instead. This setting cannot be used with `reindex.ssl.keystore.secure_password`. -`reindex.ssl.keystore.path` +`reindex.ssl.keystore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : Specifies the path to the keystore that contains a private key and certificate to be used for HTTP client authentication (if required by the remote cluster). This keystore can be in "JKS" or "PKCS#12" format. You cannot specify both `reindex.ssl.key` and `reindex.ssl.keystore.path`. -`reindex.ssl.keystore.type` +`reindex.ssl.keystore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : The type of the keystore (`reindex.ssl.keystore.path`). Must be either `jks` or `PKCS12`. If the keystore path ends in ".p12", ".pfx" or "pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`. -`reindex.ssl.secure_key_passphrase` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) +`reindex.ssl.secure_key_passphrase` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : Specifies the passphrase to decrypt the PEM encoded private key (`reindex.ssl.key`) if it is encrypted. Cannot be used with `reindex.ssl.key_passphrase`. -`reindex.ssl.keystore.secure_key_password` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) +`reindex.ssl.keystore.secure_key_password` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : The password for the key in the keystore (`reindex.ssl.keystore.path`). Defaults to the keystore password. This setting cannot be used with `reindex.ssl.keystore.key_password`. -`reindex.ssl.keystore.secure_password` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) +`reindex.ssl.keystore.secure_password` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : The password to the keystore (`reindex.ssl.keystore.path`). This setting cannot be used with `reindex.ssl.keystore.password`. -`reindex.ssl.truststore.password` +`reindex.ssl.truststore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : The password to the truststore (`reindex.ssl.truststore.path`). [7.17.0] Prefer `reindex.ssl.truststore.secure_password` instead. This setting cannot be used with `reindex.ssl.truststore.secure_password`. -`reindex.ssl.truststore.path` +`reindex.ssl.truststore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : The path to the Java Keystore file that contains the certificates to trust. This keystore can be in "JKS" or "PKCS#12" format. You cannot specify both `reindex.ssl.certificate_authorities` and `reindex.ssl.truststore.path`. -`reindex.ssl.truststore.secure_password` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) +`reindex.ssl.truststore.secure_password` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : The password to the truststore (`reindex.ssl.truststore.path`). This setting cannot be used with `reindex.ssl.truststore.password`. -`reindex.ssl.truststore.type` +`reindex.ssl.truststore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : The type of the truststore (`reindex.ssl.truststore.path`). Must be either `jks` or `PKCS12`. If the truststore path ends in ".p12", ".pfx" or "pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`. -`reindex.ssl.verification_mode` +`reindex.ssl.verification_mode` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : Indicates the type of verification to protect against man in the middle attacks and certificate forgery. One of `full` (verify the hostname and the certificate path), `certificate` (verify the certificate path, but not the hostname) or `none` (perform no verification - this is strongly discouraged in production environments). Defaults to `full`. diff --git a/docs/reference/elasticsearch/configuration-reference/security-settings.md b/docs/reference/elasticsearch/configuration-reference/security-settings.md index ddac3c31cfb37..e340216885c24 100644 --- a/docs/reference/elasticsearch/configuration-reference/security-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/security-settings.md @@ -52,13 +52,13 @@ All of these settings can be added to the `elasticsearch.yml` configuration file You can configure the following anonymous access settings in `elasticsearch.yml`. For more information, see [Enabling anonymous access](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/anonymous-access.md). -`xpack.security.authc.anonymous.username` +`xpack.security.authc.anonymous.username` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The username (principal) of the anonymous user. Defaults to `_es_anonymous_user`. -`xpack.security.authc.anonymous.roles` +`xpack.security.authc.anonymous.roles` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The roles to associate with the anonymous user. Required. -`xpack.security.authc.anonymous.authz_exception` +`xpack.security.authc.anonymous.authz_exception` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) When `true`, an HTTP 403 response is returned if the anonymous user does not have the appropriate permissions for the requested action. The user is not prompted to provide credentials to access the requested resource. When set to `false`, an HTTP 401 response is returned and the user can provide credentials with the appropriate permissions to gain access. Defaults to `true`. diff --git a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md index bd9e1f88833b6..a9cdf48b48ec4 100644 --- a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md @@ -274,7 +274,7 @@ $$$email-account-attributes$$$ `smtp.wait_on_quit` : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) If set to false the QUIT command is sent and the connection closed. If set to true, the QUIT command is sent and a reply is waited for. True by default. -`xpack.notification.email.html.sanitization.allow` +`xpack.notification.email.html.sanitization.allow` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : Specifies the HTML elements that are allowed in email notifications. For more information, see [Configuring HTML sanitization options](docs-content://explore-analyze/alerts-cases/watcher/actions-email.md#email-html-sanitization). You can specify individual HTML elements and the following HTML feature groups: $$$html-feature-groups$$$ @@ -302,10 +302,10 @@ $$$email-account-attributes$$$ : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Only embedded images. Embedded images can only use the `cid:` URL protocol in their `src` attribute. -`xpack.notification.email.html.sanitization.disallow` +`xpack.notification.email.html.sanitization.disallow` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the HTML elements that are NOT allowed in email notifications. You can specify individual HTML elements and [HTML feature groups](#html-feature-groups). -`xpack.notification.email.html.sanitization.enabled` +`xpack.notification.email.html.sanitization.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Set to `false` to completely disable HTML sanitation. Not recommended. Defaults to `true`. `xpack.notification.reporting.warning.kbn-csv-contains-formulas.text` From d93918269fa7b065a2a462d01124adb028e58927 Mon Sep 17 00:00:00 2001 From: Charlotte Hoblik Date: Mon, 17 Mar 2025 08:07:01 +0100 Subject: [PATCH 03/13] removing ECH settings page --- ...tic-cloud-hosted-elasticsearch-settings.md | 296 ------------------ .../elasticsearch-settings.md | 262 +++++++++++++++- .../index-management-settings.md | 6 +- docs/reference/toc.yml | 1 - 4 files changed, 266 insertions(+), 299 deletions(-) delete mode 100644 docs/reference/elasticsearch/configuration-reference/elastic-cloud-hosted-elasticsearch-settings.md diff --git a/docs/reference/elasticsearch/configuration-reference/elastic-cloud-hosted-elasticsearch-settings.md b/docs/reference/elasticsearch/configuration-reference/elastic-cloud-hosted-elasticsearch-settings.md deleted file mode 100644 index 4e6298f93344f..0000000000000 --- a/docs/reference/elasticsearch/configuration-reference/elastic-cloud-hosted-elasticsearch-settings.md +++ /dev/null @@ -1,296 +0,0 @@ ---- -mapped_pages: - - https://www.elastic.co/guide/en/cloud/current/ec-add-user-settings.html#ec-es-elasticsearch-settings ---- - -# Elastic Cloud Hosted Elasticsearch settings [ec-add-user-settings] - -Change how {{es}} runs by providing your own user settings. Elasticsearch Service appends these settings to each node’s `elasticsearch.yml` configuration file. - -Elasticsearch Service automatically rejects `elasticsearch.yml` settings that could break your cluster. For a list of supported settings, check [Supported {{es}} settings](#ec-es-elasticsearch-settings). - -::::{warning} -You can also update [dynamic cluster settings](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting) using {{es}}'s [update cluster settings API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings). However, Elasticsearch Service doesn’t reject unsafe setting changes made using this API. Use with caution. -:::: - - -To add or edit user settings: - -1. Log in to the [Elasticsearch Service Console](https://cloud.elastic.co?page=docs&placement=docs-body). -2. Find your deployment on the home page in the Elasticsearch Service card and select **Manage** to access it directly. Or, select **Hosted deployments** to go to the deployments page to view all of your deployments. - - On the deployments page you can narrow your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. - -3. From your deployment menu, go to the **Edit** page. -4. In the **Elasticsearch** section, select **Manage user settings and extensions**. -5. Update the user settings. -6. Select **Save changes**. - -::::{note} -In some cases, you may get a warning saying "User settings are different across Elasticsearch instances". To fix this issue, ensure that your user settings (including the comments sections and whitespaces) are identical across all Elasticsearch nodes (not only the data tiers, but also the Master, Machine Learning, and Coordinating nodes). -:::: - - -## Supported {{es}} settings [ec-es-elasticsearch-settings] - -Elasticsearch Service supports the following `elasticsearch.yml` settings. - -### General settings [ec_general_settings] - -The following general settings are supported: - -$$$http-cors-settings$$$`http.cors.*` -: Enables cross-origin resource sharing (CORS) settings for the [HTTP module](/reference/elasticsearch/configuration-reference/networking-settings.md). - - ::::{note} - If your use case depends on the ability to receive CORS requests and you have a cluster that was provisioned prior to January 25th 2019, you must manually set `http.cors.enabled` to `true` and allow a specific set of hosts with `http.cors.allow-origin`. Applying these changes in your Elasticsearch configuration allows cross-origin resource sharing requests. - :::: - - -`http.compression` -: Support for [HTTP compression](/reference/elasticsearch/configuration-reference/networking-settings.md) when possible (with Accept-Encoding). Defaults to `true`. - -`transport.compress` -: Configures [transport compression](/reference/elasticsearch/configuration-reference/networking-settings.md) for node-to-node traffic. - -`transport.compression_scheme` -: Configures [transport compression](/reference/elasticsearch/configuration-reference/networking-settings.md) for node-to-node traffic. - -`repositories.url.allowed_urls` -: Enables explicit allowing of [read-only URL repositories](docs-content://deploy-manage/tools/snapshot-and-restore/read-only-url-repository.md). - -`reindex.remote.whitelist` -: Explicitly allows the set of hosts that can be [reindexed from remotely](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex). Expects a YAML array of `host:port` strings. Consists of a comma-delimited list of `host:port` entries. Defaults to `["\*.io:*", "\*.com:*"]`. - -`reindex.ssl.*` -: To learn more on how to configure reindex SSL user settings, check [configuring reindex SSL parameters](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex). - -`script.painless.regex.enabled` -: Enables [regular expressions](/reference/scripting-languages/painless/brief-painless-walkthrough.md#modules-scripting-painless-regex) for the Painless scripting language. - -`action.auto_create_index` -: [Automatically create index](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-create) if it doesn’t already exist. - -`action.destructive_requires_name` -: When set to `true`, users must [specify the index name](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-delete) to delete an index. It’s not possible to delete _all or use wildcards. - -`xpack.notification.webhook.additional_token_enabled` -: When set to `true`, {{es}} automatically sets a token which enables the bypassing of traffic filters for calls initiated by Watcher towards {{es}} or {{kib}}. The default is `false` and the feature is available starting with {{es}} version 8.7.1 and later. - - ::::{important} - This setting only applies to the Watcher `webhook` action, not the `http` input action. - :::: - - -`cluster.indices.close.enable` -: Enables closing indices in Elasticsearch. Defaults to `true` for versions 7.2.0 and later, and to `false` for previous versions. In versions 7.1 and below, closed indices represent a data loss risk: if you close an index, it is not included in snapshots and you will not be able to restore the data. Similarly, closed indices are not included when you make cluster configuration changes, such as scaling to a different capacity, failover, and many other operations. Lastly, closed indices can lead to inaccurate disk space counts. - - ::::{warning} - For versions 7.1 and below, closed indices represent a data loss risk. Enable this setting only temporarily for these versions. - :::: - - -`azure.client.CLIENT_NAME.endpoint_suffix` -: Allows providing the [endpoint_suffix client setting](docs-content://deploy-manage/tools/snapshot-and-restore/azure-repository.md#repository-azure-client-settings) for a non-internal Azure client used for snapshot/restore. Note that `CLIENT_NAME` should be replaced with the name of the created client. - - -### Circuit breaker settings [ec_circuit_breaker_settings] - -The following circuit breaker settings are supported: - -`indices.breaker.total.limit` -: Configures [the parent circuit breaker settings](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#parent-circuit-breaker). - -`indices.breaker.fielddata.limit` -: Configures [the limit for the fielddata breaker](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#fielddata-circuit-breaker). - -`indices.breaker.fielddata.overhead` -: Configures [a constant that all field data estimations are multiplied with to determine a final estimation](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#fielddata-circuit-breaker). - -`indices.breaker.request.limit` -: Configures [the limit for the request breaker](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#request-circuit-breaker). - -`indices.breaker.request.overhead` -: Configures [a constant that all request estimations are multiplied by to determine a final estimation](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#request-circuit-breaker). - - -### Indexing pressure settings [ec_indexing_pressure_settings] - -The following indexing pressure settings are supported: - -`indexing_pressure.memory.limit` -: Configures [the indexing pressure settings](/reference/elasticsearch/index-settings/pressure.md). - - -### X-Pack [ec_x_pack] - -#### Version 8.5.3+, 7.x support in 7.17.8+ [ec_version_8_5_3_7_x_support_in_7_17_8] - -`xpack.security.transport.ssl.trust_restrictions.x509_fields` -: Specifies which field(s) from the TLS certificate is used to match for the restricted trust management that is used for remote clusters connections. This should only be set when a self managed cluster can not create certificates that follow the Elastic Cloud pattern. The default value is ["subjectAltName.otherName.commonName"], the Elastic Cloud pattern. "subjectAltName.dnsName" is also supported and can be configured in addition to or in replacement of the default. - - -#### All supported versions [ec_all_supported_versions] - -`xpack.ml.inference_model.time_to_live` -: Sets the duration of time that the trained models are cached. Check [{{ml-cap}} settings](/reference/elasticsearch/configuration-reference/machine-learning-settings.md). - -`xpack.security.loginAssistanceMessage` -: Adds a message to the login screen. Useful for displaying corporate messages. - -`xpack.security.authc.anonymous.*` -: To learn more on how to enable anonymous access, check [Enabling anonymous access](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/anonymous-access.md) - -`xpack.notification.slack` -: Configures [Slack notification settings](docs-content://explore-analyze/alerts-cases/watcher/actions-slack.md). Note that you need to add `secure_url` as a [secret value to the keystore](docs-content://deploy-manage/security/secure-settings.md). - -`xpack.notification.pagerduty` -: Configures [PagerDuty notification settings](docs-content://explore-analyze/alerts-cases/watcher/actions-pagerduty.md#configuring-pagerduty). - -`xpack.watcher.trigger.schedule.engine` -: Defines when the watch should start, based on date and time [Learn more](docs-content://explore-analyze/alerts-cases/watcher/schedule-types.md). - -`xpack.notification.email.html.sanitization.*` -: Enables [email notification settings](/reference/elasticsearch/configuration-reference/watcher-settings.md) to sanitize HTML elements in emails that are sent. - -`xpack.monitoring.collection.interval` -: Controls [how often data samples are collected](/reference/elasticsearch/configuration-reference/monitoring-settings.md#monitoring-collection-settings). - -`xpack.monitoring.collection.min_interval_seconds` -: Specifies the minimum number of seconds that a time bucket in a chart can represent. If you modify the `xpack.monitoring.collection.interval`, use the same value in this setting. - - Defaults to `10` (10 seconds). - - -$$$xpack-monitoring-history-duration$$$`xpack.monitoring.history.duration` -: Sets the [retention duration](/reference/elasticsearch/configuration-reference/monitoring-settings.md#monitoring-collection-settings) beyond which the indices created by a monitoring exporter will be automatically deleted. - -`xpack.watcher.history.cleaner_service.enabled` -: Controls [whether old watcher indices are automatically deleted](/reference/elasticsearch/configuration-reference/watcher-settings.md#general-notification-settings). - -`xpack.http.ssl.cipher_suites` -: Controls the list of supported cipher suites for all outgoing TLS connections. - -`xpack.security.authc.realms.saml.*` -: To learn more on how to enable SAML and related user settings, check [secure your clusters with SAML](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/saml.md). - -`xpack.security.authc.realms.oidc.*` -: To learn more on how to enable OpenID Connect and related user settings, check [secure your clusters with OpenID Connect](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md). - -`xpack.security.authc.realms.kerberos.*` -: To learn more on how to enable Kerberos and relate user settings, check [secure your clusters with Kerberos](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kerberos.md). - -`xpack.security.authc.realms.jwt.*` -: To learn more on how to enable JWT and related user settings, check [secure your clusters with JWT](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/jwt.md). - -::::{note} -All SAML, OpenID Connect, Kerberos, and JWT settings are allowlisted. -:::: - - - - -### Search [ec_search] - -The following search settings are supported: - -* `search.aggs.rewrite_to_filter_by_filter` - - -### Disk-based shard allocation settings [shard-allocation-settings] - -The following disk-based allocation settings are supported: - -`cluster.routing.allocation.disk.threshold_enabled` -: Enable or disable [disk allocation](/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md) decider and defaults to `true`. - -`cluster.routing.allocation.disk.watermark.low` -: Configures [disk-based shard allocation’s low watermark](/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md). - -`cluster.routing.allocation.disk.watermark.high` -: Configures [disk-based shard allocation’s high watermark](/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md). - -`cluster.routing.allocation.disk.watermark.flood_stage` -: Configures [disk-based shard allocation’s flood_stage](/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md). - -::::{tip} -Remember to update user settings for alerts when performing a major version upgrade. -:::: - - - -### Enrich settings [ec_enrich_settings] - -The following enrich settings are supported: - -`enrich.cache_size` -: Maximum number of searches to cache for enriching documents. Defaults to 1000. There is a single cache for all enrich processors in the cluster. This setting determines the size of that cache. - -`enrich.coordinator_proxy.max_concurrent_requests` -: Maximum number of concurrent multi-search requests to run when enriching documents. Defaults to 8. - -`enrich.coordinator_proxy.max_lookups_per_request` -: Maximum number of searches to include in a multi-search request when enriching documents. Defaults to 128. - -`enrich.coordinator_proxy.queue_capacity` -: coordinator queue capacity, defaults to max_concurrent_requests * max_lookups_per_request - - -### Audit settings [ec_audit_settings] - -The following audit settings are supported: - -`xpack.security.audit.enabled` -: Enables auditing on Elasticsearch cluster nodes. Defaults to *false*. - -`xpack.security.audit.logfile.events.include` -: Specifies which events to include in the auditing output. - -`xpack.security.audit.logfile.events.exclude` -: Specifies which events to exclude from the output. No events are excluded by default. - -`xpack.security.audit.logfile.events.emit_request_body` -: Specifies whether to include the request body from REST requests on certain event types, for example *authentication_failed*. Defaults to *false*. - -`xpack.security.audit.logfile.emit_node_name` -: Specifies whether to include the node name as a field in each audit event. Defaults to *true*. - -`xpack.security.audit.logfile.emit_node_host_address` -: Specifies whether to include the node’s IP address as a field in each audit event. Defaults to *false*. - -`xpack.security.audit.logfile.emit_node_host_name` -: Specifies whether to include the node’s host name as a field in each audit event. Defaults to *false*. - -`xpack.security.audit.logfile.emit_node_id` -: Specifies whether to include the node ID as a field in each audit event. Defaults to *true*. - -`xpack.security.audit.logfile.events.ignore_filters..users` -: A list of user names or wildcards. The specified policy will not print audit events for users matching these values. - -`xpack.security.audit.logfile.events.ignore_filters..realms` -: A list of authentication realm names or wildcards. The specified policy will not print audit events for users in these realms. - -`xpack.security.audit.logfile.events.ignore_filters..roles` -: A list of role names or wildcards. The specified policy will not print audit events for users that have these roles. - -`xpack.security.audit.logfile.events.ignore_filters..indices` -: A list of index names or wildcards. The specified policy will not print audit events when all the indices in the event match these values. - -`xpack.security.audit.logfile.events.ignore_filters..actions` -: A list of action names or wildcards. The specified policy will not print audit events for actions matching these values. - -::::{note} -To enable auditing you must first [enable deployment logging](docs-content://deploy-manage/monitor/stack-monitoring/elastic-cloud-stack-monitoring.md). -:::: - - - -### Universal Profiling settings [ec_universal_profiling_settings] - -The following settings for Elastic Universal Profiling are supported: - -`xpack.profiling.enabled` -: *Version 8.7.0+*: Specifies whether the Universal Profiling Elasticsearch plugin is enabled. Defaults to *true*. - -`xpack.profiling.templates.enabled` -: *Version 8.9.0+*: Specifies whether Universal Profiling related index templates should be created on startup. Defaults to *false*. diff --git a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md index 7d2b0d925cc2b..d423239633397 100644 --- a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md @@ -43,10 +43,270 @@ You can also update [dynamic cluster settings](docs-content://deploy-manage/depl In some cases, you may get a warning saying "User settings are different across Elasticsearch instances". To fix this issue, ensure that your user settings (including the comments sections and whitespaces) are identical across all Elasticsearch nodes (not only the data tiers, but also the Master, Machine Learning, and Coordinating nodes). :::: +## Supported {{es}} settings [ec-es-elasticsearch-settings] + +Elasticsearch Service supports the following `elasticsearch.yml` settings. + +### General settings [ec_general_settings] + +The following general settings are supported: + +$$$http-cors-settings$$$`http.cors.*` +: Enables cross-origin resource sharing (CORS) settings for the [HTTP module](/reference/elasticsearch/configuration-reference/networking-settings.md). + + ::::{note} + If your use case depends on the ability to receive CORS requests and you have a cluster that was provisioned prior to January 25th 2019, you must manually set `http.cors.enabled` to `true` and allow a specific set of hosts with `http.cors.allow-origin`. Applying these changes in your Elasticsearch configuration allows cross-origin resource sharing requests. + :::: + + +`http.compression` +: Support for [HTTP compression](/reference/elasticsearch/configuration-reference/networking-settings.md) when possible (with Accept-Encoding). Defaults to `true`. + +`transport.compress` +: Configures [transport compression](/reference/elasticsearch/configuration-reference/networking-settings.md) for node-to-node traffic. + +`transport.compression_scheme` +: Configures [transport compression](/reference/elasticsearch/configuration-reference/networking-settings.md) for node-to-node traffic. + +`repositories.url.allowed_urls` +: Enables explicit allowing of [read-only URL repositories](docs-content://deploy-manage/tools/snapshot-and-restore/read-only-url-repository.md). + +`reindex.remote.whitelist` +: Explicitly allows the set of hosts that can be [reindexed from remotely](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex). Expects a YAML array of `host:port` strings. Consists of a comma-delimited list of `host:port` entries. Defaults to `["\*.io:*", "\*.com:*"]`. + +`reindex.ssl.*` +: To learn more on how to configure reindex SSL user settings, check [configuring reindex SSL parameters](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex). + +`script.painless.regex.enabled` +: Enables [regular expressions](/reference/scripting-languages/painless/brief-painless-walkthrough.md#modules-scripting-painless-regex) for the Painless scripting language. + +`action.auto_create_index` +: [Automatically create index](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-create) if it doesn’t already exist. + +`action.destructive_requires_name` +: When set to `true`, users must [specify the index name](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-delete) to delete an index. It’s not possible to delete _all or use wildcards. + +`xpack.notification.webhook.additional_token_enabled` +: When set to `true`, {{es}} automatically sets a token which enables the bypassing of traffic filters for calls initiated by Watcher towards {{es}} or {{kib}}. The default is `false` and the feature is available starting with {{es}} version 8.7.1 and later. + + ::::{important} + This setting only applies to the Watcher `webhook` action, not the `http` input action. + :::: + + +`cluster.indices.close.enable` +: Enables closing indices in Elasticsearch. Defaults to `true` for versions 7.2.0 and later, and to `false` for previous versions. In versions 7.1 and below, closed indices represent a data loss risk: if you close an index, it is not included in snapshots and you will not be able to restore the data. Similarly, closed indices are not included when you make cluster configuration changes, such as scaling to a different capacity, failover, and many other operations. Lastly, closed indices can lead to inaccurate disk space counts. + + ::::{warning} + For versions 7.1 and below, closed indices represent a data loss risk. Enable this setting only temporarily for these versions. + :::: + + +`azure.client.CLIENT_NAME.endpoint_suffix` +: Allows providing the [endpoint_suffix client setting](docs-content://deploy-manage/tools/snapshot-and-restore/azure-repository.md#repository-azure-client-settings) for a non-internal Azure client used for snapshot/restore. Note that `CLIENT_NAME` should be replaced with the name of the created client. + + +### Circuit breaker settings [ec_circuit_breaker_settings] + +The following circuit breaker settings are supported: + +`indices.breaker.total.limit` +: Configures [the parent circuit breaker settings](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#parent-circuit-breaker). + +`indices.breaker.fielddata.limit` +: Configures [the limit for the fielddata breaker](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#fielddata-circuit-breaker). + +`indices.breaker.fielddata.overhead` +: Configures [a constant that all field data estimations are multiplied with to determine a final estimation](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#fielddata-circuit-breaker). + +`indices.breaker.request.limit` +: Configures [the limit for the request breaker](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#request-circuit-breaker). + +`indices.breaker.request.overhead` +: Configures [a constant that all request estimations are multiplied by to determine a final estimation](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#request-circuit-breaker). + + +### Indexing pressure settings [ec_indexing_pressure_settings] + +The following indexing pressure settings are supported: + +`indexing_pressure.memory.limit` +: Configures [the indexing pressure settings](/reference/elasticsearch/index-settings/pressure.md). + + +### X-Pack [ec_x_pack] + +#### Version 8.5.3+, 7.x support in 7.17.8+ [ec_version_8_5_3_7_x_support_in_7_17_8] + +`xpack.security.transport.ssl.trust_restrictions.x509_fields` +: Specifies which field(s) from the TLS certificate is used to match for the restricted trust management that is used for remote clusters connections. This should only be set when a self managed cluster can not create certificates that follow the Elastic Cloud pattern. The default value is ["subjectAltName.otherName.commonName"], the Elastic Cloud pattern. "subjectAltName.dnsName" is also supported and can be configured in addition to or in replacement of the default. + + +#### All supported versions [ec_all_supported_versions] + +`xpack.ml.inference_model.time_to_live` +: Sets the duration of time that the trained models are cached. Check [{{ml-cap}} settings](/reference/elasticsearch/configuration-reference/machine-learning-settings.md). + +`xpack.security.loginAssistanceMessage` +: Adds a message to the login screen. Useful for displaying corporate messages. + +`xpack.security.authc.anonymous.