Search Cluster Setup Doc

Auto-generated from the uploaded PDF Search_Cluster_Setup_Doc.pdf. This is an extracted-text rendering for searchability; see the original PDF for exact formatting, diagrams, tables, and images.

Infosys - DGARM


Search Cluster Setup Document


Last Updated:- 7th Feb, 2026


By
Prashant Kashyap

Document Control

Document No.       Doc_1

Document Version   1

Prepared By        Prashant Kashyap

Release Date       7th Feb 2026

                                                           Table of Contents
Infosys - DGARM ....................................................................................................................................................... 1

Document Control .....................................................................................................................................................2

Installation of Elasticsearch ..................................................................................................................................... 4

Kibana Installation ................................................................................................................................................... 9

                      Installation of Elasticsearch

1. Enable subscription-manager register
         subscription-manager register --username actual_user --
    password actual_pass

        Note :- After installation please subscription-manager unregister
         Command :- subscription-manager unregister


 2 . Install java on node (server), check the java version and Installation it
            yum install java*
            java -version

3. make Elasticsearch as user
          useradd elasticsearch
          groupadd elasticsearch

4. create data directory as per elasticsearch node functionality
   mkdir /data                                      // for normal node master and
data
   mkdir /ml-data                                        // for ml node

5. create ELASTIC Directory for installation work
    mkdir ELASTIC
   cd ELASTIC

   # Download Elasticsearch rpm package
   wget
https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-
9.1.5-x86_64.rpm

     # Install Elasticsearch
     sudo rpm -ivh elasticsearch-9.1.5-x86_64.rpm


6. take backup of original elasticsearch.yml file before make any changes
        cp /etc/elasticsearch/elasticsearch.yml
        /etc/elasticsearch/elasticsearch_yml.backup

7. Change ownership of elk directories and owner
        chown -R root:elasticsearch /etc/elasticsearch
        chown -R root:elasticsearch /data
        chown -R root:elasticsearch /var/log/elasticsearch

       8. Put necessary node certificates in elasticsearch certs folder


               cd /etc/elasticsearch/certs


      Note :- .cnf, .dgarm.gov.in.crt, fullchain.crt and key will different as per node

9. Enter host entry in hosts file
   Note : host entry wil be different for DR and Prod as per cluster design or setup

   nano /etc/hosts
      All ELK Cluster node entry

10. go to elasticserch folder and make changes in yml file
nano elasticsearch.yml


11. start 9200 and 9300 port
       systemctl start firewalld
       firewall-cmd --permanent --add-port=9200/tcp
       firewall-cmd --permanent --add-port=9300/tcp
       systemctl reload firewalld

12. start the elasticsearch service
         sudo systemctl daemon-reload
         sudo systemctl enable elasticsearch
         sudo systemctl start elasticsearch
         sudo systemctl restart elasticsearch
         sudo systemctl status elasticsearch

      sudo systemctl stop elasticsearch

13. Commands for check the error of Elasticsearch
       sudo journalctl -u elasticsearch.service
       sudo journalctl -u elasticsearch.service -f

14. Elasticsearch Instance
       ps aux | grep elasticsearch
       sudo netstat -plnt | grep 9200

15. command to change password for Elasticsearch user i custom form
    /usr/share/bin/elasticsearch-reset-password -u elastic -i         // set
custom password

Note:- The same steps are followed for all other Elasticsearch nodes.

Overview for Search Cluster nodes:- 3 master/hot nodes,         1 ml node
and 2 Kibana nodes.

                      Kibana Installation

   1. Enable subscription-manager register
    subscription-manager register --username ABC --password abc@123

         Note :- After installation please subscription-manager
    unregister
        Command :- subscription-manager unregister

   2. Install java on node (server), check the java version and
      Install it
          yum install java*
          java -version

   3. Make Kibana as user and group
         useradd elasticsearch
          groupadd elasticsearch

   4. Create Kibana Directory for installation work
          mkdir /kibana
          cd /kibana/
          wget https://artifacts.elastic.co/downloads/kibana/kibana-
9.1.5-x86_64.rpm
          yum install net-tools
          rpm -ivh kibana-9.1.5-x86_64.rpm


    5. put all certificates in certs directory


                                                                  cd
/etc/kibana/certs/

   6. make changes in kibana.yml file


Note : As per node, cluster and server host name will be different


7. open port and reload
       firewall-