*` +: To learn more on how to enable anonymous access, check [Enabling anonymous access](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/anonymous-access.md) + +`xpack.notification.slack` +: Configures [Slack notification settings](docs-content://explore-analyze/alerts-cases/watcher/actions-slack.md). Note that you need to add `secure_url` as a [secret value to the keystore](docs-content://deploy-manage/security/secure-settings.md). + +`xpack.notification.pagerduty` +: Configures [PagerDuty notification settings](docs-content://explore-analyze/alerts-cases/watcher/actions-pagerduty.md#configuring-pagerduty). + +`xpack.watcher.trigger.schedule.engine` +: Defines when the watch should start, based on date and time [Learn more](docs-content://explore-analyze/alerts-cases/watcher/schedule-types.md). + +`xpack.notification.email.html.sanitization.*` +: Enables [email notification settings](/reference/elasticsearch/configuration-reference/watcher-settings.md) to sanitize HTML elements in emails that are sent. + +`xpack.monitoring.collection.interval` +: Controls [how often data samples are collected](/reference/elasticsearch/configuration-reference/monitoring-settings.md#monitoring-collection-settings). + +`xpack.monitoring.collection.min_interval_seconds` +: Specifies the minimum number of seconds that a time bucket in a chart can represent. If you modify the `xpack.monitoring.collection.interval`, use the same value in this setting. + + Defaults to `10` (10 seconds). + + +$$$xpack-monitoring-history-duration$$$`xpack.monitoring.history.duration` +: Sets the [retention duration](/reference/elasticsearch/configuration-reference/monitoring-settings.md#monitoring-collection-settings) beyond which the indices created by a monitoring exporter will be automatically deleted. + +`xpack.watcher.history.cleaner_service.enabled` +: Controls [whether old watcher indices are automatically deleted](/reference/elasticsearch/configuration-reference/watcher-settings.md#general-notification-settings). + +`xpack.http.ssl.cipher_suites` +: Controls the list of supported cipher suites for all outgoing TLS connections. + +`xpack.security.authc.realms.saml.*` +: To learn more on how to enable SAML and related user settings, check [secure your clusters with SAML](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/saml.md). + +`xpack.security.authc.realms.oidc.*` +: To learn more on how to enable OpenID Connect and related user settings, check [secure your clusters with OpenID Connect](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md). + +`xpack.security.authc.realms.kerberos.*` +: To learn more on how to enable Kerberos and relate user settings, check [secure your clusters with Kerberos](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kerberos.md). + +`xpack.security.authc.realms.jwt.*` +: To learn more on how to enable JWT and related user settings, check [secure your clusters with JWT](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/jwt.md). + +::::{note} +All SAML, OpenID Connect, Kerberos, and JWT settings are allowlisted. +:::: + + + + +### Search [ec_search] + +The following search settings are supported: + +* `search.aggs.rewrite_to_filter_by_filter` + + +### Disk-based shard allocation settings [shard-allocation-settings] + +The following disk-based allocation settings are supported: + +`cluster.routing.allocation.disk.threshold_enabled` +: Enable or disable [disk allocation](/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md) decider and defaults to `true`. + +`cluster.routing.allocation.disk.watermark.low` +: Configures [disk-based shard allocation’s low watermark](/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md). + +`cluster.routing.allocation.disk.watermark.high` +: Configures [disk-based shard allocation’s high watermark](/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md). + +`cluster.routing.allocation.disk.watermark.flood_stage` +: Configures [disk-based shard allocation’s flood_stage](/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md). + +::::{tip} +Remember to update user settings for alerts when performing a major version upgrade. +:::: + + + +### Enrich settings [ec_enrich_settings] + +The following enrich settings are supported: + +`enrich.cache_size` +: Maximum number of searches to cache for enriching documents. Defaults to 1000. There is a single cache for all enrich processors in the cluster. This setting determines the size of that cache. + +`enrich.coordinator_proxy.max_concurrent_requests` +: Maximum number of concurrent multi-search requests to run when enriching documents. Defaults to 8. + +`enrich.coordinator_proxy.max_lookups_per_request` +: Maximum number of searches to include in a multi-search request when enriching documents. Defaults to 128. + +`enrich.coordinator_proxy.queue_capacity` +: coordinator queue capacity, defaults to max_concurrent_requests * max_lookups_per_request + + +### Audit settings [ec_audit_settings] + +The following audit settings are supported: + +`xpack.security.audit.enabled` +: Enables auditing on Elasticsearch cluster nodes. Defaults to *false*. + +`xpack.security.audit.logfile.events.include` +: Specifies which events to include in the auditing output. + +`xpack.security.audit.logfile.events.exclude` +: Specifies which events to exclude from the output. No events are excluded by default. + +`xpack.security.audit.logfile.events.emit_request_body` +: Specifies whether to include the request body from REST requests on certain event types, for example *authentication_failed*. Defaults to *false*. + +`xpack.security.audit.logfile.emit_node_name` +: Specifies whether to include the node name as a field in each audit event. Defaults to *true*. + +`xpack.security.audit.logfile.emit_node_host_address` +: Specifies whether to include the node’s IP address as a field in each audit event. Defaults to *false*. + +`xpack.security.audit.logfile.emit_node_host_name` +: Specifies whether to include the node’s host name as a field in each audit event. Defaults to *false*. + +`xpack.security.audit.logfile.emit_node_id` +: Specifies whether to include the node ID as a field in each audit event. Defaults to *true*. + +`xpack.security.audit.logfile.events.ignore_filters..users` +: A list of user names or wildcards. The specified policy will not print audit events for users matching these values. + +`xpack.security.audit.logfile.events.ignore_filters..realms` +: A list of authentication realm names or wildcards. The specified policy will not print audit events for users in these realms. + +`xpack.security.audit.logfile.events.ignore_filters..roles` +: A list of role names or wildcards. The specified policy will not print audit events for users that have these roles. + +`xpack.security.audit.logfile.events.ignore_filters..indices` +: A list of index names or wildcards. The specified policy will not print audit events when all the indices in the event match these values. + +`xpack.security.audit.logfile.events.ignore_filters..actions` +: A list of action names or wildcards. The specified policy will not print audit events for actions matching these values. + ::::{note} -If your use case depends on the ability to receive CORS requests and you have a cluster that was provisioned prior to January 25th 2019, you must manually set `http.cors.enabled` to `true` and allow a specific set of hosts with `http.cors.allow-origin`. Applying these changes in your Elasticsearch configuration allows cross-origin resource sharing requests. +To enable auditing you must first [enable deployment logging](docs-content://deploy-manage/monitor/stack-monitoring/elastic-cloud-stack-monitoring.md). :::: + + +### Universal Profiling settings [ec_universal_profiling_settings] + +The following settings for Elastic Universal Profiling are supported: + +`xpack.profiling.enabled` +: *Version 8.7.0+*: Specifies whether the Universal Profiling Elasticsearch plugin is enabled. Defaults to *true*. + +`xpack.profiling.templates.enabled` +: *Version 8.9.0+*: Specifies whether Universal Profiling related index templates should be created on startup. Defaults to *false*. + ## Add or edit user settings for {{ece}}: ```{applies_to} deployment: diff --git a/docs/reference/elasticsearch/configuration-reference/index-management-settings.md b/docs/reference/elasticsearch/configuration-reference/index-management-settings.md index 4c9b2da50ef49..481814f224590 100644 --- a/docs/reference/elasticsearch/configuration-reference/index-management-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/index-management-settings.md @@ -20,8 +20,12 @@ $$$action-destructive-requires-name$$$ $$$cluster-indices-close-enable$$$ `cluster.indices.close.enable` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") -: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Enables [closing of open indices](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-close) in {{es}}. If `false`, you cannot close open indices. Defaults to `true`. +: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Enables [closing of open indices](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-close) in {{es}}. If `false`, you cannot close open indices. Defaults to `true` for versions 7.2.0 and later, and to `false` for previous versions. In versions 7.1 and below, closed indices represent a data loss risk: if you close an index, it is not included in snapshots and you will not be able to restore the data. Similarly, closed indices are not included when you make cluster configuration changes, such as scaling to a different capacity, failover, and many other operations. Lastly, closed indices can lead to inaccurate disk space counts. + ::::{warning} + For versions 7.1 and below, closed indices represent a data loss risk. Enable this setting only temporarily for these versions. + :::: + ::::{note} Closed indices still consume a significant amount of disk space. :::: diff --git a/docs/reference/toc.yml b/docs/reference/toc.yml index ad3b78058576c..45eb2dbaa9a93 100644 --- a/docs/reference/toc.yml +++ b/docs/reference/toc.yml @@ -30,7 +30,6 @@ toc: - file: elasticsearch/configuration-reference/transforms-settings.md - file: elasticsearch/configuration-reference/thread-pool-settings.md - file: elasticsearch/configuration-reference/watcher-settings.md - - file: elasticsearch/configuration-reference/elastic-cloud-hosted-elasticsearch-settings.md - file: elasticsearch/configuration-reference/elasticsearch-settings.md - file: elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md - file: elasticsearch/jvm-settings.md From c217fee9920e8e53023495b21455cff1659af318 Mon Sep 17 00:00:00 2001 From: Charlotte Hoblik Date: Mon, 17 Mar 2025 08:09:01 +0100 Subject: [PATCH 04/13] removing duplicate information from ECH --- .../elasticsearch-settings.md | 160 ------------------ 1 file changed, 160 deletions(-) diff --git a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md index d423239633397..f6d40e31e747e 100644 --- a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md @@ -49,43 +49,6 @@ Elasticsearch Service supports the following `elasticsearch.yml` settings. ### General settings [ec_general_settings] -The following general settings are supported: - -$$$http-cors-settings$$$`http.cors.*` -: Enables cross-origin resource sharing (CORS) settings for the [HTTP module](/reference/elasticsearch/configuration-reference/networking-settings.md). - - ::::{note} - If your use case depends on the ability to receive CORS requests and you have a cluster that was provisioned prior to January 25th 2019, you must manually set `http.cors.enabled` to `true` and allow a specific set of hosts with `http.cors.allow-origin`. Applying these changes in your Elasticsearch configuration allows cross-origin resource sharing requests. - :::: - - -`http.compression` -: Support for [HTTP compression](/reference/elasticsearch/configuration-reference/networking-settings.md) when possible (with Accept-Encoding). Defaults to `true`. - -`transport.compress` -: Configures [transport compression](/reference/elasticsearch/configuration-reference/networking-settings.md) for node-to-node traffic. - -`transport.compression_scheme` -: Configures [transport compression](/reference/elasticsearch/configuration-reference/networking-settings.md) for node-to-node traffic. - -`repositories.url.allowed_urls` -: Enables explicit allowing of [read-only URL repositories](docs-content://deploy-manage/tools/snapshot-and-restore/read-only-url-repository.md). - -`reindex.remote.whitelist` -: Explicitly allows the set of hosts that can be [reindexed from remotely](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex). Expects a YAML array of `host:port` strings. Consists of a comma-delimited list of `host:port` entries. Defaults to `["\*.io:*", "\*.com:*"]`. - -`reindex.ssl.*` -: To learn more on how to configure reindex SSL user settings, check [configuring reindex SSL parameters](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex). - -`script.painless.regex.enabled` -: Enables [regular expressions](/reference/scripting-languages/painless/brief-painless-walkthrough.md#modules-scripting-painless-regex) for the Painless scripting language. - -`action.auto_create_index` -: [Automatically create index](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-create) if it doesn’t already exist. - -`action.destructive_requires_name` -: When set to `true`, users must [specify the index name](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-delete) to delete an index. It’s not possible to delete _all or use wildcards. - `xpack.notification.webhook.additional_token_enabled` : When set to `true`, {{es}} automatically sets a token which enables the bypassing of traffic filters for calls initiated by Watcher towards {{es}} or {{kib}}. The default is `false` and the feature is available starting with {{es}} version 8.7.1 and later. @@ -93,39 +56,9 @@ $$$http-cors-settings$$$`http.cors.*` This setting only applies to the Watcher `webhook` action, not the `http` input action. :::: - -`cluster.indices.close.enable` -: Enables closing indices in Elasticsearch. Defaults to `true` for versions 7.2.0 and later, and to `false` for previous versions. In versions 7.1 and below, closed indices represent a data loss risk: if you close an index, it is not included in snapshots and you will not be able to restore the data. Similarly, closed indices are not included when you make cluster configuration changes, such as scaling to a different capacity, failover, and many other operations. Lastly, closed indices can lead to inaccurate disk space counts. - - ::::{warning} - For versions 7.1 and below, closed indices represent a data loss risk. Enable this setting only temporarily for these versions. - :::: - - `azure.client.CLIENT_NAME.endpoint_suffix` : Allows providing the [endpoint_suffix client setting](docs-content://deploy-manage/tools/snapshot-and-restore/azure-repository.md#repository-azure-client-settings) for a non-internal Azure client used for snapshot/restore. Note that `CLIENT_NAME` should be replaced with the name of the created client. - -### Circuit breaker settings [ec_circuit_breaker_settings] - -The following circuit breaker settings are supported: - -`indices.breaker.total.limit` -: Configures [the parent circuit breaker settings](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#parent-circuit-breaker). - -`indices.breaker.fielddata.limit` -: Configures [the limit for the fielddata breaker](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#fielddata-circuit-breaker). - -`indices.breaker.fielddata.overhead` -: Configures [a constant that all field data estimations are multiplied with to determine a final estimation](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#fielddata-circuit-breaker). - -`indices.breaker.request.limit` -: Configures [the limit for the request breaker](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#request-circuit-breaker). - -`indices.breaker.request.overhead` -: Configures [a constant that all request estimations are multiplied by to determine a final estimation](/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md#request-circuit-breaker). - - ### Indexing pressure settings [ec_indexing_pressure_settings] The following indexing pressure settings are supported: @@ -144,15 +77,9 @@ The following indexing pressure settings are supported: #### All supported versions [ec_all_supported_versions] -`xpack.ml.inference_model.time_to_live` -: Sets the duration of time that the trained models are cached. Check [{{ml-cap}} settings](/reference/elasticsearch/configuration-reference/machine-learning-settings.md). - `xpack.security.loginAssistanceMessage` : Adds a message to the login screen. Useful for displaying corporate messages. -`xpack.security.authc.anonymous.*` -: To learn more on how to enable anonymous access, check [Enabling anonymous access](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/anonymous-access.md) - `xpack.notification.slack` : Configures [Slack notification settings](docs-content://explore-analyze/alerts-cases/watcher/actions-slack.md). Note that you need to add `secure_url` as a [secret value to the keystore](docs-content://deploy-manage/security/secure-settings.md). @@ -162,26 +89,14 @@ The following indexing pressure settings are supported: `xpack.watcher.trigger.schedule.engine` : Defines when the watch should start, based on date and time [Learn more](docs-content://explore-analyze/alerts-cases/watcher/schedule-types.md). -`xpack.notification.email.html.sanitization.*` -: Enables [email notification settings](/reference/elasticsearch/configuration-reference/watcher-settings.md) to sanitize HTML elements in emails that are sent. - -`xpack.monitoring.collection.interval` -: Controls [how often data samples are collected](/reference/elasticsearch/configuration-reference/monitoring-settings.md#monitoring-collection-settings). - `xpack.monitoring.collection.min_interval_seconds` : Specifies the minimum number of seconds that a time bucket in a chart can represent. If you modify the `xpack.monitoring.collection.interval`, use the same value in this setting. Defaults to `10` (10 seconds). - -$$$xpack-monitoring-history-duration$$$`xpack.monitoring.history.duration` -: Sets the [retention duration](/reference/elasticsearch/configuration-reference/monitoring-settings.md#monitoring-collection-settings) beyond which the indices created by a monitoring exporter will be automatically deleted. - `xpack.watcher.history.cleaner_service.enabled` : Controls [whether old watcher indices are automatically deleted](/reference/elasticsearch/configuration-reference/watcher-settings.md#general-notification-settings). -`xpack.http.ssl.cipher_suites` -: Controls the list of supported cipher suites for all outgoing TLS connections. `xpack.security.authc.realms.saml.*` : To learn more on how to enable SAML and related user settings, check [secure your clusters with SAML](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/saml.md). @@ -200,37 +115,12 @@ All SAML, OpenID Connect, Kerberos, and JWT settings are allowlisted. :::: - - ### Search [ec_search] The following search settings are supported: * `search.aggs.rewrite_to_filter_by_filter` - -### Disk-based shard allocation settings [shard-allocation-settings] - -The following disk-based allocation settings are supported: - -`cluster.routing.allocation.disk.threshold_enabled` -: Enable or disable [disk allocation](/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md) decider and defaults to `true`. - -`cluster.routing.allocation.disk.watermark.low` -: Configures [disk-based shard allocation’s low watermark](/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md). - -`cluster.routing.allocation.disk.watermark.high` -: Configures [disk-based shard allocation’s high watermark](/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md). - -`cluster.routing.allocation.disk.watermark.flood_stage` -: Configures [disk-based shard allocation’s flood_stage](/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md). - -::::{tip} -Remember to update user settings for alerts when performing a major version upgrade. -:::: - - - ### Enrich settings [ec_enrich_settings] The following enrich settings are supported: @@ -247,56 +137,6 @@ The following enrich settings are supported: `enrich.coordinator_proxy.queue_capacity` : coordinator queue capacity, defaults to max_concurrent_requests * max_lookups_per_request - -### Audit settings [ec_audit_settings] - -The following audit settings are supported: - -`xpack.security.audit.enabled` -: Enables auditing on Elasticsearch cluster nodes. Defaults to *false*. - -`xpack.security.audit.logfile.events.include` -: Specifies which events to include in the auditing output. - -`xpack.security.audit.logfile.events.exclude` -: Specifies which events to exclude from the output. No events are excluded by default. - -`xpack.security.audit.logfile.events.emit_request_body` -: Specifies whether to include the request body from REST requests on certain event types, for example *authentication_failed*. Defaults to *false*. - -`xpack.security.audit.logfile.emit_node_name` -: Specifies whether to include the node name as a field in each audit event. Defaults to *true*. - -`xpack.security.audit.logfile.emit_node_host_address` -: Specifies whether to include the node’s IP address as a field in each audit event. Defaults to *false*. - -`xpack.security.audit.logfile.emit_node_host_name` -: Specifies whether to include the node’s host name as a field in each audit event. Defaults to *false*. - -`xpack.security.audit.logfile.emit_node_id` -: Specifies whether to include the node ID as a field in each audit event. Defaults to *true*. - -`xpack.security.audit.logfile.events.ignore_filters..users` -: A list of user names or wildcards. The specified policy will not print audit events for users matching these values. - -`xpack.security.audit.logfile.events.ignore_filters..realms` -: A list of authentication realm names or wildcards. The specified policy will not print audit events for users in these realms. - -`xpack.security.audit.logfile.events.ignore_filters..roles` -: A list of role names or wildcards. The specified policy will not print audit events for users that have these roles. - -`xpack.security.audit.logfile.events.ignore_filters..indices` -: A list of index names or wildcards. The specified policy will not print audit events when all the indices in the event match these values. - -`xpack.security.audit.logfile.events.ignore_filters..actions` -: A list of action names or wildcards. The specified policy will not print audit events for actions matching these values. - -::::{note} -To enable auditing you must first [enable deployment logging](docs-content://deploy-manage/monitor/stack-monitoring/elastic-cloud-stack-monitoring.md). -:::: - - - ### Universal Profiling settings [ec_universal_profiling_settings] The following settings for Elastic Universal Profiling are supported: From 09323d3b14b620ba143c52946aa332362b6a2247 Mon Sep 17 00:00:00 2001 From: Charlotte Hoblik Date: Mon, 17 Mar 2025 09:13:01 +0100 Subject: [PATCH 05/13] move settings to correcponding page --- .../elasticsearch-settings.md | 32 ------------------- .../enrich-settings.md | 15 +++++++++ .../snapshot-restore-settings.md | 3 ++ .../watcher-settings.md | 6 ++++ docs/reference/toc.yml | 5 +-- 5 files changed, 27 insertions(+), 34 deletions(-) create mode 100644 docs/reference/elasticsearch/configuration-reference/enrich-settings.md diff --git a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md index f6d40e31e747e..b60ae06df4b40 100644 --- a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md @@ -56,16 +56,6 @@ Elasticsearch Service supports the following `elasticsearch.yml` settings. This setting only applies to the Watcher `webhook` action, not the `http` input action. :::: -`azure.client.CLIENT_NAME.endpoint_suffix` -: Allows providing the [endpoint_suffix client setting](docs-content://deploy-manage/tools/snapshot-and-restore/azure-repository.md#repository-azure-client-settings) for a non-internal Azure client used for snapshot/restore. Note that `CLIENT_NAME` should be replaced with the name of the created client. - -### Indexing pressure settings [ec_indexing_pressure_settings] - -The following indexing pressure settings are supported: - -`indexing_pressure.memory.limit` -: Configures [the indexing pressure settings](/reference/elasticsearch/index-settings/pressure.md). - ### X-Pack [ec_x_pack] @@ -80,12 +70,6 @@ The following indexing pressure settings are supported: `xpack.security.loginAssistanceMessage` : Adds a message to the login screen. Useful for displaying corporate messages. -`xpack.notification.slack` -: Configures [Slack notification settings](docs-content://explore-analyze/alerts-cases/watcher/actions-slack.md). Note that you need to add `secure_url` as a [secret value to the keystore](docs-content://deploy-manage/security/secure-settings.md). - -`xpack.notification.pagerduty` -: Configures [PagerDuty notification settings](docs-content://explore-analyze/alerts-cases/watcher/actions-pagerduty.md#configuring-pagerduty). - `xpack.watcher.trigger.schedule.engine` : Defines when the watch should start, based on date and time [Learn more](docs-content://explore-analyze/alerts-cases/watcher/schedule-types.md). @@ -121,22 +105,6 @@ The following search settings are supported: * `search.aggs.rewrite_to_filter_by_filter` -### Enrich settings [ec_enrich_settings] - -The following enrich settings are supported: - -`enrich.cache_size` -: Maximum number of searches to cache for enriching documents. Defaults to 1000. There is a single cache for all enrich processors in the cluster. This setting determines the size of that cache. - -`enrich.coordinator_proxy.max_concurrent_requests` -: Maximum number of concurrent multi-search requests to run when enriching documents. Defaults to 8. - -`enrich.coordinator_proxy.max_lookups_per_request` -: Maximum number of searches to include in a multi-search request when enriching documents. Defaults to 128. - -`enrich.coordinator_proxy.queue_capacity` -: coordinator queue capacity, defaults to max_concurrent_requests * max_lookups_per_request - ### Universal Profiling settings [ec_universal_profiling_settings] The following settings for Elastic Universal Profiling are supported: diff --git a/docs/reference/elasticsearch/configuration-reference/enrich-settings.md b/docs/reference/elasticsearch/configuration-reference/enrich-settings.md new file mode 100644 index 0000000000000..e898bb4110204 --- /dev/null +++ b/docs/reference/elasticsearch/configuration-reference/enrich-settings.md @@ -0,0 +1,15 @@ +# Enrich settings [enrich_settings] + +You can configure these enrich settings in the `elasticsearch.yml` file. For more information, see [Set up an enrich processor](docs-content:///manage-data/ingest/transform-enrich/set-up-an-enrich-processor.md). + +`enrich.cache_size` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: Maximum number of searches to cache for enriching documents. Defaults to 1000. There is a single cache for all enrich processors in the cluster. This setting determines the size of that cache. + +`enrich.coordinator_proxy.max_concurrent_requests` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: Maximum number of concurrent multi-search requests to run when enriching documents. Defaults to 8. + +`enrich.coordinator_proxy.max_lookups_per_request` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: Maximum number of searches to include in a multi-search request when enriching documents. Defaults to 128. + +`enrich.coordinator_proxy.queue_capacity` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: coordinator queue capacity, defaults to max_concurrent_requests * max_lookups_per_request \ No newline at end of file diff --git a/docs/reference/elasticsearch/configuration-reference/snapshot-restore-settings.md b/docs/reference/elasticsearch/configuration-reference/snapshot-restore-settings.md index 5d1cc998b580c..fb2cc294693a4 100644 --- a/docs/reference/elasticsearch/configuration-reference/snapshot-restore-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/snapshot-restore-settings.md @@ -14,6 +14,9 @@ $$$snapshot-max-concurrent-ops$$$ This limit applies in total to all ongoing snapshot creation, cloning, and deletion operations. {{es}} will reject any operations that would exceed this limit. +`azure.client.CLIENT_NAME.endpoint_suffix` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: Allows providing the [endpoint_suffix client setting](docs-content://deploy-manage/tools/snapshot-and-restore/azure-repository.md#repository-azure-client-settings) for a non-internal Azure client used for snapshot/restore. Note that `CLIENT_NAME` should be replaced with the name of the created client. + ## {{slm-init}} settings [_slm_init_settings] diff --git a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md index a9cdf48b48ec4..e5b75f4185d98 100644 --- a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md @@ -452,6 +452,9 @@ PKCS#12 files are configured in the same way as Java keystore files: You can configure the following Slack notification settings in `elasticsearch.yml`. For more information about sending notifications via Slack, see [Configuring Slack actions](docs-content://explore-analyze/alerts-cases/watcher/actions-slack.md#configuring-slack-actions). +`xpack.notification.slack` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: Configures [Slack notification settings](docs-content://explore-analyze/alerts-cases/watcher/actions-slack.md). Note that you need to add `secure_url` as a [secret value to the keystore](docs-content://deploy-manage/security/secure-settings.md). + `xpack.notification.slack.default_account` : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Default Slack account to use. @@ -522,6 +525,9 @@ $$$jira-account-attributes$$$ You can configure the following PagerDuty notification settings in `elasticsearch.yml`. For more information about sending notifications via PagerDuty, see [Configuring PagerDuty actions](docs-content://explore-analyze/alerts-cases/watcher/actions-pagerduty.md#configuring-pagerduty-actions). +`xpack.notification.pagerduty` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: Configures [PagerDuty notification settings](docs-content://explore-analyze/alerts-cases/watcher/actions-pagerduty.md#configuring-pagerduty). + `xpack.notification.pagerduty.default_account` : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Default PagerDuty account to use. diff --git a/docs/reference/toc.yml b/docs/reference/toc.yml index 45eb2dbaa9a93..09f067c7d99c4 100644 --- a/docs/reference/toc.yml +++ b/docs/reference/toc.yml @@ -2,8 +2,11 @@ toc: - file: index.md - file: elasticsearch/configuration-reference/index.md children: + - file: elasticsearch/configuration-reference/elasticsearch-settings.md + - file: elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md - file: elasticsearch/configuration-reference/circuit-breaker-settings.md - file: elasticsearch/configuration-reference/auding-settings.md + - file: elasticsearch/configuration-reference/enrich-settings.md - file: elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md - file: elasticsearch/configuration-reference/miscellaneous-cluster-settings.md - file: elasticsearch/configuration-reference/cross-cluster-replication-settings.md @@ -30,8 +33,6 @@ toc: - file: elasticsearch/configuration-reference/transforms-settings.md - file: elasticsearch/configuration-reference/thread-pool-settings.md - file: elasticsearch/configuration-reference/watcher-settings.md - - file: elasticsearch/configuration-reference/elasticsearch-settings.md - - file: elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md - file: elasticsearch/jvm-settings.md - file: elasticsearch/roles.md - file: elasticsearch/security-privileges.md From 47a41c5c52ab48b6a4760eb78a3185ed6809df61 Mon Sep 17 00:00:00 2001 From: Charlotte Hoblik Date: Mon, 17 Mar 2025 09:28:22 +0100 Subject: [PATCH 06/13] update configuration page --- .../elastic-cloud-serverless-elasticsearch-settings.md | 2 +- .../configuration-reference/elasticsearch-settings.md | 2 +- docs/reference/elasticsearch/configuration-reference/index.md | 3 ++- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/reference/elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md b/docs/reference/elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md index 499808d5e4214..3d3277dbf1abe 100644 --- a/docs/reference/elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md @@ -6,7 +6,7 @@ applies_to: serverless: --- -# Differences from other {{es}} offerings [elasticsearch-differences] +# User settings in {{es}} {{serverless-short}} [elasticsearch-differences] [{{es-serverless}}](docs-content://solutions/search.md) handles all the infrastructure management for you, providing a fully managed {{es}} service. diff --git a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md index b60ae06df4b40..6a09d68b596ba 100644 --- a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md @@ -9,7 +9,7 @@ applies_to: ece: --- -# Elasticsearch settings [add-user-settings] +# Configure {{es}} [add-user-settings] Change how {{es}} runs by providing your own user settings. Elasticsearch Service appends these settings to each node’s `elasticsearch.yml` configuration file. diff --git a/docs/reference/elasticsearch/configuration-reference/index.md b/docs/reference/elasticsearch/configuration-reference/index.md index 64f419c9ad97f..bae060723e217 100644 --- a/docs/reference/elasticsearch/configuration-reference/index.md +++ b/docs/reference/elasticsearch/configuration-reference/index.md @@ -7,7 +7,7 @@ navigation_title: "Configuration" Configuration settings enable you to customize the behavior of Elasticsearch features. This reference provides details about each setting, such as its purpose, default behavior, and availability in Elastic Cloud environments. -% TO-DO: For information about how to update these settings, refer to "Configure Elasticsearch" (link to appropriate deployment pages) % +For details on updating user settings, see [Configure Elasticsearch](elasticsearch-settings.md) ({{ece}} and {{ech}}) and [User settings in Elasticsearch Serverless](elastic-cloud-serverless-elasticsearch-settings.md) ({{serverless-short}}). The settings are grouped by feature or purpose, for example: @@ -16,6 +16,7 @@ The settings are grouped by feature or purpose, for example: - [Cluster formation and discovery](/reference/elasticsearch/configuration-reference/discovery-cluster-formation-settings.md) - [Cross-cluster replication](/reference/elasticsearch/configuration-reference/cross-cluster-replication-settings.md) - [Data stream lifecycle](/reference/elasticsearch/configuration-reference/data-stream-lifecycle-settings.md) +- [Enrich settings](/reference/elasticsearch/configuration-reference/enrich-settings.md) - [Field data cache](/reference/elasticsearch/configuration-reference/field-data-cache-settings.md) - [Health diagnostic](/reference/elasticsearch/configuration-reference/health-diagnostic-settings.md) - [Index lifecycle management](/reference/elasticsearch/configuration-reference/index-lifecycle-management-settings.md), From a03692d3daf043447fef03fc870ab344979e13ca Mon Sep 17 00:00:00 2001 From: Charlotte Hoblik Date: Mon, 17 Mar 2025 12:37:29 +0100 Subject: [PATCH 07/13] fix link --- .../configuration-reference/elasticsearch-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md index 6a09d68b596ba..51f9d428b78bb 100644 --- a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md @@ -13,7 +13,7 @@ applies_to: Change how {{es}} runs by providing your own user settings. Elasticsearch Service appends these settings to each node’s `elasticsearch.yml` configuration file. -Elasticsearch Service automatically rejects `elasticsearch.yml` settings that could break your cluster. For a list of supported settings, check [Supported {{es}} settings](#TODO). +Elasticsearch Service automatically rejects `elasticsearch.yml` settings that could break your cluster. For a list of supported settings, check [Supported {{es}} settings](index.md). ::::{tip} Some settings that could break your cluster if set incorrectly are blocked, such as certain zen discovery and security settings. For examples of a few of the settings that are generally safe in cloud environments, check [Edit stack settings](docs-content://deploy-manage/deploy/cloud-enterprise/edit-stack-settings.md) for {{ece}} and [Edit stack settings](docs-content://deploy-manage/deploy/elastic-cloud/edit-stack-settings.md) for the {{ech}} offering. From 3f002b454aa216d493b7329273246dbaa0f411c3 Mon Sep 17 00:00:00 2001 From: lcawl Date: Mon, 17 Mar 2025 22:16:59 -0700 Subject: [PATCH 08/13] Add applies_to frontmatter to auditing settings --- .../elasticsearch/configuration-reference/auding-settings.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/reference/elasticsearch/configuration-reference/auding-settings.md b/docs/reference/elasticsearch/configuration-reference/auding-settings.md index ed35718e38848..7290a4c0e66b1 100644 --- a/docs/reference/elasticsearch/configuration-reference/auding-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/auding-settings.md @@ -2,6 +2,10 @@ navigation_title: "Auditing settings" mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/auditing-settings.html +applies_to: + deployment: + ess: + self: --- # Auditing security settings [auditing-settings] From 5ef3a62ce6aa80d9d40530b12919526052897f3d Mon Sep 17 00:00:00 2001 From: Charlotte Hoblik Date: Tue, 18 Mar 2025 13:24:15 +0100 Subject: [PATCH 09/13] remove duplicate how-to pages --- ...cloud-serverless-elasticsearch-settings.md | 159 ------------------ .../elasticsearch-settings.md | 148 ---------------- .../index-management-settings.md | 9 + .../configuration-reference/index.md | 2 +- .../monitoring-settings.md | 5 + .../search-settings.md | 4 + .../security-settings.md | 21 +++ .../watcher-settings.md | 13 ++ docs/reference/toc.yml | 2 - 9 files changed, 53 insertions(+), 310 deletions(-) delete mode 100644 docs/reference/elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md delete mode 100644 docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md diff --git a/docs/reference/elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md b/docs/reference/elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md deleted file mode 100644 index 3d3277dbf1abe..0000000000000 --- a/docs/reference/elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -navigation_title: "{{es}} settings {{serverless-short}}" -mapped_pages: - - https://www.elastic.co/guide/en/serverless/current/elasticsearch-differences.html -applies_to: - serverless: ---- - -# User settings in {{es}} {{serverless-short}} [elasticsearch-differences] - - -[{{es-serverless}}](docs-content://solutions/search.md) handles all the infrastructure management for you, providing a fully managed {{es}} service. - -If you’ve used {{es}} before, you’ll notice some differences in how you work with the service on {{serverless-full}}, because a number of APIs and settings are not required for serverless projects. - -This guide helps you understand what’s different, what’s available, and how to work effectively when running {{es}} on {{serverless-full}}. - - -## Fully managed infrastructure [elasticsearch-differences-serverless-infrastructure-management] - -{{es-serverless}} manages all infrastructure automatically, including: - -* Cluster scaling and optimization -* Node management and allocation -* Shard distribution and replication -* Resource utilization and monitoring - -This fully managed approach means many traditional {{es}} infrastructure APIs and settings are not available to end users, as detailed in the following sections. - - -## Index size guidelines [elasticsearch-differences-serverless-index-size] - -To ensure optimal performance, follow these recommendations for sizing individual indices on {{es-serverless}}: - -| Use case | Maximum index size | Project configuration | -| --- | --- | --- | -| Vector search | 150GB | Vector optimized | -| General search (non data-stream) | 300GB | General purpose | -| Other uses (non data-stream) | 600GB | General purpose | - -For large datasets that exceed the recommended maximum size for a single index, consider splitting your data across smaller indices and using an alias to search them collectively. - -These recommendations do not apply to indices using better binary quantization (BBQ). Refer to [vector quantization](/reference/elasticsearch/mapping-reference/dense-vector.md#dense-vector-quantization) in the core {{es}} docs for more information. - - -## API availability [elasticsearch-differences-serverless-apis-availability] - -Because {{es-serverless}} manages infrastructure automatically, certain APIs are not available, while others remain fully accessible. - -::::{tip} -Refer to the [{{es-serverless}} API reference](https://www.elastic.co/docs/api/doc/elasticsearch-serverless) for a complete list of available APIs. - -:::: - - -The following categories of operations are unavailable: - -Infrastructure operations -: * All `_nodes/*` operations -* All `_cluster/*` operations -* Most `_cat/*` operations, except for index-related operations such as `/_cat/indices` and `/_cat/aliases` - - -Storage and backup -: * All `_snapshot/*` operations -* Repository management operations - - -Index management -: * `indices/close` operations -* `indices/open` operations -* Recovery and stats operations -* Force merge operations - - -When attempting to use an unavailable API, you’ll receive a clear error message: - -```json -{ - "error": { - "root_cause": [ - { - "type": "api_not_available_exception", - "reason": "Request for uri [/] with method [] exists but is not available when running in serverless mode" - } - ], - "status": 410 - } -} -``` - - -## Settings availability [elasticsearch-differences-serverless-settings-availability] - -In {{es-serverless}}, you can only configure [index-level settings](/reference/elasticsearch/index-settings/index.md). Cluster-level settings and node-level settings are not required by end users and the `elasticsearch.yml` file is fully managed by Elastic. - -Available settings -: **Index-level settings**: Settings that control how {{es}} documents are processed, stored, and searched are available to end users. These include: - - * Analysis configuration - * Mapping parameters - * Search/query settings - * Indexing settings such as `refresh_interval` - - -Managed settings -: **Infrastructure-related settings**: Settings that affect cluster resources or data distribution are not available to end users. These include: - - * Node configurations - * Cluster topology - * Shard allocation - * Resource management - - - -## Feature availability [elasticsearch-differences-serverless-feature-categories] - -Some features that are available in Elastic Cloud Hosted and self-managed offerings are not available in {{es-serverless}}. These features have either been replaced by a new feature, are planned to be released in future, or are not applicable in the new serverless architecture. - - -### Replaced features [elasticsearch-differences-serverless-features-replaced] - -These features have been replaced by a new feature and are therefore not available on {{es-serverless}}: - -* **Index lifecycle management ({{ilm-init}})** is not available, in favor of [**data stream lifecycle**](docs-content://manage-data/data-store/index-basics.md). - - In an Elastic Cloud Hosted or self-managed environment, {{ilm-init}} lets you automatically transition indices through data tiers according to your performance needs and retention requirements. This allows you to balance hardware costs with performance. {{es-serverless}} eliminates this complexity by optimizing your cluster performance for you. - - Data stream lifecycle is an optimized lifecycle tool that lets you focus on the most common lifecycle management needs, without unnecessary hardware-centric concepts like data tiers. - -* **Watcher** is not available, in favor of [**Alerts**](docs-content://explore-analyze/alerts-cases/alerts.md#rules-alerts). - - Kibana Alerts allows rich integrations across use cases like APM, metrics, security, and uptime. Prepackaged rule types simplify setup and hide the details of complex, domain-specific detections, while providing a consistent interface across Kibana. - - - -### Planned features [elasticsearch-differences-serverless-feature-planned] - -The following features are planned for future support in all {{serverless-full}} projects: - -* Reindexing from remote clusters -* Cross-project search and replication -* Snapshot and restore -* Migrations from non-serverless deployments -* Audit logging -* Clone index API -* Traffic filtering and VPCs - - - -### Unplanned features [elasticsearch-differences-serverless-feature-unavailable] - -The following features are not available in {{es-serverless}} and are not planned for future support: - -* [Custom plugins and bundles](docs-content://deploy-manage/deploy/elastic-cloud/upload-custom-plugins-bundles.md) -* {{es}} for Apache Hadoop -* [Scripted metric aggregations](/reference/data-analysis/aggregations/search-aggregations-metrics-scripted-metric-aggregation.md) -* Managed web crawler: You can use the [self-managed web crawler](https://github.com/elastic/crawler) instead. -* Managed Search connectors: You can use [self-managed Search connectors](/reference/ingestion-tools/search-connectors/self-managed-connectors.md) instead. diff --git a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md b/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md deleted file mode 100644 index 51f9d428b78bb..0000000000000 --- a/docs/reference/elasticsearch/configuration-reference/elasticsearch-settings.md +++ /dev/null @@ -1,148 +0,0 @@ ---- -navigation_title: "{{es}} settings for ECH and ECE" -mapped_pages: - - https://www.elastic.co/guide/en/cloud/current/ec-add-user-settings.html#ec-es-elasticsearch-settings - - https://www.elastic.co/guide/en/cloud-enterprise/current/ece-add-user-settings.html#ece-change-user-settings-examples -applies_to: - deployment: - ess: - ece: ---- - -# Configure {{es}} [add-user-settings] - -Change how {{es}} runs by providing your own user settings. Elasticsearch Service appends these settings to each node’s `elasticsearch.yml` configuration file. - -Elasticsearch Service automatically rejects `elasticsearch.yml` settings that could break your cluster. For a list of supported settings, check [Supported {{es}} settings](index.md). - -::::{tip} -Some settings that could break your cluster if set incorrectly are blocked, such as certain zen discovery and security settings. For examples of a few of the settings that are generally safe in cloud environments, check [Edit stack settings](docs-content://deploy-manage/deploy/cloud-enterprise/edit-stack-settings.md) for {{ece}} and [Edit stack settings](docs-content://deploy-manage/deploy/elastic-cloud/edit-stack-settings.md) for the {{ech}} offering. -:::: - -::::{warning} -You can also update [dynamic cluster settings](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting) using {{es}}'s [update cluster settings API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings). However, Elasticsearch Service doesn’t reject unsafe setting changes made using this API. Use with caution. -:::: - -## Add or edit user settings for {{ech}}: -```{applies_to} - deployment: - ess: -``` - -1. Log in to the [Elasticsearch Service Console](https://cloud.elastic.co?page=docs&placement=docs-body). -2. Find your deployment on the home page in the Elasticsearch Service card and select **Manage** to access it directly. Or, select **Hosted deployments** to go to the deployments page to view all of your deployments. - - On the deployments page you can narrow your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list. - -3. From your deployment menu, go to the **Edit** page. -4. In the **Elasticsearch** section, select **Manage user settings and extensions**. -5. Update the user settings. -6. Select **Save changes**. - -::::{note} -In some cases, you may get a warning saying "User settings are different across Elasticsearch instances". To fix this issue, ensure that your user settings (including the comments sections and whitespaces) are identical across all Elasticsearch nodes (not only the data tiers, but also the Master, Machine Learning, and Coordinating nodes). -:::: - -## Supported {{es}} settings [ec-es-elasticsearch-settings] - -Elasticsearch Service supports the following `elasticsearch.yml` settings. - -### General settings [ec_general_settings] - -`xpack.notification.webhook.additional_token_enabled` -: When set to `true`, {{es}} automatically sets a token which enables the bypassing of traffic filters for calls initiated by Watcher towards {{es}} or {{kib}}. The default is `false` and the feature is available starting with {{es}} version 8.7.1 and later. - - ::::{important} - This setting only applies to the Watcher `webhook` action, not the `http` input action. - :::: - - -### X-Pack [ec_x_pack] - -#### Version 8.5.3+, 7.x support in 7.17.8+ [ec_version_8_5_3_7_x_support_in_7_17_8] - -`xpack.security.transport.ssl.trust_restrictions.x509_fields` -: Specifies which field(s) from the TLS certificate is used to match for the restricted trust management that is used for remote clusters connections. This should only be set when a self managed cluster can not create certificates that follow the Elastic Cloud pattern. The default value is ["subjectAltName.otherName.commonName"], the Elastic Cloud pattern. "subjectAltName.dnsName" is also supported and can be configured in addition to or in replacement of the default. - - -#### All supported versions [ec_all_supported_versions] - -`xpack.security.loginAssistanceMessage` -: Adds a message to the login screen. Useful for displaying corporate messages. - -`xpack.watcher.trigger.schedule.engine` -: Defines when the watch should start, based on date and time [Learn more](docs-content://explore-analyze/alerts-cases/watcher/schedule-types.md). - -`xpack.monitoring.collection.min_interval_seconds` -: Specifies the minimum number of seconds that a time bucket in a chart can represent. If you modify the `xpack.monitoring.collection.interval`, use the same value in this setting. - - Defaults to `10` (10 seconds). - -`xpack.watcher.history.cleaner_service.enabled` -: Controls [whether old watcher indices are automatically deleted](/reference/elasticsearch/configuration-reference/watcher-settings.md#general-notification-settings). - - -`xpack.security.authc.realms.saml.*` -: To learn more on how to enable SAML and related user settings, check [secure your clusters with SAML](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/saml.md). - -`xpack.security.authc.realms.oidc.*` -: To learn more on how to enable OpenID Connect and related user settings, check [secure your clusters with OpenID Connect](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md). - -`xpack.security.authc.realms.kerberos.*` -: To learn more on how to enable Kerberos and relate user settings, check [secure your clusters with Kerberos](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kerberos.md). - -`xpack.security.authc.realms.jwt.*` -: To learn more on how to enable JWT and related user settings, check [secure your clusters with JWT](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/jwt.md). - -::::{note} -All SAML, OpenID Connect, Kerberos, and JWT settings are allowlisted. -:::: - - -### Search [ec_search] - -The following search settings are supported: - -* `search.aggs.rewrite_to_filter_by_filter` - -### Universal Profiling settings [ec_universal_profiling_settings] - -The following settings for Elastic Universal Profiling are supported: - -`xpack.profiling.enabled` -: *Version 8.7.0+*: Specifies whether the Universal Profiling Elasticsearch plugin is enabled. Defaults to *true*. - -`xpack.profiling.templates.enabled` -: *Version 8.9.0+*: Specifies whether Universal Profiling related index templates should be created on startup. Defaults to *false*. - -## Add or edit user settings for {{ece}}: -```{applies_to} - deployment: - ece: -``` - -1. [Log into the Cloud UI](docs-content://deploy-manage/deploy/cloud-enterprise/log-into-cloud-ui.md). -2. On the **Deployments** page, select your deployment. - - Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters. - -3. From your deployment menu, go to the **Edit** page. -4. In the **Elasticsearch** section, select **Edit elasticsearch.yml**. For deployments with existing user settings, you may have to expand the **User setting overrides** caret for each node type instead. -5. Update the user settings. -6. Select **Save changes**. - - ::::{warning} - If you encounter the **Edit elasticsearch.yml** carets, be sure to make your changes on all Elasticsearch node types. - :::: - -### Enable email notifications from Gmail [ece_enable_email_notifications_from_gmail] -```{applies_to} - deployment: - ece: -``` - -You can configure email notifications to Gmail for a user that you specify. For details, refer to [Configuring email actions](docs-content://explore-analyze/alerts-cases/watcher/actions-email.md). - -::::{warning} -Before you add the `xpack.notification.email*` setting in Elasticsearch user settings, make sure you add the account SMTP password to the keystore as a [secret value](docs-content://deploy-manage/security/secure-settings.md). -:::: \ No newline at end of file diff --git a/docs/reference/elasticsearch/configuration-reference/index-management-settings.md b/docs/reference/elasticsearch/configuration-reference/index-management-settings.md index 481814f224590..e2406e685862f 100644 --- a/docs/reference/elasticsearch/configuration-reference/index-management-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/index-management-settings.md @@ -61,6 +61,15 @@ This setting also affects the following built-in component templates: * `synthetics@mapping` * `synthetics@settings` +### Universal Profiling settings + +The following settings for Elastic Universal Profiling are supported: + +`xpack.profiling.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: *Version 8.7.0+*: Specifies whether the Universal Profiling Elasticsearch plugin is enabled. Defaults to *true*. + +`xpack.profiling.templates.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: *Version 8.9.0+*: Specifies whether Universal Profiling related index templates should be created on startup. Defaults to *false*. ## Reindex settings [reindex-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/index.md b/docs/reference/elasticsearch/configuration-reference/index.md index 29b4495a07000..d608efa916304 100644 --- a/docs/reference/elasticsearch/configuration-reference/index.md +++ b/docs/reference/elasticsearch/configuration-reference/index.md @@ -13,7 +13,7 @@ Refer to [Elasticsearch configuration](docs-content://deploy-manage/deploy/cloud Configuration settings enable you to customize the behavior of Elasticsearch features. This reference provides details about each setting, such as its purpose, default behavior, and availability in Elastic Cloud environments. -For details on updating user settings, see [Configure Elasticsearch](elasticsearch-settings.md) ({{ece}} and {{ech}}) and [User settings in Elasticsearch Serverless](elastic-cloud-serverless-elasticsearch-settings.md) ({{serverless-short}}). +For details on updating user settings, see [Edit Elastic Stack settings](docs-content://deploy-manage/deploy/elastic-cloud/edit-stack-settings) for {{ech}}, [Add Elasticsearch user settings](docs-content://deploy-manage/deploy/cloud-enterprise/edit-stack-settings-elasticsearch) for {{ece}} and [Differences from other Elasticsearch offerings](docs-content://deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings) for ({{serverless-short}}). The settings are grouped by feature or purpose, for example: diff --git a/docs/reference/elasticsearch/configuration-reference/monitoring-settings.md b/docs/reference/elasticsearch/configuration-reference/monitoring-settings.md index b7bc8cfbfcafe..6ba828d705733 100644 --- a/docs/reference/elasticsearch/configuration-reference/monitoring-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/monitoring-settings.md @@ -66,6 +66,11 @@ $$$xpack-monitoring-collection-interval$$$ `xpack.monitoring.collection.index.recovery.timeout` : ([Dynamic](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings)) [7.16.0] Timeout for collecting the recovery information, in [time units](/reference/elasticsearch/rest-apis/api-conventions.md#time-units). Defaults to `10s`. +`xpack.monitoring.collection.min_interval_seconds` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: Specifies the minimum number of seconds that a time bucket in a chart can represent. If you modify the `xpack.monitoring.collection.interval`, use the same value in this setting. + + Defaults to `10` (10 seconds). + $$$xpack-monitoring-history-duration$$$ `xpack.monitoring.history.duration` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") diff --git a/docs/reference/elasticsearch/configuration-reference/search-settings.md b/docs/reference/elasticsearch/configuration-reference/search-settings.md index 09290a4d82703..dbdd3bbb905fc 100644 --- a/docs/reference/elasticsearch/configuration-reference/search-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/search-settings.md @@ -58,4 +58,8 @@ $$$indices-query-bool-max-nested-depth$$$ This setting limits the nesting depth of queries. Deep nesting of queries may lead to stack overflow errors. +The following search settings are supported: + +* `search.aggs.rewrite_to_filter_by_filter` + diff --git a/docs/reference/elasticsearch/configuration-reference/security-settings.md b/docs/reference/elasticsearch/configuration-reference/security-settings.md index e340216885c24..9b356abf854a6 100644 --- a/docs/reference/elasticsearch/configuration-reference/security-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/security-settings.md @@ -144,6 +144,22 @@ Large real-time clock inconsistency across cluster nodes can cause problems with `xpack.security.authc.api_key.hashing.algorithm` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the hashing algorithm that is used for securing API key credentials. See [Table 3, Secure token hashing algorithms](#secure-token-hashing-algorithms). Defaults to `ssha256`. +`xpack.security.authc.realms.saml.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: To learn more on how to enable SAML and related user settings, check [secure your clusters with SAML](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/saml.md). + +`xpack.security.authc.realms.oidc.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: To learn more on how to enable OpenID Connect and related user settings, check [secure your clusters with OpenID Connect](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md). + +`xpack.security.authc.realms.kerberos.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: To learn more on how to enable Kerberos and relate user settings, check [secure your clusters with Kerberos](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kerberos.md). + +`xpack.security.authc.realms.jwt.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: To learn more on how to enable JWT and related user settings, check [secure your clusters with JWT](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/jwt.md). + +::::{note} +All SAML, OpenID Connect, Kerberos, and JWT settings are allowlisted. +:::: + ### Security domain settings [security-domain-settings] @@ -1839,6 +1855,9 @@ You can configure the following TLS/SSL settings. For more information, see Oracle’s [Java Cryptography Architecture documentation](https://docs.oracle.com/en/java/javase/11/security/oracle-providers.md#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2). +`xpack.security.transport.ssl.trust_restrictions.x509_fields` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: Specifies which field(s) from the TLS certificate is used to match for the restricted trust management that is used for remote clusters connections. This should only be set when a self managed cluster can not create certificates that follow the Elastic Cloud pattern. The default value is ["subjectAltName.otherName.commonName"], the Elastic Cloud pattern. "subjectAltName.dnsName" is also supported and can be configured in addition to or in replacement of the default. + ### Transport TLS/SSL key and trusted certificate settings [security-transport-tls-ssl-key-trusted-certificate-settings] @@ -1875,6 +1894,8 @@ When using PEM encoded files, use the following settings: This setting and `ssl.truststore.path` cannot be used at the same time. +`xpack.security.loginAssistanceMessage` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: Adds a message to the login screen. Useful for displaying corporate messages. ### Java keystore files [_java_keystore_files_3] diff --git a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md index e5b75f4185d98..59a3bfb22dcba 100644 --- a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md @@ -28,6 +28,12 @@ $$$xpack-watcher-encrypt-sensitive-data$$$ `xpack.watcher.max.history.record.size` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The maximum size watcher history record that can be written into the watcher history index. Any larger history record will have some of its larger fields removed. Defaults to 10mb. +`xpack.watcher.trigger.schedule.engine` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: Defines when the watch should start, based on date and time [Learn more](docs-content://explore-analyze/alerts-cases/watcher/schedule-types.md). + +`xpack.watcher.history.cleaner_service.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: Controls [whether old watcher indices are automatically deleted](/reference/elasticsearch/configuration-reference/watcher-settings.md#general-notification-settings). + `xpack.http.proxy.host` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the address of the proxy server to use to connect to HTTP services. @@ -567,5 +573,12 @@ $$$pagerduty-account-attributes$$$ `attach_payload` : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Whether or not to provide the watch payload as context for the event by default. Valid values: `true`, `false`. +`xpack.notification.webhook.additional_token_enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +: When set to `true`, {{es}} automatically sets a token which enables the bypassing of traffic filters for calls initiated by Watcher towards {{es}} or {{kib}}. The default is `false` and the feature is available starting with {{es}} version 8.7.1 and later. + + ::::{important} + This setting only applies to the Watcher `webhook` action, not the `http` input action. + :::: + diff --git a/docs/reference/toc.yml b/docs/reference/toc.yml index 422b94b394ed8..46398e22d9e6e 100644 --- a/docs/reference/toc.yml +++ b/docs/reference/toc.yml @@ -2,8 +2,6 @@ toc: - file: index.md - file: elasticsearch/configuration-reference/index.md children: - - file: elasticsearch/configuration-reference/elasticsearch-settings.md - - file: elasticsearch/configuration-reference/elastic-cloud-serverless-elasticsearch-settings.md - file: elasticsearch/configuration-reference/circuit-breaker-settings.md - file: elasticsearch/configuration-reference/auding-settings.md - file: elasticsearch/configuration-reference/enrich-settings.md From 93865f4bb728e05dd5aefe1f619d3a38d8def3c0 Mon Sep 17 00:00:00 2001 From: Charlotte Hoblik Date: Tue, 18 Mar 2025 13:27:33 +0100 Subject: [PATCH 10/13] fix broken links --- docs/reference/elasticsearch/configuration-reference/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/elasticsearch/configuration-reference/index.md b/docs/reference/elasticsearch/configuration-reference/index.md index d608efa916304..edbc4154fba52 100644 --- a/docs/reference/elasticsearch/configuration-reference/index.md +++ b/docs/reference/elasticsearch/configuration-reference/index.md @@ -13,7 +13,7 @@ Refer to [Elasticsearch configuration](docs-content://deploy-manage/deploy/cloud Configuration settings enable you to customize the behavior of Elasticsearch features. This reference provides details about each setting, such as its purpose, default behavior, and availability in Elastic Cloud environments. -For details on updating user settings, see [Edit Elastic Stack settings](docs-content://deploy-manage/deploy/elastic-cloud/edit-stack-settings) for {{ech}}, [Add Elasticsearch user settings](docs-content://deploy-manage/deploy/cloud-enterprise/edit-stack-settings-elasticsearch) for {{ece}} and [Differences from other Elasticsearch offerings](docs-content://deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings) for ({{serverless-short}}). +For details on updating user settings, see [Edit Elastic Stack settings](docs-content://deploy-manage/deploy/elastic-cloud/edit-stack-settings.md) for {{ech}}, [Add Elasticsearch user settings](docs-content://deploy-manage/deploy/cloud-enterprise/edit-stack-settings-elasticsearch.md) for {{ece}} and [Differences from other Elasticsearch offerings](docs-content://deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md) for ({{serverless-short}}). The settings are grouped by feature or purpose, for example: From 2c5518a42c7f1cb48aa1d63c56f979bc1d508e1a Mon Sep 17 00:00:00 2001 From: Charlotte Hoblik Date: Tue, 18 Mar 2025 13:52:02 +0100 Subject: [PATCH 11/13] replce cloud icon text --- .../auding-settings.md | 26 +- .../circuit-breaker-settings.md | 12 +- ...level-shard-allocation-routing-settings.md | 12 +- .../enrich-settings.md | 8 +- .../index-management-settings.md | 44 +-- .../configuration-reference/index.md | 2 +- .../machine-learning-settings.md | 4 +- .../monitoring-settings.md | 6 +- .../networking-settings.md | 20 +- .../security-settings.md | 306 +++++++++--------- .../snapshot-restore-settings.md | 4 +- .../watcher-settings.md | 20 +- 12 files changed, 232 insertions(+), 232 deletions(-) diff --git a/docs/reference/elasticsearch/configuration-reference/auding-settings.md b/docs/reference/elasticsearch/configuration-reference/auding-settings.md index 7290a4c0e66b1..53e9ed1b5b6e2 100644 --- a/docs/reference/elasticsearch/configuration-reference/auding-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/auding-settings.md @@ -24,7 +24,7 @@ If configured, auditing settings must be set on every node in the cluster. Stati $$$xpack-security-audit-enabled$$$ -`xpack.security.audit.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.audit.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Set to `true` to enable auditing on the node. The default value is `false`. This puts the auditing events in a dedicated file named `_audit.json` on each node. If enabled, this setting must be configured in `elasticsearch.yml` on all nodes in the cluster. @@ -37,17 +37,17 @@ The events and some other information about what gets logged can be controlled b $$$xpack-sa-lf-events-include$$$ -`xpack.security.audit.logfile.events.include` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.audit.logfile.events.include` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies the [kind of events](/reference/elasticsearch/elasticsearch-audit-events.md) to print in the auditing output. In addition, `_all` can be used to exhaustively audit all the events, but this is usually discouraged since it will get very verbose. The default list value contains: `access_denied, access_granted, anonymous_access_denied, authentication_failed, connection_denied, tampered_request, run_as_denied, run_as_granted, security_config_change`. $$$xpack-sa-lf-events-exclude$$$ -`xpack.security.audit.logfile.events.exclude` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.audit.logfile.events.exclude` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Excludes the specified [kind of events](/reference/elasticsearch/elasticsearch-audit-events.md) from the include list. This is useful in the case where the `events.include` setting contains the special value `_all`. The default is the empty list. $$$xpack-sa-lf-events-emit-request$$$ -`xpack.security.audit.logfile.events.emit_request_body` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.audit.logfile.events.emit_request_body` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the full request body from REST requests as an attribute of certain kinds of audit events. This setting can be used to [audit search queries](docs-content://deploy-manage/monitor/logging-configuration/auditing-search-queries.md). The default value is `false`, so request bodies are not printed. @@ -62,22 +62,22 @@ $$$xpack-sa-lf-events-emit-request$$$ $$$xpack-sa-lf-emit-node-name$$$ -`xpack.security.audit.logfile.emit_node_name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.audit.logfile.emit_node_name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the [node name](docs-content://deploy-manage/deploy/self-managed/important-settings-configuration.md#node-name) as a field in each audit event. The default value is `false`. $$$xpack-sa-lf-emit-node-host-address$$$ -`xpack.security.audit.logfile.emit_node_host_address` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.audit.logfile.emit_node_host_address` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the node’s IP address as a field in each audit event. The default value is `false`. $$$xpack-sa-lf-emit-node-host-name$$$ -`xpack.security.audit.logfile.emit_node_host_name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.audit.logfile.emit_node_host_name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the node’s host name as a field in each audit event. The default value is `false`. $$$xpack-sa-lf-emit-node-id$$$ -`xpack.security.audit.logfile.emit_node_id` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.audit.logfile.emit_node_id` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the node id as a field in each audit event. Unlike [node name](docs-content://deploy-manage/deploy/self-managed/important-settings-configuration.md#node-name), whose value might change if the administrator changes the setting in the config file, the node id will persist across cluster restarts and the administrator cannot change it. The default value is `true`. @@ -87,27 +87,27 @@ The following settings affect the [ignore policies](docs-content://deploy-manage $$$xpack-sa-lf-events-ignore-users$$$ -`xpack.security.audit.logfile.events.ignore_filters..users` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.audit.logfile.events.ignore_filters..users` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of user names or wildcards. The specified policy will not print audit events for users matching these values. $$$xpack-sa-lf-events-ignore-realms$$$ -`xpack.security.audit.logfile.events.ignore_filters..realms` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.audit.logfile.events.ignore_filters..realms` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of authentication realm names or wildcards. The specified policy will not print audit events for users in these realms. $$$xpack-sa-lf-events-ignore-actions$$$ -`xpack.security.audit.logfile.events.ignore_filters..actions` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.audit.logfile.events.ignore_filters..actions` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of action names or wildcards. Action name can be found in the `action` field of the audit event. The specified policy will not print audit events for actions matching these values. $$$xpack-sa-lf-events-ignore-roles$$$ -`xpack.security.audit.logfile.events.ignore_filters..roles` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.audit.logfile.events.ignore_filters..roles` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of role names or wildcards. The specified policy will not print audit events for users that have these roles. If the user has several roles, some of which are **not** covered by the policy, the policy will **not** cover this event. $$$xpack-sa-lf-events-ignore-indices$$$ -`xpack.security.audit.logfile.events.ignore_filters..indices` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.audit.logfile.events.ignore_filters..indices` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of index names or wildcards. The specified policy will not print audit events when all the indices in the event match these values. If the event concerns several indices, some of which are **not** covered by the policy, the policy will **not** cover this event. diff --git a/docs/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md b/docs/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md index 3c2b5ae72d198..456c3858d18b0 100644 --- a/docs/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md @@ -26,7 +26,7 @@ The parent-level breaker can be configured with the following settings: $$$indices-breaker-total-limit$$$ -`indices.breaker.total.limit` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`indices.breaker.total.limit` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Starting limit for overall parent breaker. Defaults to 70% of JVM heap if `indices.breaker.total.use_real_memory` is `false`. If `indices.breaker.total.use_real_memory` is `true`, defaults to 95% of the JVM heap. @@ -36,12 +36,12 @@ The field data circuit breaker estimates the heap memory required to load a fiel $$$fielddata-circuit-breaker-limit$$$ -`indices.breaker.fielddata.limit` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`indices.breaker.fielddata.limit` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Limit for fielddata breaker. Defaults to 40% of JVM heap. $$$fielddata-circuit-breaker-overhead$$$ -`indices.breaker.fielddata.overhead` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`indices.breaker.fielddata.overhead` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A constant that all field data estimations are multiplied with to determine a final estimation. Defaults to `1.03`. @@ -51,12 +51,12 @@ The request circuit breaker allows Elasticsearch to prevent per-request data str $$$request-breaker-limit$$$ -`indices.breaker.request.limit` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`indices.breaker.request.limit` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Limit for request breaker, defaults to 60% of JVM heap. $$$request-breaker-overhead$$$ -`indices.breaker.request.overhead` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`indices.breaker.request.overhead` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A constant that all request estimations are multiplied with to determine a final estimation. Defaults to `1`. @@ -89,7 +89,7 @@ Poorly written regular expressions can degrade cluster stability and performance $$$script-painless-regex-enabled$$$ -`script.painless.regex.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`script.painless.regex.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Enables regex in Painless scripts. Accepts: `limited` (Default) diff --git a/docs/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md b/docs/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md index 977724c565b59..99c74852196e1 100644 --- a/docs/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md @@ -165,12 +165,12 @@ You can use the following settings to control disk-based allocation: $$$cluster-routing-disk-threshold$$$ -`cluster.routing.allocation.disk.threshold_enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`cluster.routing.allocation.disk.threshold_enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Defaults to `true`. Set to `false` to disable the disk allocation decider. Upon disabling, it will also remove any existing `index.blocks.read_only_allow_delete` index blocks. $$$cluster-routing-watermark-low$$$ -`cluster.routing.allocation.disk.watermark.low` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`cluster.routing.allocation.disk.watermark.low` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Controls the low watermark for disk usage. It defaults to `85%`, meaning that {{es}} will not allocate shards to nodes that have more than 85% disk used. It can alternatively be set to a ratio value, e.g., `0.85`. It can also be set to an absolute byte value (like `500mb`) to prevent {{es}} from allocating shards if less than the specified amount of space is available. This setting has no effect on the primary shards of newly-created indices but will prevent their replicas from being allocated. `cluster.routing.allocation.disk.watermark.low.max_headroom` @@ -178,7 +178,7 @@ $$$cluster-routing-watermark-low$$$ $$$cluster-routing-watermark-high$$$ -`cluster.routing.allocation.disk.watermark.high` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`cluster.routing.allocation.disk.watermark.high` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Controls the high watermark. It defaults to `90%`, meaning that {{es}} will attempt to relocate shards away from a node whose disk usage is above 90%. It can alternatively be set to a ratio value, e.g., `0.9`. It can also be set to an absolute byte value (similarly to the low watermark) to relocate shards away from a node if it has less than the specified amount of free space. This setting affects the allocation of all shards, whether previously allocated or not. `cluster.routing.allocation.disk.watermark.high.max_headroom` @@ -189,7 +189,7 @@ $$$cluster-routing-watermark-high$$$ $$$cluster-routing-flood-stage$$$ -`cluster.routing.allocation.disk.watermark.flood_stage` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`cluster.routing.allocation.disk.watermark.flood_stage` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Controls the flood stage watermark, which defaults to 95%. {{es}} enforces a read-only index block ([`index.blocks.read_only_allow_delete`](/reference/elasticsearch/index-settings/index-block.md)) on every index that has one or more shards allocated on the node, and that has at least one disk exceeding the flood stage. This setting is a last resort to prevent nodes from running out of disk space. The index block is automatically released when the disk utilization falls below the high watermark. Similarly to the low and high watermark values, it can alternatively be set to a ratio value, e.g., `0.95`, or an absolute byte value. @@ -203,10 +203,10 @@ You can’t mix the usage of percentage/ratio values and byte values across the $$$cluster-routing-flood-stage-frozen$$$ -`cluster.routing.allocation.disk.watermark.flood_stage.frozen` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`cluster.routing.allocation.disk.watermark.flood_stage.frozen` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Controls the flood stage watermark for dedicated frozen nodes, which defaults to 95%. -`cluster.routing.allocation.disk.watermark.flood_stage.frozen.max_headroom` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`cluster.routing.allocation.disk.watermark.flood_stage.frozen.max_headroom` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Controls the max headroom for the flood stage watermark (in case of a percentage/ratio value) for dedicated frozen nodes. Defaults to 20GB when `cluster.routing.allocation.disk.watermark.flood_stage.frozen` is not explicitly set. This caps the amount of free space required on dedicated frozen nodes. `cluster.info.update.interval` diff --git a/docs/reference/elasticsearch/configuration-reference/enrich-settings.md b/docs/reference/elasticsearch/configuration-reference/enrich-settings.md index e898bb4110204..0f5b56727b2d1 100644 --- a/docs/reference/elasticsearch/configuration-reference/enrich-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/enrich-settings.md @@ -2,14 +2,14 @@ You can configure these enrich settings in the `elasticsearch.yml` file. For more information, see [Set up an enrich processor](docs-content:///manage-data/ingest/transform-enrich/set-up-an-enrich-processor.md). -`enrich.cache_size` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`enrich.cache_size` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Maximum number of searches to cache for enriching documents. Defaults to 1000. There is a single cache for all enrich processors in the cluster. This setting determines the size of that cache. -`enrich.coordinator_proxy.max_concurrent_requests` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`enrich.coordinator_proxy.max_concurrent_requests` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Maximum number of concurrent multi-search requests to run when enriching documents. Defaults to 8. -`enrich.coordinator_proxy.max_lookups_per_request` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`enrich.coordinator_proxy.max_lookups_per_request` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Maximum number of searches to include in a multi-search request when enriching documents. Defaults to 128. -`enrich.coordinator_proxy.queue_capacity` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`enrich.coordinator_proxy.queue_capacity` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : coordinator queue capacity, defaults to max_concurrent_requests * max_lookups_per_request \ No newline at end of file diff --git a/docs/reference/elasticsearch/configuration-reference/index-management-settings.md b/docs/reference/elasticsearch/configuration-reference/index-management-settings.md index e2406e685862f..9a17eb0f2c97a 100644 --- a/docs/reference/elasticsearch/configuration-reference/index-management-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/index-management-settings.md @@ -9,17 +9,17 @@ You can use the following cluster settings to enable or disable index management $$$auto-create-index$$$ -`action.auto_create_index` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`action.auto_create_index` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) [Automatically create an index](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-create) if it doesn’t already exist and apply any configured index templates. Defaults to `true`. $$$action-destructive-requires-name$$$ -`action.destructive_requires_name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`action.destructive_requires_name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) When set to `true`, you must specify the index name to [delete an index](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-delete). It is not possible to delete all indices with `_all` or use wildcards. Defaults to `true`. $$$cluster-indices-close-enable$$$ -`cluster.indices.close.enable` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`cluster.indices.close.enable` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Enables [closing of open indices](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-close) in {{es}}. If `false`, you cannot close open indices. Defaults to `true` for versions 7.2.0 and later, and to `false` for previous versions. In versions 7.1 and below, closed indices represent a data loss risk: if you close an index, it is not included in snapshots and you will not be able to restore the data. Similarly, closed indices are not included when you make cluster configuration changes, such as scaling to a different capacity, failover, and many other operations. Lastly, closed indices can lead to inaccurate disk space counts. ::::{warning} @@ -65,10 +65,10 @@ This setting also affects the following built-in component templates: The following settings for Elastic Universal Profiling are supported: -`xpack.profiling.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.profiling.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : *Version 8.7.0+*: Specifies whether the Universal Profiling Elasticsearch plugin is enabled. Defaults to *true*. -`xpack.profiling.templates.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.profiling.templates.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : *Version 8.9.0+*: Specifies whether Universal Profiling related index templates should be created on startup. Defaults to *false*. @@ -76,54 +76,54 @@ The following settings for Elastic Universal Profiling are supported: $$$reindex-remote-whitelist$$$ -`reindex.remote.whitelist` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.remote.whitelist` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the hosts that can be [reindexed from remotely](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex). Expects a YAML array of `host:port` strings. Consists of a comma-delimited list of `host:port` entries. Defaults to `["\*.io:*", "\*.com:*"]`. -`reindex.ssl.certificate` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.certificate` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Specifies the path to the PEM encoded certificate (or certificate chain) to be used for HTTP client authentication (if required by the remote cluster) This setting requires that `reindex.ssl.key` also be set. You cannot specify both `reindex.ssl.certificate` and `reindex.ssl.keystore.path`. -`reindex.ssl.certificate_authorities` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.certificate_authorities` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : List of paths to PEM encoded certificate files that should be trusted. You cannot specify both `reindex.ssl.certificate_authorities` and `reindex.ssl.truststore.path`. -`reindex.ssl.key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Specifies the path to the PEM encoded private key associated with the certificate used for client authentication (`reindex.ssl.certificate`). You cannot specify both `reindex.ssl.key` and `reindex.ssl.keystore.path`. -`reindex.ssl.key_passphrase` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.key_passphrase` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Specifies the passphrase to decrypt the PEM encoded private key (`reindex.ssl.key`) if it is encrypted. [7.17.0] Prefer `reindex.ssl.secure_key_passphrase` instead. Cannot be used with `reindex.ssl.secure_key_passphrase`. -`reindex.ssl.keystore.key_password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.keystore.key_password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : The password for the key in the keystore (`reindex.ssl.keystore.path`). Defaults to the keystore password. [7.17.0] Prefer `reindex.ssl.keystore.secure_key_password` instead. This setting cannot be used with `reindex.ssl.keystore.secure_key_password`. -`reindex.ssl.keystore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.keystore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : The password to the keystore (`reindex.ssl.keystore.path`). [7.17.0] Prefer `reindex.ssl.keystore.secure_password` instead. This setting cannot be used with `reindex.ssl.keystore.secure_password`. -`reindex.ssl.keystore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.keystore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Specifies the path to the keystore that contains a private key and certificate to be used for HTTP client authentication (if required by the remote cluster). This keystore can be in "JKS" or "PKCS#12" format. You cannot specify both `reindex.ssl.key` and `reindex.ssl.keystore.path`. -`reindex.ssl.keystore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.keystore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : The type of the keystore (`reindex.ssl.keystore.path`). Must be either `jks` or `PKCS12`. If the keystore path ends in ".p12", ".pfx" or "pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`. -`reindex.ssl.secure_key_passphrase` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.secure_key_passphrase` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Specifies the passphrase to decrypt the PEM encoded private key (`reindex.ssl.key`) if it is encrypted. Cannot be used with `reindex.ssl.key_passphrase`. -`reindex.ssl.keystore.secure_key_password` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.keystore.secure_key_password` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : The password for the key in the keystore (`reindex.ssl.keystore.path`). Defaults to the keystore password. This setting cannot be used with `reindex.ssl.keystore.key_password`. -`reindex.ssl.keystore.secure_password` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.keystore.secure_password` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : The password to the keystore (`reindex.ssl.keystore.path`). This setting cannot be used with `reindex.ssl.keystore.password`. -`reindex.ssl.truststore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.truststore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : The password to the truststore (`reindex.ssl.truststore.path`). [7.17.0] Prefer `reindex.ssl.truststore.secure_password` instead. This setting cannot be used with `reindex.ssl.truststore.secure_password`. -`reindex.ssl.truststore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.truststore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : The path to the Java Keystore file that contains the certificates to trust. This keystore can be in "JKS" or "PKCS#12" format. You cannot specify both `reindex.ssl.certificate_authorities` and `reindex.ssl.truststore.path`. -`reindex.ssl.truststore.secure_password` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.truststore.secure_password` ([Secure](docs-content://deploy-manage/security/secure-settings.md)) ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : The password to the truststore (`reindex.ssl.truststore.path`). This setting cannot be used with `reindex.ssl.truststore.password`. -`reindex.ssl.truststore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.truststore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : The type of the truststore (`reindex.ssl.truststore.path`). Must be either `jks` or `PKCS12`. If the truststore path ends in ".p12", ".pfx" or "pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`. -`reindex.ssl.verification_mode` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`reindex.ssl.verification_mode` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Indicates the type of verification to protect against man in the middle attacks and certificate forgery. One of `full` (verify the hostname and the certificate path), `certificate` (verify the certificate path, but not the hostname) or `none` (perform no verification - this is strongly discouraged in production environments). Defaults to `full`. diff --git a/docs/reference/elasticsearch/configuration-reference/index.md b/docs/reference/elasticsearch/configuration-reference/index.md index edbc4154fba52..0a691cf04bc9a 100644 --- a/docs/reference/elasticsearch/configuration-reference/index.md +++ b/docs/reference/elasticsearch/configuration-reference/index.md @@ -13,7 +13,7 @@ Refer to [Elasticsearch configuration](docs-content://deploy-manage/deploy/cloud Configuration settings enable you to customize the behavior of Elasticsearch features. This reference provides details about each setting, such as its purpose, default behavior, and availability in Elastic Cloud environments. -For details on updating user settings, see [Edit Elastic Stack settings](docs-content://deploy-manage/deploy/elastic-cloud/edit-stack-settings.md) for {{ech}}, [Add Elasticsearch user settings](docs-content://deploy-manage/deploy/cloud-enterprise/edit-stack-settings-elasticsearch.md) for {{ece}} and [Differences from other Elasticsearch offerings](docs-content://deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md) for ({{serverless-short}}). +For details on updating user settings, see [Edit Elastic Stack settings](docs-content://deploy-manage/deploy/elastic-cloud/edit-stack-settings.md) for {{ech}}, [Add Elasticsearch user settings](docs-content://deploy-manage/deploy/cloud-enterprise/edit-stack-settings-elasticsearch.md) for {{ece}} and [Differences from other Elasticsearch offerings](docs-content://deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md) for {{serverless-short}}. The settings are grouped by feature or purpose, for example: diff --git a/docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md b/docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md index fdac65c8a68bd..339054dc7dd53 100644 --- a/docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md @@ -53,8 +53,8 @@ To control memory usage used by {{ml}} jobs, you can use the [machine learning c $$$xpack-interference-model-ttl$$$ -`xpack.ml.inference_model.time_to_live` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") -: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The time to live (TTL) for trained models in the inference model cache. The TTL is calculated from last access. Users of the cache (such as the inference processor or inference aggregator) cache a model on its first use and reset the TTL on every use. If a cached model is not accessed for the duration of the TTL, it is flagged for eviction from the cache. If a document is processed later, the model is again loaded into the cache. To update this setting in {{ess}}, see [Add {{es}} user settings](/reference/elasticsearch/configuration-reference/elasticsearch-settings.md). Defaults to `5m`. +`xpack.ml.inference_model.time_to_live` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") +: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The time to live (TTL) for trained models in the inference model cache. The TTL is calculated from last access. Users of the cache (such as the inference processor or inference aggregator) cache a model on its first use and reset the TTL on every use. If a cached model is not accessed for the duration of the TTL, it is flagged for eviction from the cache. If a document is processed later, the model is again loaded into the cache. To update this setting in {{ess}}, see [Add {{es}} user settings](/reference/elasticsearch/configuration-reference/index.md). Defaults to `5m`. `xpack.ml.max_inference_processors` : ([Dynamic](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings)) The total number of `inference` type processors allowed across all ingest pipelines. Once the limit is reached, adding an `inference` processor to a pipeline is disallowed. Defaults to `50`. diff --git a/docs/reference/elasticsearch/configuration-reference/monitoring-settings.md b/docs/reference/elasticsearch/configuration-reference/monitoring-settings.md index 6ba828d705733..011ca441f7f0a 100644 --- a/docs/reference/elasticsearch/configuration-reference/monitoring-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/monitoring-settings.md @@ -39,7 +39,7 @@ The `xpack.monitoring.collection` settings control how data is collected from yo $$$xpack-monitoring-collection-interval$$$ -`xpack.monitoring.collection.interval` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.monitoring.collection.interval` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : [6.3.0] ([Dynamic](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings)) Setting to `-1` to disable data collection is no longer supported beginning with 7.0.0. Controls how often data samples are collected. Defaults to `10s`. If you modify the collection interval, set the `xpack.monitoring.min_interval_seconds` option in `kibana.yml` to the same value. @@ -66,14 +66,14 @@ $$$xpack-monitoring-collection-interval$$$ `xpack.monitoring.collection.index.recovery.timeout` : ([Dynamic](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings)) [7.16.0] Timeout for collecting the recovery information, in [time units](/reference/elasticsearch/rest-apis/api-conventions.md#time-units). Defaults to `10s`. -`xpack.monitoring.collection.min_interval_seconds` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.monitoring.collection.min_interval_seconds` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Specifies the minimum number of seconds that a time bucket in a chart can represent. If you modify the `xpack.monitoring.collection.interval`, use the same value in this setting. Defaults to `10` (10 seconds). $$$xpack-monitoring-history-duration$$$ -`xpack.monitoring.history.duration` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.monitoring.history.duration` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings)) [7.16.0] Retention duration beyond which the indices created by a monitoring exporter are automatically deleted, in [time units](/reference/elasticsearch/rest-apis/api-conventions.md#time-units). Defaults to `7d` (7 days). This setting has a minimum value of `1d` (1 day) to ensure that something is being monitored and it cannot be disabled. diff --git a/docs/reference/elasticsearch/configuration-reference/networking-settings.md b/docs/reference/elasticsearch/configuration-reference/networking-settings.md index c7bdc9ddf3c31..b9b4c44d0781b 100644 --- a/docs/reference/elasticsearch/configuration-reference/networking-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/networking-settings.md @@ -198,7 +198,7 @@ Use the following advanced settings to configure the HTTP interface independentl $$$http-compression$$$ -`http.compression` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.compression` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting), boolean) Support for compression when possible (with Accept-Encoding). If HTTPS is enabled, defaults to `false`. Otherwise, defaults to `true`. Disabling compression for HTTPS mitigates potential security risks, such as a [BREACH attack](https://en.wikipedia.org/wiki/BREACH). To compress HTTPS traffic, you must explicitly set `http.compression` to `true`. @@ -209,7 +209,7 @@ $$$http-compression$$$ $$$http-cors-enabled$$$ -`http.cors.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.cors.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting), boolean) Enable or disable cross-origin resource sharing, which determines whether a browser on another origin can execute requests against {{es}}. Set to `true` to enable {{es}} to process pre-flight [CORS](https://en.wikipedia.org/wiki/Cross-origin_resource_sharing) requests. {{es}} will respond to those requests with the `Access-Control-Allow-Origin` header if the `Origin` sent in the request is permitted by the `http.cors.allow-origin` list. Set to `false` (the default) to make {{es}} ignore the `Origin` request header, effectively disabling CORS requests because {{es}} will never respond with the `Access-Control-Allow-Origin` response header. ::::{note} @@ -219,7 +219,7 @@ $$$http-cors-enabled$$$ $$$http-cors-allow-origin$$$ -`http.cors.allow-origin` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.cors.allow-origin` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting), string) Which origins to allow. If you prepend and append a forward slash (`/`) to the value, this will be treated as a regular expression, allowing you to support HTTP and HTTPs. For example, using `/https?:\/\/localhost(:[0-9]+)?/` would return the request header appropriately in both cases. Defaults to no origins allowed. ::::{important} @@ -229,27 +229,27 @@ $$$http-cors-allow-origin$$$ $$$http-cors-max-age$$$ -`http.cors.max-age` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.cors.max-age` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting), integer) Browsers send a "preflight" OPTIONS-request to determine CORS settings. `max-age` defines for how long, in seconds, the result should be cached. Defaults to `1728000` (20 days). $$$http-cors-allow-methods$$$ -`http.cors.allow-methods` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.cors.allow-methods` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting), string) Which methods to allow. Defaults to `OPTIONS, HEAD, GET, POST, PUT, DELETE`. $$$http-cors-allow-headers$$$ -`http.cors.allow-headers` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.cors.allow-headers` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting), string) Which headers to allow. Defaults to `X-Requested-With, Content-Type, Content-Length, Authorization, Accept, User-Agent, X-Elastic-Client-Meta`. $$$http-cors-expose-headers$$$ -`http.cors.expose-headers` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.cors.expose-headers` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Which response headers to expose in the client. Defaults to `X-elastic-product`. $$$http-cors-allow-credentials$$$ -`http.cors.allow-credentials` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.cors.allow-credentials` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting), boolean) Whether the `Access-Control-Allow-Credentials` header should be returned. Defaults to `false`. ::::{note} @@ -337,7 +337,7 @@ Use the following advanced settings to configure the transport interface indepen $$$transport-settings-compress$$$ -`transport.compress` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`transport.compress` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting), string) Determines which transport requests are compressed before sending them to another node. {{es}} will compress transport responses if and only if the corresponding request was compressed. See also `transport.compression_scheme`, which specifies the compression scheme which is used. Accepts the following values: `false` @@ -352,7 +352,7 @@ $$$transport-settings-compress$$$ $$$transport-settings-compression-scheme$$$ -`transport.compression_scheme` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`transport.compression_scheme` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting), string) Configures the compression scheme for requests which are selected for compression by to the `transport.compress` setting. Accepts either `deflate` or `lz4`, which offer different trade-offs between compression ratio and CPU usage. {{es}} will use the same compression scheme for responses as for the corresponding requests. Defaults to `lz4`. `transport.tcp.keep_alive` diff --git a/docs/reference/elasticsearch/configuration-reference/security-settings.md b/docs/reference/elasticsearch/configuration-reference/security-settings.md index 9b356abf854a6..ec6159c6fe1c1 100644 --- a/docs/reference/elasticsearch/configuration-reference/security-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/security-settings.md @@ -52,13 +52,13 @@ All of these settings can be added to the `elasticsearch.yml` configuration file You can configure the following anonymous access settings in `elasticsearch.yml`. For more information, see [Enabling anonymous access](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/anonymous-access.md). -`xpack.security.authc.anonymous.username` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.authc.anonymous.username` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The username (principal) of the anonymous user. Defaults to `_es_anonymous_user`. -`xpack.security.authc.anonymous.roles` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.authc.anonymous.roles` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The roles to associate with the anonymous user. Required. -`xpack.security.authc.anonymous.authz_exception` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.authc.anonymous.authz_exception` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) When `true`, an HTTP 403 response is returned if the anonymous user does not have the appropriate permissions for the requested action. The user is not prompted to provide credentials to access the requested resource. When set to `false`, an HTTP 401 response is returned and the user can provide credentials with the appropriate permissions to gain access. Defaults to `true`. @@ -144,16 +144,16 @@ Large real-time clock inconsistency across cluster nodes can cause problems with `xpack.security.authc.api_key.hashing.algorithm` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the hashing algorithm that is used for securing API key credentials. See [Table 3, Secure token hashing algorithms](#secure-token-hashing-algorithms). Defaults to `ssha256`. -`xpack.security.authc.realms.saml.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.authc.realms.saml.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : To learn more on how to enable SAML and related user settings, check [secure your clusters with SAML](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/saml.md). -`xpack.security.authc.realms.oidc.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.authc.realms.oidc.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : To learn more on how to enable OpenID Connect and related user settings, check [secure your clusters with OpenID Connect](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md). -`xpack.security.authc.realms.kerberos.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.authc.realms.kerberos.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : To learn more on how to enable Kerberos and relate user settings, check [secure your clusters with Kerberos](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kerberos.md). -`xpack.security.authc.realms.jwt.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.authc.realms.jwt.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : To learn more on how to enable JWT and related user settings, check [secure your clusters with JWT](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/jwt.md). ::::{note} @@ -773,10 +773,10 @@ If `truststore.path` is set, this setting is required. In addition to the [settings that are valid for all realms](#ref-realm-settings), you can specify the following settings. -`idp.entity_id` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`idp.entity_id` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Entity ID of the SAML Identity Provider. An Entity ID is a URI with a maximum length of 1024 characters. It can be a URL ([https://idp.example.com/](https://idp.example.com/)) or a URN (`urn:example.com:idp`) and can be found in the configuration or the SAML metadata of the Identity Provider. -`idp.metadata.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`idp.metadata.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path *(recommended)* or URL to a SAML 2.0 metadata file describing the capabilities and configuration of the Identity Provider. If a path is provided, then it is resolved relative to the {{es}} config directory. If a URL is provided, then it must be either a `file` URL or a `https` URL. {{es}} automatically polls this metadata resource and reloads the IdP configuration when changes are detected. File based resources are polled at a frequency determined by the global {{es}} `resource.reload.interval.high` setting, which defaults to 5 seconds. HTTPS resources are polled at a frequency determined by the realm’s `idp.metadata.http.refresh` and `idp.metadata.http.minimum_refresh` settings. @@ -787,7 +787,7 @@ In addition to the [settings that are valid for all realms](#ref-realm-settings) `idp.metadata.http.fail_on_error` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) If set to `true`, the realm will fail on startup (and prevent the node from starting) if it attempts to load metadata over HTTPS and that metadata is not available. If set to `false` (the default), the node will start but the affected SAML realm will not support user authentication until the metadata can be successfully loaded. This setting is ignored if metadata is loaded from a file. -`idp.metadata.http.refresh` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`idp.metadata.http.refresh` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the frequency with which `https` metadata is checked for changes. Defaults to `1h` (1 hour). Under some circumstances {{es}} may determine that the metadata needs to be checked more frequently. This may occur if previous attempts to load the metadata encountered an error, or if the metadata indicates that it is due to expire in less than the configured refresh interval. In these cases {{es}} will poll more often, but never more frequently than `idp.metadata.http.minimum_refresh`. If there is an attempt to authenticate against a realm that has not yet loaded metadata successfully, that realm may attempt to load metadata outside of the configured polling frequency. @@ -796,73 +796,73 @@ In addition to the [settings that are valid for all realms](#ref-realm-settings) `idp.metadata.http.minimum_refresh` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the minimum frequency with which `https` metadata is checked for changes. In regular operation {{es}} will use the value of `idp.metadata.http.refresh` as the polling interval. However, under some circumstances {{es}} may determine that it needs to poll more frequently. In these cases, the `minimum_refresh` will set the minimum frequency at which the metdata will be checked. Defaults to `5m` (5 minutes) and must not be set to a value greater than `idp.metadata.http.refresh` -`idp.use_single_logout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`idp.use_single_logout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Indicates whether to utilise the Identity Provider’s Single Logout service (if one exists in the IdP metadata file). Defaults to `true`. -`sp.entity_id` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`sp.entity_id` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Entity ID to use for this SAML Service Provider. This should be entered as a URI. We recommend that you use the base URL of your Kibana instance. For example, `https://kibana.example.com/`. -`sp.acs` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`sp.acs` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The URL of the Assertion Consumer Service within {{kib}}. Typically this is the "api/security/saml/callback" endpoint of your Kibana server. For example, `https://kibana.example.com/api/security/saml/callback`. -`sp.logout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`sp.logout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The URL of the Single Logout service within {{kib}}. Typically this is the "logout" endpoint of your Kibana server. For example, `https://kibana.example.com/logout`. -`attributes.principal` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`attributes.principal` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Name of the SAML attribute that contains the user’s principal (username). -`attributes.groups` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`attributes.groups` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Name of the SAML attribute that contains the user’s groups. -`attributes.name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`attributes.name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Name of the SAML attribute that contains the user’s full name. -`attributes.mail` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`attributes.mail` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Name of the SAML attribute that contains the user’s email address. -`attributes.dn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`attributes.dn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Name of the SAML attribute that contains the user’s X.50 *Distinguished Name*. -`attribute_patterns.principal` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`attribute_patterns.principal` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A Java regular expression that is matched against the SAML attribute specified by `attributes.principal` before it is applied to the user’s *principal* property. The attribute value must match the pattern and the value of the first *capturing group* is used as the principal. For example, `^([^@]+)@example\\.com$` matches email addresses from the "example.com" domain and uses the local-part as the principal. -`attribute_patterns.groups` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`attribute_patterns.groups` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `attribute_patterns.principal`, but for the *group* property. -`attribute_patterns.name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`attribute_patterns.name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `attribute_patterns.principal`, but for the *name* property. -`attribute_patterns.mail` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`attribute_patterns.mail` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `attribute_patterns.principal`, but for the *mail* property. -`attribute_patterns.dn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`attribute_patterns.dn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `attribute_patterns.principal`, but for the *dn* property. -`attribute_delimiters.groups` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`attribute_delimiters.groups` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A plain string that is used as a delimiter to split a single-valued SAML attribute specified by `attributes.groups` before it is applied to the user’s *groups* property. For example, splitting the SAML attribute value `engineering,elasticsearch-admins,employees` on a delimiter value of `,` will result in `engineering`, `elasticsearch-admins`, and `employees` as the list of groups for the user. The delimiter will always be split on, regardless of escaping in the input string. This setting does not support multi-valued SAML attributes. It cannot be used together with the `attribute_patterns` setting. You can only configure this setting for the groups attribute. -`nameid_format` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`nameid_format` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The NameID format that should be requested when asking the IdP to authenticate the current user. The default is to not include the `nameid_format` attribute. -`nameid.allow_create` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`nameid.allow_create` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The value of the `AllowCreate` attribute of the `NameIdPolicy` element in an authentication request. The default value is false. -`nameid.sp_qualifier` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`nameid.sp_qualifier` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The value of the `SPNameQualifier` attribute of the `NameIdPolicy` element in an authentication request. The default is to not include the `SPNameQualifier` attribute. -`force_authn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`force_authn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies whether to set the `ForceAuthn` attribute when requesting that the IdP authenticate the current user. If set to `true`, the IdP is required to verify the user’s identity, irrespective of any existing sessions they might have. Defaults to `false`. -`populate_user_metadata` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`populate_user_metadata` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies whether to populate the {{es}} user’s metadata with the values that are provided by the SAML attributes. Defaults to `true`. `authorization_realms` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The names of the realms that should be consulted for delegated authorization. If this setting is used, then the SAML realm does not perform role mapping and instead loads the user from the listed realms. See [Delegating authorization to another realm](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/realm-chains.md#authorization_realms). -`allowed_clock_skew` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`allowed_clock_skew` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The maximum amount of skew that can be tolerated between the IdP’s clock and the {{es}} node’s clock. Defaults to `3m` (3 minutes). -`req_authn_context_class_ref` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`req_authn_context_class_ref` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A comma separated list of Authentication Context Class Reference values to be included in the Requested Authentication Context when requesting the IdP to authenticate the current user. The Authentication Context of the corresponding authentication response should contain at least one of the requested values. For more information, see [Requesting specific authentication methods](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/saml.md#req-authn-context). @@ -873,31 +873,31 @@ In addition to the [settings that are valid for all realms](#ref-realm-settings) If a signing key is configured (that is, either `signing.key` or `signing.keystore.path` is set), then {{es}} signs outgoing SAML messages. Signing can be configured using the following settings: -`signing.saml_messages` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`signing.saml_messages` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A list of SAML message types that should be signed or `*` to sign all messages. Each element in the list should be the local name of a SAML XML Element. Supported element types are `AuthnRequest`, `LogoutRequest` and `LogoutResponse`. Only valid if `signing.key` or `signing.keystore.path` is also specified. Defaults to `*`. -`signing.key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`signing.key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path to the PEM encoded private key to use for SAML message signing. `signing.key` and `signing.keystore.path` cannot be used at the same time. -`signing.secure_key_passphrase` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`signing.secure_key_passphrase` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Secure](docs-content://deploy-manage/security/secure-settings.md)) Specifies the passphrase to decrypt the PEM encoded private key (`signing.key`) if it is encrypted. -`signing.certificate` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`signing.certificate` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path to the PEM encoded certificate (or certificate chain) that corresponds to the `signing.key`. This certificate must also be included in the Service Provider metadata or manually configured within the IdP to allow for signature validation. This setting can only be used if `signing.key` is set. -`signing.keystore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`signing.keystore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path to the keystore that contains a private key and certificate. It must be either a Java keystore (jks) or a PKCS#12 file. You cannot use this setting and `signing.key` at the same time. -`signing.keystore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`signing.keystore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The type of the keystore in `signing.keystore.path`. Must be either `jks` or `PKCS12`. If the keystore path ends in ".p12", ".pfx", or "pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`. -`signing.keystore.alias` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`signing.keystore.alias` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the alias of the key within the keystore that should be used for SAML message signing. If the keystore contains more than one private key, this setting must be specified. -`signing.keystore.secure_password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`signing.keystore.secure_password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Secure](docs-content://deploy-manage/security/secure-settings.md)) The password to the keystore in `signing.keystore.path`. -`signing.keystore.secure_key_password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`signing.keystore.secure_key_password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Secure](docs-content://deploy-manage/security/secure-settings.md)) The password for the key in the keystore (`signing.keystore.path`). Defaults to the keystore password. @@ -905,22 +905,22 @@ If a signing key is configured (that is, either `signing.key` or `signing.keysto If an encryption key is configured (that is, either `encryption.key` or `encryption.keystore.path` is set), then {{es}} publishes an encryption certificate when generating metadata and attempts to decrypt incoming SAML content. Encryption can be configured using the following settings: -`encryption.key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`encryption.key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path to the PEM encoded private key to use for SAML message decryption. `encryption.key` and `encryption.keystore.path` cannot be used at the same time. `encryption.secure_key_passphrase` : ([Secure](docs-content://deploy-manage/security/secure-settings.md)) Specifies the passphrase to decrypt the PEM encoded private key (`encryption.key`) if it is encrypted. -`encryption.certificate` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`encryption.certificate` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path to the PEM encoded certificate (or certificate chain) that is associated with the `encryption.key`. This certificate must also be included in the Service Provider metadata or manually configured within the IdP to enable message encryption. This setting can be used only if `encryption.key` is set. -`encryption.keystore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`encryption.keystore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path to the keystore that contains a private key and certificate. It must be either a Java keystore (jks) or a PKCS#12 file. You cannot use this setting and `encryption.key` at the same time. -`encryption.keystore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`encryption.keystore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The type of the keystore (`encryption.keystore.path`). Must be either `jks` or `PKCS12`. If the keystore path ends in ".p12", ".pfx", or "pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`. -`encryption.keystore.alias` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`encryption.keystore.alias` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the alias of the key within the keystore (`encryption.keystore.path`) that should be used for SAML message decryption. If not specified, all compatible key pairs from the keystore are considered as candidate keys for decryption. `encryption.keystore.secure_password` @@ -939,13 +939,13 @@ These settings are not used for any purpose other than loading metadata over htt :::: -`ssl.key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Path to a PEM encoded file containing the private key. If HTTP client authentication is required, it uses this file. You cannot use this setting and `ssl.keystore.path` at the same time. -`ssl.key_passphrase` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.key_passphrase` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The passphrase that is used to decrypt the private key. Since the key might not be encrypted, this value is optional. [7.17.0] Prefer `ssl.secure_key_passphrase` instead. You cannot use this setting and `ssl.secure_key_passphrase` at the same time. @@ -957,28 +957,28 @@ These settings are not used for any purpose other than loading metadata over htt You cannot use this setting and `ssl.key_passphrase` at the same time. -`ssl.certificate` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.certificate` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path for the PEM encoded certificate (or certificate chain) that is associated with the key. This setting can be used only if `ssl.key` is set. -`ssl.certificate_authorities` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.certificate_authorities` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) List of paths to PEM encoded certificate files that should be trusted. This setting and `ssl.truststore.path` cannot be used at the same time. -`ssl.keystore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.keystore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path for the keystore file that contains a private key and certificate. It must be either a Java keystore (jks) or a PKCS#12 file. You cannot use this setting and `ssl.key` at the same time. -`ssl.keystore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.keystore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The format of the keystore file. It must be either `jks` or `PKCS12`. If the keystore path ends in ".p12", ".pfx", or ".pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`. -`ssl.keystore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.keystore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The password for the keystore. [7.17.0] Prefer `ssl.keystore.secure_password` instead. `ssl.keystore.secure_password` @@ -1000,16 +1000,16 @@ These settings are not used for any purpose other than loading metadata over htt You cannot use this setting and `ssl.keystore.key_password` at the same time. -`ssl.truststore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.truststore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path for the keystore that contains the certificates to trust. It must be either a Java keystore (jks) or a PKCS#12 file. You cannot use this setting and `ssl.certificate_authorities` at the same time. -`ssl.truststore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.truststore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The format of the truststore file. It must be either `jks` or `PKCS12`. If the file name ends in ".p12", ".pfx" or "pkcs12", the default is `PKCS12`. Otherwise, it defaults to `jks`. -`ssl.truststore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.truststore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The password for the truststore. [7.17.0] Prefer `ssl.truststore.secure_password` instead. You cannot use this setting and `ssl.truststore.secure_password` at the same time. @@ -1021,7 +1021,7 @@ You cannot use this setting and `ssl.keystore.key_password` at the same time. This setting cannot be used with `ssl.truststore.password`. -`ssl.verification_mode` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.verification_mode` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the verification of certificates. ::::{dropdown} Valid values @@ -1045,7 +1045,7 @@ You cannot use this setting and `ssl.keystore.key_password` at the same time. Defaults to `full`. -`ssl.supported_protocols` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.supported_protocols` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported protocols with versions. Valid protocols: `SSLv2Hello`, `SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`, `TLSv1.3`. If the JVM’s SSL provider supports TLSv1.3, the default is `TLSv1.3,TLSv1.2,TLSv1.1`. Otherwise, the default is `TLSv1.2,TLSv1.1`. {{es}} relies on your JDK’s implementation of SSL and TLS. View [Supported SSL/TLS versions by JDK version](docs-content://deploy-manage/security/supported-ssltls-versions-by-jdk-version.md) for more information. @@ -1055,7 +1055,7 @@ You cannot use this setting and `ssl.keystore.key_password` at the same time. :::: -`ssl.cipher_suites` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.cipher_suites` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported cipher suites vary depending on which version of Java you use. For example, for version 12 the default value is `TLS_AES_256_GCM_SHA384`, `TLS_AES_128_GCM_SHA256`, `TLS_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`, `TLS_RSA_WITH_AES_256_GCM_SHA384`, `TLS_RSA_WITH_AES_128_GCM_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_128_CBC_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA`, `TLS_RSA_WITH_AES_128_CBC_SHA`. For more information, see Oracle’s [Java Cryptography Architecture documentation](https://docs.oracle.com/en/java/javase/11/security/oracle-providers.md#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2). @@ -1066,22 +1066,22 @@ You cannot use this setting and `ssl.keystore.key_password` at the same time. In addition to the [settings that are valid for all realms](#ref-realm-settings), you can specify the following settings: -`keytab.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`keytab.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path to the Kerberos keytab file that contains the service principal used by this {{es}} node. This must be a location within the {{es}} configuration directory and the file must have read permissions. Required. -`remove_realm_name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`remove_realm_name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Set to `true` to remove the realm part of principal names. Principal names in Kerberos have the form `user/instance@REALM`. If this option is `true`, the realm part (`@REALM`) will not be included in the username. Defaults to `false`. `krb.debug` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Set to `true` to enable debug logs for the Java login module that provides support for Kerberos authentication. Defaults to `false`. -`cache.ttl` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`cache.ttl` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The time-to-live for cached user entries. A user is cached for this period of time. Specify the time period using the standard {{es}} [time units](/reference/elasticsearch/rest-apis/api-conventions.md#time-units). Defaults to `20m`. -`cache.max_users` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`cache.max_users` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The maximum number of user entries that can live in the cache at any given time. Defaults to 100,000. -`authorization_realms` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`authorization_realms` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The names of the realms that should be consulted for delegated authorization. If this setting is used, then the Kerberos realm does not perform role mapping and instead loads the user from the listed realms. See [Delegating authorization to another realm](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/realm-chains.md#authorization_realms). @@ -1089,22 +1089,22 @@ In addition to the [settings that are valid for all realms](#ref-realm-settings) In addition to the [settings that are valid for all realms](#ref-realm-settings), you can specify the following settings. -`op.issuer` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`op.issuer` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A verifiable Identifier for your OpenID Connect Provider. An Issuer Identifier is usually a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components and no query or fragment components. The value for this setting should be provided by your OpenID Connect Provider. -`op.authorization_endpoint` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`op.authorization_endpoint` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The URL for the Authorization Endpoint at the OpenID Connect Provider. The value for this setting should be provided by your OpenID Connect Provider. -`op.token_endpoint` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`op.token_endpoint` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The URL for the Token Endpoint at the OpenID Connect Provider. The value for this setting should be provided by your OpenID Connect Provider. -`op.userinfo_endpoint` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`op.userinfo_endpoint` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The URL for the User Info Endpoint at the OpenID Connect Provider. The value for this setting should be provided by your OpenID Connect Provider. -`op.endsession_endpoint` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`op.endsession_endpoint` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The URL for the End Session Endpoint at the OpenID Connect Provider. The value for this setting should be provided by your OpenID Connect Provider. -`op.jwkset_path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`op.jwkset_path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The file name or URL to a JSON Web Key Set (JWKS) with the public key material used to verify tokens and claims responses signed by the OpenID Connect Provider. A value is considered a file name if it does not begin with `https` or `http`. The file name is resolved relative to the {{es}} configuration directory. Changes to the file are polled at a frequency determined by the global {{es}} `resource.reload.interval.high` setting, which defaults to 5 seconds. @@ -1114,67 +1114,67 @@ The file name or URL to a JSON Web Key Set (JWKS) with the public key material u `authorization_realms` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The names of the realms that should be consulted for delegated authorization. If this setting is used, then the OpenID Connect realm does not perform role mapping and instead loads the user from the listed realms. See [Delegating authorization to another realm](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/realm-chains.md#authorization_realms). -`rp.client_id` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`rp.client_id` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The OAuth 2.0 Client Identifier that was assigned to {{es}} during registration at the OpenID Connect Provider. `rp.client_secret` : ([Secure](docs-content://deploy-manage/security/secure-settings.md)) The OAuth 2.0 Client Secret that was assigned to {{es}} during registration at the OpenID Connect Provider. -`rp.client_auth_method` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`rp.client_auth_method` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The client authentication method used by {{es}} to authenticate to the OpenID Connect Provider. Can be `client_secret_basic`, `client_secret_post`, or `client_secret_jwt`. Defaults to `client_secret_basic`. -`rp.client_auth_jwt_signature_algorithm` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`rp.client_auth_jwt_signature_algorithm` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The signature algorithm that {{es}} uses to sign the JWT with which it authenticates as a client to the OpenID Connect Provider when `client_secret_jwt` is selected for `rp.client_auth_method`. Can be either `HS256`, `HS384`, or `HS512`. Defaults to `HS384`. -`rp.redirect_uri` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`rp.redirect_uri` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Redirect URI within {{kib}}. If you want to use the authorization code flow, this is the `api/security/oidc/callback` endpoint of your {{kib}} server. If you want to use the implicit flow, it is the `api/security/oidc/implicit` endpoint. For example, `https://kibana.example.com/api/security/oidc/callback`. -`rp.response_type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`rp.response_type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) OAuth 2.0 Response Type value that determines the authorization processing flow to be used. Can be `code` for authorization code grant flow, or one of `id_token`, `id_token token` for the implicit flow. -`rp.signature_algorithm` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`rp.signature_algorithm` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The signature algorithm that will be used by {{es}} in order to verify the signature of the id tokens it will receive from the OpenID Connect Provider. Allowed values are `HS256`, `HS384`, `HS512`, `ES256`, `ES384`, `ES512`, `RS256`, `RS384`, `RS512`, `PS256`, `PS384`, `PS512`. Defaults to `RS256`. -`rp.requested_scopes` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`rp.requested_scopes` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The scope values that will be requested by the OpenID Connect Provider as part of the Authentication Request. Optional, defaults to `openid` -`rp.post_logout_redirect_uri` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`rp.post_logout_redirect_uri` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Redirect URI (usually within {{kib}}) that the OpenID Connect Provider should redirect the browser to after a successful Single Logout. `claims.principal` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the OpenID Connect claim that contains the user’s principal (username). -`claims.groups` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claims.groups` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the OpenID Connect claim that contains the user’s groups. -`claims.name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claims.name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the OpenID Connect claim that contains the user’s full name. -`claims.mail` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claims.mail` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the OpenID Connect claim that contains the user’s email address. -`claims.dn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claims.dn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the OpenID Connect claim that contains the user’s X.509 *Distinguished Name*. -`claim_patterns.principal` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claim_patterns.principal` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A Java regular expression that is matched against the OpenID Connect claim specified by `claims.principal` before it is applied to the user’s *principal* property. The attribute value must match the pattern and the value of the first *capturing group* is used as the principal. For example, `^([^@]+)@example\\.com$` matches email addresses from the "example.com" domain and uses the local-part as the principal. -`claim_patterns.groups` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claim_patterns.groups` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `claim_patterns.principal`, but for the *group* property. -`claim_patterns.name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claim_patterns.name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `claim_patterns.principal`, but for the *name* property. -`claim_patterns.mail` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claim_patterns.mail` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `claim_patterns.principal`, but for the *mail* property. -`claim_patterns.dn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claim_patterns.dn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `claim_patterns.principal`, but for the *dn* property. -`allowed_clock_skew` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`allowed_clock_skew` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The maximum allowed clock skew to be taken into consideration when validating id tokens with regards to their creation and expiration times. Defaults to `60s`. -`populate_user_metadata` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`populate_user_metadata` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies whether to populate the {{es}} user’s metadata with the values that are provided by the OpenID Connect claims. Defaults to `true`. `http.proxy.host` @@ -1186,25 +1186,25 @@ The file name or URL to a JSON Web Key Set (JWKS) with the public key material u `http.proxy.port` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the port of the proxy server that will be used by the http client for all backchannel communication to the OpenID Connect Provider endpoints. Defaults to `80`. -`http.connect_timeout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.connect_timeout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the behavior of the http client used for back-channel communication to the OpenID Connect Provider endpoints. Specifies the timeout until a connection is established. A value of zero means the timeout is not used. Defaults to `5s`. -`http.connection_read_timeout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.connection_read_timeout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the behavior of the http client used for back-channel communication to the OpenID Connect Provider endpoints. Specifies the timeout used when requesting a connection from the connection manager. Defaults to `5s` -`http.socket_timeout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.socket_timeout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the behavior of the http client used for back-channel communication to the OpenID Connect Provider endpoints. Specifies the socket timeout (SO_TIMEOUT) in milliseconds, which is the timeout for waiting for data or, put differently, a maximum period inactivity between two consecutive data packets). Defaults to `5s`. -`http.max_connections` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.max_connections` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the behavior of the http client used for back-channel communication to the OpenID Connect Provider endpoints. Specifies the maximum number of connections allowed across all endpoints. Defaults to `200`. -`http.max_endpoint_connections` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.max_endpoint_connections` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the behavior of the http client used for back-channel communication to the OpenID Connect Provider endpoints. Specifies the maximum number of connections allowed per endpoint. Defaults to `200`. -`http.tcp.keep_alive` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.tcp.keep_alive` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Whether to enable TCP keepalives on HTTP connections used for back-channel communication to the OpenID Connect Provider endpoints. Defaults to `true`. -`http.connection_pool_ttl` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.connection_pool_ttl` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the behavior of the http client used for back-channel communication to the OpenID Connect Provider endpoints. Specifies the time-to-live of connections in the connection pool (default to 3 minutes). A connection is closed if it is idle for more than the specified timeout. The server can also set the `Keep-Alive` HTTP response header. The effective time-to-live value is the smaller value between this setting and the `Keep-Alive` response header. Configure this setting to `-1` to let the server dictate the value. If the header is not set by the server and the setting has value of `-1`, the time-to-live is infinite and connections never expire. @@ -1219,13 +1219,13 @@ These settings are *only* used for the back-channel communication between {{es}} :::: -`ssl.key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Path to a PEM encoded file containing the private key. If HTTP client authentication is required, it uses this file. You cannot use this setting and `ssl.keystore.path` at the same time. -`ssl.key_passphrase` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.key_passphrase` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The passphrase that is used to decrypt the private key. Since the key might not be encrypted, this value is optional. [7.17.0] Prefer `ssl.secure_key_passphrase` instead. You cannot use this setting and `ssl.secure_key_passphrase` at the same time. @@ -1237,28 +1237,28 @@ These settings are *only* used for the back-channel communication between {{es}} You cannot use this setting and `ssl.key_passphrase` at the same time. -`ssl.certificate` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.certificate` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path for the PEM encoded certificate (or certificate chain) that is associated with the key. This setting can be used only if `ssl.key` is set. -`ssl.certificate_authorities` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.certificate_authorities` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) List of paths to PEM encoded certificate files that should be trusted. This setting and `ssl.truststore.path` cannot be used at the same time. -`ssl.keystore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.keystore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path for the keystore file that contains a private key and certificate. It must be either a Java keystore (jks) or a PKCS#12 file. You cannot use this setting and `ssl.key` at the same time. -`ssl.keystore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.keystore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The format of the keystore file. It must be either `jks` or `PKCS12`. If the keystore path ends in ".p12", ".pfx", or ".pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`. -`ssl.keystore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.keystore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The password for the keystore. [7.17.0] Prefer `ssl.keystore.secure_password` instead. `ssl.keystore.secure_password` @@ -1281,16 +1281,16 @@ These settings are *only* used for the back-channel communication between {{es}} You cannot use this setting and `ssl.keystore.key_password` at the same time. -`ssl.truststore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.truststore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path for the keystore that contains the certificates to trust. It must be either a Java keystore (jks) or a PKCS#12 file. You cannot use this setting and `ssl.certificate_authorities` at the same time. -`ssl.truststore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.truststore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The format of the truststore file. It must be either `jks` or `PKCS12`. If the file name ends in ".p12", ".pfx" or "pkcs12", the default is `PKCS12`. Otherwise, it defaults to `jks`. -`ssl.truststore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.truststore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The password for the truststore. [7.17.0] Prefer `ssl.truststore.secure_password` instead. You cannot use this setting and `ssl.truststore.secure_password` at the same time. @@ -1302,7 +1302,7 @@ These settings are *only* used for the back-channel communication between {{es}} You cannot use this setting and `ssl.truststore.password` at the same time. -`ssl.verification_mode` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.verification_mode` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the verification of certificates. ::::{dropdown} Valid values @@ -1326,7 +1326,7 @@ These settings are *only* used for the back-channel communication between {{es}} Defaults to `full`. -`ssl.supported_protocols` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.supported_protocols` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported protocols with versions. Valid protocols: `SSLv2Hello`, `SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`, `TLSv1.3`. If the JVM’s SSL provider supports TLSv1.3, the default is `TLSv1.3,TLSv1.2,TLSv1.1`. Otherwise, the default is `TLSv1.2,TLSv1.1`. {{es}} relies on your JDK’s implementation of SSL and TLS. View [Supported SSL/TLS versions by JDK version](docs-content://deploy-manage/security/supported-ssltls-versions-by-jdk-version.md) for more information. @@ -1336,7 +1336,7 @@ These settings are *only* used for the back-channel communication between {{es}} :::: -`ssl.cipher_suites` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.cipher_suites` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported cipher suites vary depending on which version of Java you use. For example, for version 12 the default value is `TLS_AES_256_GCM_SHA384`, `TLS_AES_128_GCM_SHA256`, `TLS_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`, `TLS_RSA_WITH_AES_256_GCM_SHA384`, `TLS_RSA_WITH_AES_128_GCM_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_128_CBC_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA`, `TLS_RSA_WITH_AES_128_CBC_SHA`. For more information, see Oracle’s [Java Cryptography Architecture documentation](https://docs.oracle.com/en/java/javase/11/security/oracle-providers.md#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2). @@ -1347,32 +1347,32 @@ These settings are *only* used for the back-channel communication between {{es}} In addition to the [settings that are valid for all realms](#ref-realm-settings), you can specify the following settings. -`token_type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`token_type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The token type, `id_token` or `access_token`, that the JWT realm uses to verify incoming JWTs. Defaults to `id_token`. -`allowed_audiences` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`allowed_audiences` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A list of allowed JWT audiences that {{es}} should verify. {{es}} will only consume JWTs that were intended for any of these audiences, as denoted by the `aud` claim in the JWT). The audiences are compared with exact string matches and do not support wildcards or regex. Examples of `aud` claim are `https://example.com/client1` and `other_service,elasticsearch`. When `token_type` is `access_token`, the audiences can be optionally denoted by a different claim in the JWT if `aud` does not exist. See also [`fallback_claims.aud`](#security-settings-jwt-fallback-claims-aud). -`allowed_clock_skew` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`allowed_clock_skew` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The maximum allowed clock skew to be taken into consideration when validating JWTs with regards to their creation, not before, and expiration times. -`allowed_issuer` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`allowed_issuer` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A verifiable Identifier for your JWT Issuer. An Issuer Identifier is usually a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components and no query or fragment components. However, it can be any string. The value for this setting should be provided by your JWT Issuer. The issuer is compared with exact string matches and do not support wildcards or regex. Examples of `iss` claim are `https://example.com:8443/jwt` and `issuer123`. -`allowed_subjects` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`allowed_subjects` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A list of allowed JWT subjects that {{es}} should verify. {{es}} will only consume JWTs that were issued for any of these subjects, as denoted by the `sub` claim in the JWT. The subjects are compared with exact string matches and do not support wildcards or regex. Examples of `sub` claim are `https://example.com/user1` and `user_1,user2`. When `token_type` is `access_token`, this setting is mandatory and the subject can be optionally denoted by a different claim in the JWT if `sub` does not exist. See also [`fallback_claims.sub`](#security-settings-jwt-fallback-claims-sub). $$$security-settings-jwt-fallback-claims-sub$$$ -`fallback_claims.sub` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`fallback_claims.sub` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The alternative claim to look for the subject information if the `sub` claim does not exist. It is configurable only when the `token_type` is `access_token`. The fallback is applied everywhere the `sub` claim is used. $$$security-settings-jwt-fallback-claims-aud$$$ -`fallback_claims.aud` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`fallback_claims.aud` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The alternative claim to look for the audiences information if the `aud` claim does not exist. It is configurable only when the `token_type` is `access_token`. The fallback is applied everywhere the `aud` claim is used. -`required_claims` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`required_claims` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Additional claims and associated values that {{es}} should verify. This is a group setting that takes key/value pairs, where the key is a string and the value must be either a string or an array of strings. The values are compared with exact string matches and do not support wildcards or regex. For example: @@ -1384,34 +1384,34 @@ xpack.security.authc.realms.jwt.jwt1: versions: ["1.0", "2.0"] ``` -`allowed_signature_algorithms` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`allowed_signature_algorithms` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A list of signature algorithms that will be used by {{es}} in order to verify the signature of the JWT it will receive from the JWT Issuer. Defaults to `RS256`. Examples are `HS512,RS512,ES512` and `ES384`. Allowed values are `HS256`, `HS384`, `HS512`, `ES256`, `ES384`, `ES512`, `RS256`, `RS384`, `RS512`, `PS256`, `PS384`, `PS512`. `authorization_realms` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The names of the realms that should be consulted for delegated authorization. If this setting is used, then the JWT realm does not perform role mapping and instead loads the user from the listed realms. See [Delegating authorization to another realm](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/realm-chains.md#authorization_realms). -`claims.dn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claims.dn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the JWT claim that contains the user’s Distinguished Name (DN), which uniquely identifies a user or group. -`claim_patterns.dn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claim_patterns.dn` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Accepts the same Java regular expression as [`claim_patterns.principal`](#jwt-claim-pattern-principal), but for the `dn` property. -`claims.groups` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claims.groups` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the JWT claim that contains the user’s groups, such as `groups` and `roles`. -`claim_patterns.group` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claim_patterns.group` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Accepts the same Java regular expression as [`claim_patterns.principal`](#jwt-claim-pattern-principal), but for the `group` property. -`claims.mail` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claims.mail` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the JWT claim that contains the user’s e-mail address. -`claim_patterns.mail` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claim_patterns.mail` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Accepts the same Java regular expression as [`claim_patterns.principal`](#jwt-claim-pattern-principal), but for the `mail` property. -`claims.name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claims.name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the JWT claim that contains the user’s username. -`claim_patterns.name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claim_patterns.name` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Accepts the same Java regular expression as [`claim_patterns.principal`](#jwt-claim-pattern-principal), but for the `name` property. `claims.principal` @@ -1419,34 +1419,34 @@ xpack.security.authc.realms.jwt.jwt1: $$$jwt-claim-pattern-principal$$$ -`claim_patterns.principal` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`claim_patterns.principal` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) An optional Java regular expression that is matched against the JWT claim specified by `claims.principal` before it is applied to the user’s `principal` property. The value must match the pattern and the value of the first *capturing group* is used as the principal. For example, `^([^@]+)@example\\.com$` matches email addresses from the `example.com` domain and uses the local-part as the principal. Another example is `sub` which may not need a pattern setting. -`client_authentication.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`client_authentication.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies whether to use `shared_secret` or `none` to authenticate incoming client requests. If this value is `shared_secret`, the client is authenticated using an HTTP request header that must match a pre-configured secret value. The client must provide this shared secret with every request in the `ES-Client-Authentication` header. If this value is `none`, then the request header `ES-Client-Authentication` is ignored. Defaults to `shared_secret`. Enabling client authentication is recommended. If JWT bearer tokens are shared with other clients or services, client authentication restricts which ones are allowed to submit those JWTs to {{es}}. -`client_authentication.shared_secret` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`client_authentication.shared_secret` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Secure](docs-content://deploy-manage/security/secure-settings.md), [reloadable](docs-content://deploy-manage/security/secure-settings.md#reloadable-secure-settings)) Secret value string for client authentication. Required if `client_authentication.type` is `shared_secret`. `client_authentication.rotation_grace_period` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Sets the grace period for how long after rotating the `client_authentication.shared_secret` is valid. `client_authentication.shared_secret` can be rotated by updating the keystore then calling the [reload API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-nodes-reload-secure-settings). Defaults to `1m`. -`http.connect_timeout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.connect_timeout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Sets the timeout for the HTTP client that is used for fetching the JSON Web Key Set from a remote URL. A value of zero means the timeout is not used. Defaults to `5s`. -`http.connection_read_timeout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.connection_read_timeout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the HTTP timeout used when requesting a connection from the connection manager. Defaults to `5s`. -`http.socket_timeout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.socket_timeout` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the maximum socket timeout (SO_TIMEOUT) for the HTTP client to wait for inactivity between two consecutive data packets. Defaults to `5s`. -`http.max_connections` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.max_connections` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the maximum number of connections allowed across all endpoints. -`http.max_endpoint_connections` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`http.max_endpoint_connections` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the maximum number of connections allowed per endpoint. `jwt.cache.size` @@ -1455,16 +1455,16 @@ $$$jwt-claim-pattern-principal$$$ `jwt.cache.ttl` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the time-to-live for the period of time to cache JWT entries. JWTs can only be cached if client authentication is successful (or disabled). Uses the standard {{es}} [time units](/reference/elasticsearch/rest-apis/api-conventions.md#time-units). If clients use a different JWT for every request, set to `0` to disable the JWT cache. Defaults to `20m`. -`pkc_jwkset_path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`pkc_jwkset_path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The file name or URL to a JSON Web Key Set (JWKS) with the public key material that the JWT Realm uses for verifying token signatures. A value is considered a file name if it does not begin with `https`. The file name is resolved relative to the {{es}} configuration directory. If a URL is provided, then it must begin with `https://` (`http://` is not supported). {{es}} automatically caches the JWK set and will attempt to refresh the JWK set upon signature verification failure, as this might indicate that the JWT Provider has rotated the signing keys. -`hmac_jwkset` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`hmac_jwkset` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Secure](docs-content://deploy-manage/security/secure-settings.md)) Contents of a JSON Web Key Set (JWKS), including the secret key that the JWT realm uses to verify token signatures. This format supports multiple keys and optional attributes, and is preferred over the `hmac_key` setting. Cannot be used in conjunction with the `hmac_key` setting. Refer to [Configure {{es}} to use a JWT realm](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/jwt.md). -`hmac_key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`hmac_key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Secure](docs-content://deploy-manage/security/secure-settings.md)) Contents of a single JSON Web Key (JWK), including the secret key that the JWT realm uses to verify token signatures. This format only supports a single key without attributes, and cannot be used with the `hmac_jwkset` setting. This format is compatible with OIDC. The HMAC key must be a UNICODE string, where the key bytes are the UTF-8 encoding of the UNICODE string. The `hmac_jwkset` setting is preferred. Refer to [Configure {{es}} to use a JWT realm](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/jwt.md). -`populate_user_metadata` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`populate_user_metadata` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies whether to populate the {{es}} user’s metadata with the values that are provided by the JWT claims. Defaults to `true`. @@ -1477,13 +1477,13 @@ These settings are *only* used for the back-channel communication between {{es}} :::: -`ssl.key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.key` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Path to a PEM encoded file containing the private key. If HTTP client authentication is required, it uses this file. You cannot use this setting and `ssl.keystore.path` at the same time. -`ssl.key_passphrase` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.key_passphrase` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The passphrase that is used to decrypt the private key. Since the key might not be encrypted, this value is optional. [7.17.0] Prefer `ssl.secure_key_passphrase` instead. You cannot use this setting and `ssl.secure_key_passphrase` at the same time. @@ -1495,28 +1495,28 @@ These settings are *only* used for the back-channel communication between {{es}} You cannot use this setting and `ssl.key_passphrase` at the same time. -`ssl.certificate` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.certificate` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path for the PEM encoded certificate (or certificate chain) that is associated with the key. This setting can be used only if `ssl.key` is set. -`ssl.certificate_authorities` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.certificate_authorities` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) List of paths to PEM encoded certificate files that should be trusted. This setting and `ssl.truststore.path` cannot be used at the same time. -`ssl.keystore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.keystore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path for the keystore file that contains a private key and certificate. It must be either a Java keystore (jks) or a PKCS#12 file. You cannot use this setting and `ssl.key` at the same time. -`ssl.keystore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.keystore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The format of the keystore file. It must be either `jks` or `PKCS12`. If the keystore path ends in ".p12", ".pfx", or ".pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`. -`ssl.keystore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.keystore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The password for the keystore. [7.17.0] Prefer `ssl.keystore.secure_password` instead. `ssl.keystore.secure_password` @@ -1539,16 +1539,16 @@ These settings are *only* used for the back-channel communication between {{es}} You cannot use this setting and `ssl.keystore.key_password` at the same time. -`ssl.truststore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.truststore.path` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path for the keystore that contains the certificates to trust. It must be either a Java keystore (jks) or a PKCS#12 file. You cannot use this setting and `ssl.certificate_authorities` at the same time. -`ssl.truststore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.truststore.type` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The format of the truststore file. It must be either `jks` or `PKCS12`. If the file name ends in ".p12", ".pfx" or "pkcs12", the default is `PKCS12`. Otherwise, it defaults to `jks`. -`ssl.truststore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.truststore.password` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The password for the truststore. [7.17.0] Prefer `ssl.truststore.secure_password` instead. You cannot use this setting and `ssl.truststore.secure_password` at the same time. @@ -1560,7 +1560,7 @@ These settings are *only* used for the back-channel communication between {{es}} You cannot use this setting and `ssl.truststore.password` at the same time. -`ssl.verification_mode` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.verification_mode` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the verification of certificates. ::::{dropdown} Valid values @@ -1584,7 +1584,7 @@ These settings are *only* used for the back-channel communication between {{es}} Defaults to `full`. -`ssl.supported_protocols` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.supported_protocols` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported protocols with versions. Valid protocols: `SSLv2Hello`, `SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`, `TLSv1.3`. If the JVM’s SSL provider supports TLSv1.3, the default is `TLSv1.3,TLSv1.2,TLSv1.1`. Otherwise, the default is `TLSv1.2,TLSv1.1`. {{es}} relies on your JDK’s implementation of SSL and TLS. View [Supported SSL/TLS versions by JDK version](docs-content://deploy-manage/security/supported-ssltls-versions-by-jdk-version.md) for more information. @@ -1594,7 +1594,7 @@ These settings are *only* used for the back-channel communication between {{es}} :::: -`ssl.cipher_suites` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`ssl.cipher_suites` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported cipher suites vary depending on which version of Java you use. For example, for version 12 the default value is `TLS_AES_256_GCM_SHA384`, `TLS_AES_128_GCM_SHA256`, `TLS_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`, `TLS_RSA_WITH_AES_256_GCM_SHA384`, `TLS_RSA_WITH_AES_128_GCM_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_128_CBC_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA`, `TLS_RSA_WITH_AES_128_CBC_SHA`. For more information, see Oracle’s [Java Cryptography Architecture documentation](https://docs.oracle.com/en/java/javase/11/security/oracle-providers.md#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2). @@ -1855,7 +1855,7 @@ You can configure the following TLS/SSL settings. For more information, see Oracle’s [Java Cryptography Architecture documentation](https://docs.oracle.com/en/java/javase/11/security/oracle-providers.md#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2). -`xpack.security.transport.ssl.trust_restrictions.x509_fields` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.transport.ssl.trust_restrictions.x509_fields` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Specifies which field(s) from the TLS certificate is used to match for the restricted trust management that is used for remote clusters connections. This should only be set when a self managed cluster can not create certificates that follow the Elastic Cloud pattern. The default value is ["subjectAltName.otherName.commonName"], the Elastic Cloud pattern. "subjectAltName.dnsName" is also supported and can be configured in addition to or in replacement of the default. @@ -1894,7 +1894,7 @@ When using PEM encoded files, use the following settings: This setting and `ssl.truststore.path` cannot be used at the same time. -`xpack.security.loginAssistanceMessage` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.security.loginAssistanceMessage` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Adds a message to the login screen. Useful for displaying corporate messages. diff --git a/docs/reference/elasticsearch/configuration-reference/snapshot-restore-settings.md b/docs/reference/elasticsearch/configuration-reference/snapshot-restore-settings.md index fb2cc294693a4..c708b4765e510 100644 --- a/docs/reference/elasticsearch/configuration-reference/snapshot-restore-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/snapshot-restore-settings.md @@ -14,7 +14,7 @@ $$$snapshot-max-concurrent-ops$$$ This limit applies in total to all ongoing snapshot creation, cloning, and deletion operations. {{es}} will reject any operations that would exceed this limit. -`azure.client.CLIENT_NAME.endpoint_suffix` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`azure.client.CLIENT_NAME.endpoint_suffix` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Allows providing the [endpoint_suffix client setting](docs-content://deploy-manage/tools/snapshot-and-restore/azure-repository.md#repository-azure-client-settings) for a non-internal Azure client used for snapshot/restore. Note that `CLIENT_NAME` should be replaced with the name of the created client. @@ -44,7 +44,7 @@ $$$slm-health-failed-snapshot-warn-threshold$$$ $$$repositories-url-allowed$$$ -`repositories.url.allowed_urls` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`repositories.url.allowed_urls` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the [read-only URL repositories](docs-content://deploy-manage/tools/snapshot-and-restore/read-only-url-repository.md) that snapshots can be restored from. diff --git a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md index 59a3bfb22dcba..8dbb1235dd4bc 100644 --- a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md @@ -19,7 +19,7 @@ All of these settings can be added to the `elasticsearch.yml` configuration file $$$xpack-watcher-encrypt-sensitive-data$$$ -`xpack.watcher.encrypt_sensitive_data` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.watcher.encrypt_sensitive_data` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Set to `true` to encrypt sensitive data. If this setting is enabled, you must also specify the `xpack.watcher.encryption_key` setting. For more information, see [*Encrypting sensitive data in {{watcher}}*](docs-content://explore-analyze/alerts-cases/watcher/encrypting-data.md). `xpack.watcher.encryption_key` @@ -28,10 +28,10 @@ $$$xpack-watcher-encrypt-sensitive-data$$$ `xpack.watcher.max.history.record.size` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The maximum size watcher history record that can be written into the watcher history index. Any larger history record will have some of its larger fields removed. Defaults to 10mb. -`xpack.watcher.trigger.schedule.engine` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.watcher.trigger.schedule.engine` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Defines when the watch should start, based on date and time [Learn more](docs-content://explore-analyze/alerts-cases/watcher/schedule-types.md). -`xpack.watcher.history.cleaner_service.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.watcher.history.cleaner_service.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Controls [whether old watcher indices are automatically deleted](/reference/elasticsearch/configuration-reference/watcher-settings.md#general-notification-settings). `xpack.http.proxy.host` @@ -100,7 +100,7 @@ You can configure the following TLS/SSL settings. Defaults to `full`. -`xpack.http.ssl.cipher_suites` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.http.ssl.cipher_suites` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported cipher suites vary depending on which version of Java you use. For example, for version 12 the default value is `TLS_AES_256_GCM_SHA384`, `TLS_AES_128_GCM_SHA256`, `TLS_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`, `TLS_RSA_WITH_AES_256_GCM_SHA384`, `TLS_RSA_WITH_AES_128_GCM_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_128_CBC_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA`, `TLS_RSA_WITH_AES_128_CBC_SHA`. For more information, see Oracle’s [Java Cryptography Architecture documentation](https://docs.oracle.com/en/java/javase/11/security/oracle-providers.md#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2). @@ -280,7 +280,7 @@ $$$email-account-attributes$$$ `smtp.wait_on_quit` : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) If set to false the QUIT command is sent and the connection closed. If set to true, the QUIT command is sent and a reply is waited for. True by default. -`xpack.notification.email.html.sanitization.allow` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.notification.email.html.sanitization.allow` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Specifies the HTML elements that are allowed in email notifications. For more information, see [Configuring HTML sanitization options](docs-content://explore-analyze/alerts-cases/watcher/actions-email.md#email-html-sanitization). You can specify individual HTML elements and the following HTML feature groups: $$$html-feature-groups$$$ @@ -308,10 +308,10 @@ $$$email-account-attributes$$$ : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Only embedded images. Embedded images can only use the `cid:` URL protocol in their `src` attribute. -`xpack.notification.email.html.sanitization.disallow` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.notification.email.html.sanitization.disallow` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the HTML elements that are NOT allowed in email notifications. You can specify individual HTML elements and [HTML feature groups](#html-feature-groups). -`xpack.notification.email.html.sanitization.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.notification.email.html.sanitization.enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Set to `false` to completely disable HTML sanitation. Not recommended. Defaults to `true`. `xpack.notification.reporting.warning.kbn-csv-contains-formulas.text` @@ -458,7 +458,7 @@ PKCS#12 files are configured in the same way as Java keystore files: You can configure the following Slack notification settings in `elasticsearch.yml`. For more information about sending notifications via Slack, see [Configuring Slack actions](docs-content://explore-analyze/alerts-cases/watcher/actions-slack.md#configuring-slack-actions). -`xpack.notification.slack` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.notification.slack` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Configures [Slack notification settings](docs-content://explore-analyze/alerts-cases/watcher/actions-slack.md). Note that you need to add `secure_url` as a [secret value to the keystore](docs-content://deploy-manage/security/secure-settings.md). `xpack.notification.slack.default_account` @@ -531,7 +531,7 @@ $$$jira-account-attributes$$$ You can configure the following PagerDuty notification settings in `elasticsearch.yml`. For more information about sending notifications via PagerDuty, see [Configuring PagerDuty actions](docs-content://explore-analyze/alerts-cases/watcher/actions-pagerduty.md#configuring-pagerduty-actions). -`xpack.notification.pagerduty` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.notification.pagerduty` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Configures [PagerDuty notification settings](docs-content://explore-analyze/alerts-cases/watcher/actions-pagerduty.md#configuring-pagerduty). `xpack.notification.pagerduty.default_account` @@ -573,7 +573,7 @@ $$$pagerduty-account-attributes$$$ `attach_payload` : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Whether or not to provide the watch payload as context for the event by default. Valid values: `true`, `false`. -`xpack.notification.webhook.additional_token_enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on {{ess}}") +`xpack.notification.webhook.additional_token_enabled` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : When set to `true`, {{es}} automatically sets a token which enables the bypassing of traffic filters for calls initiated by Watcher towards {{es}} or {{kib}}. The default is `false` and the feature is available starting with {{es}} version 8.7.1 and later. ::::{important} From b35556e04b5adff7e595a4e5be3e10ce19fcf037 Mon Sep 17 00:00:00 2001 From: Charlotte Hoblik Date: Tue, 18 Mar 2025 14:14:08 +0100 Subject: [PATCH 12/13] adjust settings pages --- .../security-settings.md | 32 +++++++++---------- .../watcher-settings.md | 8 ++--- 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/docs/reference/elasticsearch/configuration-reference/security-settings.md b/docs/reference/elasticsearch/configuration-reference/security-settings.md index ec6159c6fe1c1..edb8d3d73b826 100644 --- a/docs/reference/elasticsearch/configuration-reference/security-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/security-settings.md @@ -144,22 +144,6 @@ Large real-time clock inconsistency across cluster nodes can cause problems with `xpack.security.authc.api_key.hashing.algorithm` : ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the hashing algorithm that is used for securing API key credentials. See [Table 3, Secure token hashing algorithms](#secure-token-hashing-algorithms). Defaults to `ssha256`. -`xpack.security.authc.realms.saml.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") -: To learn more on how to enable SAML and related user settings, check [secure your clusters with SAML](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/saml.md). - -`xpack.security.authc.realms.oidc.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") -: To learn more on how to enable OpenID Connect and related user settings, check [secure your clusters with OpenID Connect](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md). - -`xpack.security.authc.realms.kerberos.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") -: To learn more on how to enable Kerberos and relate user settings, check [secure your clusters with Kerberos](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kerberos.md). - -`xpack.security.authc.realms.jwt.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") -: To learn more on how to enable JWT and related user settings, check [secure your clusters with JWT](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/jwt.md). - -::::{note} -All SAML, OpenID Connect, Kerberos, and JWT settings are allowlisted. -:::: - ### Security domain settings [security-domain-settings] @@ -183,6 +167,22 @@ xpack: ### Realm settings [realm-settings] +`xpack.security.authc.realms.saml.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") +: To learn more on how to enable SAML and related user settings, check [secure your clusters with SAML](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/saml.md). + +`xpack.security.authc.realms.oidc.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") +: To learn more on how to enable OpenID Connect and related user settings, check [secure your clusters with OpenID Connect](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md). + +`xpack.security.authc.realms.kerberos.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") +: To learn more on how to enable Kerberos and relate user settings, check [secure your clusters with Kerberos](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kerberos.md). + +`xpack.security.authc.realms.jwt.*` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") +: To learn more on how to enable JWT and related user settings, check [secure your clusters with JWT](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/jwt.md). + +::::{note} +All SAML, OpenID Connect, Kerberos, and JWT settings are allowlisted. +:::: + You configure realm settings in the `xpack.security.authc.realms` namespace in `elasticsearch.yml`. For example: diff --git a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md index 8dbb1235dd4bc..76ef4f6b75a53 100644 --- a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md @@ -461,7 +461,7 @@ You can configure the following Slack notification settings in `elasticsearch.ym `xpack.notification.slack` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Configures [Slack notification settings](docs-content://explore-analyze/alerts-cases/watcher/actions-slack.md). Note that you need to add `secure_url` as a [secret value to the keystore](docs-content://deploy-manage/security/secure-settings.md). -`xpack.notification.slack.default_account` +`xpack.notification.slack.default_account` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Default Slack account to use. If you configure multiple Slack accounts, you must either configure this setting or specify the Slack account to use in the [`slack`](docs-content://explore-analyze/alerts-cases/watcher/actions-slack.md) action. See [Configuring Slack Accounts](docs-content://explore-analyze/alerts-cases/watcher/actions-slack.md#configuring-slack). @@ -469,7 +469,7 @@ You can configure the following Slack notification settings in `elasticsearch.ym $$$slack-account-attributes$$$ -`xpack.notification.slack.account` +`xpack.notification.slack.account` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Specifies account information for sending notifications via Slack. You can specify the following Slack account attributes: `secure_url` @@ -534,7 +534,7 @@ You can configure the following PagerDuty notification settings in `elasticsearc `xpack.notification.pagerduty` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Configures [PagerDuty notification settings](docs-content://explore-analyze/alerts-cases/watcher/actions-pagerduty.md#configuring-pagerduty). -`xpack.notification.pagerduty.default_account` +`xpack.notification.pagerduty.default_account` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Default PagerDuty account to use. If you configure multiple PagerDuty accounts, you must either configure this setting or specify the PagerDuty account to use in the [`pagerduty`](docs-content://explore-analyze/alerts-cases/watcher/actions-pagerduty.md) action. See [Configuring PagerDuty accounts](docs-content://explore-analyze/alerts-cases/watcher/actions-pagerduty.md#configuring-pagerduty). @@ -542,7 +542,7 @@ You can configure the following PagerDuty notification settings in `elasticsearc $$$pagerduty-account-attributes$$$ -`xpack.notification.pagerduty.account` +`xpack.notification.pagerduty.account` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted") : Specifies account information for sending notifications via PagerDuty. You can specify the following PagerDuty account attributes: `name` From fc97d55c3dd360a84b757e91369ca822f736fdf4 Mon Sep 17 00:00:00 2001 From: Charlotte Hoblik Date: Tue, 18 Mar 2025 14:55:09 +0100 Subject: [PATCH 13/13] add applies_to tag --- .../configuration-reference/circuit-breaker-settings.md | 4 ++++ .../cluster-level-shard-allocation-routing-settings.md | 4 ++++ .../cross-cluster-replication-settings.md | 3 +++ .../data-stream-lifecycle-settings.md | 3 +++ .../discovery-cluster-formation-settings.md | 3 +++ .../configuration-reference/enrich-settings.md | 7 +++++++ .../configuration-reference/field-data-cache-settings.md | 3 +++ .../configuration-reference/health-diagnostic-settings.md | 3 +++ .../index-lifecycle-management-settings.md | 3 +++ .../configuration-reference/index-management-settings.md | 4 ++++ .../configuration-reference/index-recovery-settings.md | 3 +++ .../elasticsearch/configuration-reference/index.md | 8 +++++++- .../configuration-reference/indexing-buffer-settings.md | 3 +++ .../configuration-reference/inference-settings.md | 3 +++ .../configuration-reference/license-settings.md | 3 +++ .../configuration-reference/local-gateway.md | 3 +++ .../configuration-reference/machine-learning-settings.md | 4 ++++ .../miscellaneous-cluster-settings.md | 3 +++ .../configuration-reference/monitoring-settings.md | 4 ++++ .../configuration-reference/networking-settings.md | 4 ++++ .../configuration-reference/node-query-cache-settings.md | 3 +++ .../configuration-reference/node-settings.md | 3 +++ .../configuration-reference/search-settings.md | 3 +++ .../configuration-reference/security-settings.md | 4 ++++ .../shard-request-cache-settings.md | 3 +++ .../configuration-reference/snapshot-restore-settings.md | 4 ++++ .../configuration-reference/thread-pool-settings.md | 3 +++ .../configuration-reference/transforms-settings.md | 3 +++ .../configuration-reference/watcher-settings.md | 4 ++++ 29 files changed, 104 insertions(+), 1 deletion(-) diff --git a/docs/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md b/docs/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md index 456c3858d18b0..c5ec2c19785af 100644 --- a/docs/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md @@ -1,6 +1,10 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/circuit-breaker.html +applies_to: + deployment: + ess: + self: --- # Circuit breaker settings [circuit-breaker] diff --git a/docs/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md b/docs/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md index 99c74852196e1..a6d5259943c34 100644 --- a/docs/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md @@ -1,6 +1,10 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-cluster.html +applies_to: + deployment: + ess: + self: --- # Cluster-level shard allocation and routing settings [modules-cluster] diff --git a/docs/reference/elasticsearch/configuration-reference/cross-cluster-replication-settings.md b/docs/reference/elasticsearch/configuration-reference/cross-cluster-replication-settings.md index c32cd1842e435..58638af440441 100644 --- a/docs/reference/elasticsearch/configuration-reference/cross-cluster-replication-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/cross-cluster-replication-settings.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/ccr-settings.html +applies_to: + deployment: + self: --- # Cross-cluster replication settings [ccr-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/data-stream-lifecycle-settings.md b/docs/reference/elasticsearch/configuration-reference/data-stream-lifecycle-settings.md index b5089bcd41c38..34ed18422d46b 100644 --- a/docs/reference/elasticsearch/configuration-reference/data-stream-lifecycle-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/data-stream-lifecycle-settings.md @@ -2,6 +2,9 @@ navigation_title: "Data stream lifecycle settings" mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/data-stream-lifecycle-settings.html +applies_to: + deployment: + self: --- # Data stream lifecycle settings in {{es}} [data-stream-lifecycle-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/discovery-cluster-formation-settings.md b/docs/reference/elasticsearch/configuration-reference/discovery-cluster-formation-settings.md index f2670875e0510..efc691f44c6c1 100644 --- a/docs/reference/elasticsearch/configuration-reference/discovery-cluster-formation-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/discovery-cluster-formation-settings.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-discovery-settings.html +applies_to: + deployment: + self: --- # Discovery and cluster formation settings [modules-discovery-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/enrich-settings.md b/docs/reference/elasticsearch/configuration-reference/enrich-settings.md index 0f5b56727b2d1..b8c5c9d198db8 100644 --- a/docs/reference/elasticsearch/configuration-reference/enrich-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/enrich-settings.md @@ -1,3 +1,10 @@ +--- +applies_to: + deployment: + ess: + self: +--- + # Enrich settings [enrich_settings] You can configure these enrich settings in the `elasticsearch.yml` file. For more information, see [Set up an enrich processor](docs-content:///manage-data/ingest/transform-enrich/set-up-an-enrich-processor.md). diff --git a/docs/reference/elasticsearch/configuration-reference/field-data-cache-settings.md b/docs/reference/elasticsearch/configuration-reference/field-data-cache-settings.md index d196f8e3dbb51..9d1f0d26f2768 100644 --- a/docs/reference/elasticsearch/configuration-reference/field-data-cache-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/field-data-cache-settings.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-fielddata.html +applies_to: + deployment: + self: --- # Field data cache settings [modules-fielddata] diff --git a/docs/reference/elasticsearch/configuration-reference/health-diagnostic-settings.md b/docs/reference/elasticsearch/configuration-reference/health-diagnostic-settings.md index 131c8e0e544f3..21d7932b31b2f 100644 --- a/docs/reference/elasticsearch/configuration-reference/health-diagnostic-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/health-diagnostic-settings.md @@ -2,6 +2,9 @@ navigation_title: "Health Diagnostic settings" mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/health-diagnostic-settings.html +applies_to: + deployment: + self: --- # Health diagnostic settings in {{es}} [health-diagnostic-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/index-lifecycle-management-settings.md b/docs/reference/elasticsearch/configuration-reference/index-lifecycle-management-settings.md index 1085f81421355..19ac2b28be424 100644 --- a/docs/reference/elasticsearch/configuration-reference/index-lifecycle-management-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/index-lifecycle-management-settings.md @@ -2,6 +2,9 @@ navigation_title: "{{ilm-cap}} settings" mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-settings.html +applies_to: + deployment: + self: --- # {{ilm-cap}} settings in {{es}} [ilm-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/index-management-settings.md b/docs/reference/elasticsearch/configuration-reference/index-management-settings.md index 9a17eb0f2c97a..d1ef1c186a6a8 100644 --- a/docs/reference/elasticsearch/configuration-reference/index-management-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/index-management-settings.md @@ -1,6 +1,10 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/index-management-settings.html +applies_to: + deployment: + ess: + self: --- # Index management settings [index-management-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/index-recovery-settings.md b/docs/reference/elasticsearch/configuration-reference/index-recovery-settings.md index 98513f7efc18a..a42602cf4f1fd 100644 --- a/docs/reference/elasticsearch/configuration-reference/index-recovery-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/index-recovery-settings.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/recovery.html +applies_to: + deployment: + self: --- # Index recovery settings [recovery] diff --git a/docs/reference/elasticsearch/configuration-reference/index.md b/docs/reference/elasticsearch/configuration-reference/index.md index 0a691cf04bc9a..85e0b5537a6ec 100644 --- a/docs/reference/elasticsearch/configuration-reference/index.md +++ b/docs/reference/elasticsearch/configuration-reference/index.md @@ -1,5 +1,11 @@ --- navigation_title: "Configuration" +applies_to: + deployment: + ess: + ece: + self: + serverless: --- # Elasticsearch configuration reference @@ -13,7 +19,7 @@ Refer to [Elasticsearch configuration](docs-content://deploy-manage/deploy/cloud Configuration settings enable you to customize the behavior of Elasticsearch features. This reference provides details about each setting, such as its purpose, default behavior, and availability in Elastic Cloud environments. -For details on updating user settings, see [Edit Elastic Stack settings](docs-content://deploy-manage/deploy/elastic-cloud/edit-stack-settings.md) for {{ech}}, [Add Elasticsearch user settings](docs-content://deploy-manage/deploy/cloud-enterprise/edit-stack-settings-elasticsearch.md) for {{ece}} and [Differences from other Elasticsearch offerings](docs-content://deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md) for {{serverless-short}}. +For details on updating user settings, see [Edit Elastic Stack settings](docs-content://deploy-manage/deploy/elastic-cloud/edit-stack-settings.md) for {{ech}} deployments, [Add Elasticsearch user settings](docs-content://deploy-manage/deploy/cloud-enterprise/edit-stack-settings-elasticsearch.md) for {{ece}} deployments and [Differences from other Elasticsearch offerings](docs-content://deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md) for {{serverless-short}}. The settings are grouped by feature or purpose, for example: diff --git a/docs/reference/elasticsearch/configuration-reference/indexing-buffer-settings.md b/docs/reference/elasticsearch/configuration-reference/indexing-buffer-settings.md index 8e68a30243425..1c815b9d15d4e 100644 --- a/docs/reference/elasticsearch/configuration-reference/indexing-buffer-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/indexing-buffer-settings.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/indexing-buffer.html +applies_to: + deployment: + self: --- # Indexing buffer settings [indexing-buffer] diff --git a/docs/reference/elasticsearch/configuration-reference/inference-settings.md b/docs/reference/elasticsearch/configuration-reference/inference-settings.md index 7e1b92c4f284a..162df6e8116c0 100644 --- a/docs/reference/elasticsearch/configuration-reference/inference-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/inference-settings.md @@ -2,6 +2,9 @@ navigation_title: "Inference settings" mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/inference-settings.html +applies_to: + deployment: + self: --- # Inference API settings in {{es}} [inference-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/license-settings.md b/docs/reference/elasticsearch/configuration-reference/license-settings.md index cc5caf247fd8d..cd7e4860e817e 100644 --- a/docs/reference/elasticsearch/configuration-reference/license-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/license-settings.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/license-settings.html +applies_to: + deployment: + self: --- # License settings [license-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/local-gateway.md b/docs/reference/elasticsearch/configuration-reference/local-gateway.md index e8bd29240b8e3..a749e54ea340c 100644 --- a/docs/reference/elasticsearch/configuration-reference/local-gateway.md +++ b/docs/reference/elasticsearch/configuration-reference/local-gateway.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-gateway.html +applies_to: + deployment: + self: --- # Local gateway [modules-gateway] diff --git a/docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md b/docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md index 339054dc7dd53..35fe856b9d570 100644 --- a/docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md @@ -2,6 +2,10 @@ navigation_title: "Machine learning settings" mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-settings.html +applies_to: + deployment: + ess: + self: --- # Machine learning settings in Elasticsearch [ml-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/miscellaneous-cluster-settings.md b/docs/reference/elasticsearch/configuration-reference/miscellaneous-cluster-settings.md index 7b3ff23563c8d..a60daeadec1ea 100644 --- a/docs/reference/elasticsearch/configuration-reference/miscellaneous-cluster-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/miscellaneous-cluster-settings.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/misc-cluster-settings.html +applies_to: + deployment: + self: --- # Miscellaneous cluster settings [misc-cluster-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/monitoring-settings.md b/docs/reference/elasticsearch/configuration-reference/monitoring-settings.md index 011ca441f7f0a..c1902dbff86be 100644 --- a/docs/reference/elasticsearch/configuration-reference/monitoring-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/monitoring-settings.md @@ -2,6 +2,10 @@ navigation_title: "Monitoring settings" mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/monitoring-settings.html +applies_to: + deployment: + ess: + self: --- # Monitoring settings in {{es}} [monitoring-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/networking-settings.md b/docs/reference/elasticsearch/configuration-reference/networking-settings.md index b9b4c44d0781b..85f2287d5a0a4 100644 --- a/docs/reference/elasticsearch/configuration-reference/networking-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/networking-settings.md @@ -1,6 +1,10 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html +applies_to: + deployment: + ess: + self: --- # Networking settings [modules-network] diff --git a/docs/reference/elasticsearch/configuration-reference/node-query-cache-settings.md b/docs/reference/elasticsearch/configuration-reference/node-query-cache-settings.md index 8105e163cc7b2..78ee6a0800081 100644 --- a/docs/reference/elasticsearch/configuration-reference/node-query-cache-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/node-query-cache-settings.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/query-cache.html +applies_to: + deployment: + self: --- # Node query cache settings [query-cache] diff --git a/docs/reference/elasticsearch/configuration-reference/node-settings.md b/docs/reference/elasticsearch/configuration-reference/node-settings.md index 47f8fa18ff453..5f0c42080f32a 100644 --- a/docs/reference/elasticsearch/configuration-reference/node-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/node-settings.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html +applies_to: + deployment: + self: --- # Node settings [modules-node] diff --git a/docs/reference/elasticsearch/configuration-reference/search-settings.md b/docs/reference/elasticsearch/configuration-reference/search-settings.md index dbdd3bbb905fc..ff20acfa5c3fa 100644 --- a/docs/reference/elasticsearch/configuration-reference/search-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/search-settings.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/search-settings.html +applies_to: + deployment: + self: --- # Search settings [search-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/security-settings.md b/docs/reference/elasticsearch/configuration-reference/security-settings.md index edb8d3d73b826..9fbf2c7ff095a 100644 --- a/docs/reference/elasticsearch/configuration-reference/security-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/security-settings.md @@ -2,6 +2,10 @@ navigation_title: "Security settings" mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html +applies_to: + deployment: + ess: + self: --- # Security settings in {{es}} [security-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/shard-request-cache-settings.md b/docs/reference/elasticsearch/configuration-reference/shard-request-cache-settings.md index 2e0663980604d..9a801ea607dc7 100644 --- a/docs/reference/elasticsearch/configuration-reference/shard-request-cache-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/shard-request-cache-settings.md @@ -2,6 +2,9 @@ mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/shard-request-cache-settings.html navigation_title: Shard request cache +applies_to: + deployment: + self: --- # Shard request cache settings [shard-request-cache-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/snapshot-restore-settings.md b/docs/reference/elasticsearch/configuration-reference/snapshot-restore-settings.md index c708b4765e510..4f7d27c6fc4ab 100644 --- a/docs/reference/elasticsearch/configuration-reference/snapshot-restore-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/snapshot-restore-settings.md @@ -1,6 +1,10 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshot-settings.html +applies_to: + deployment: + ess: + self: --- # Snapshot and restore settings [snapshot-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/thread-pool-settings.md b/docs/reference/elasticsearch/configuration-reference/thread-pool-settings.md index 2e2844dc22d1a..7a52376ef9b7a 100644 --- a/docs/reference/elasticsearch/configuration-reference/thread-pool-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/thread-pool-settings.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-threadpool.html +applies_to: + deployment: + self: --- # Thread pool settings [modules-threadpool] diff --git a/docs/reference/elasticsearch/configuration-reference/transforms-settings.md b/docs/reference/elasticsearch/configuration-reference/transforms-settings.md index 1408aba965307..4a69385a1eaa0 100644 --- a/docs/reference/elasticsearch/configuration-reference/transforms-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/transforms-settings.md @@ -2,6 +2,9 @@ navigation_title: "{{transforms-cap}} settings" mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-settings.html +applies_to: + deployment: + self: --- # {{transforms-cap}} settings in Elasticsearch [transform-settings] diff --git a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md index 76ef4f6b75a53..fc6ae6340967f 100644 --- a/docs/reference/elasticsearch/configuration-reference/watcher-settings.md +++ b/docs/reference/elasticsearch/configuration-reference/watcher-settings.md @@ -2,6 +2,10 @@ navigation_title: "{{watcher}} settings" mapped_pages: - https://www.elastic.co/guide/en/elasticsearch/reference/current/notification-settings.html +applies_to: + deployment: + ess: + self: --- # {{watcher}} settings in Elasticsearch [notification-settings]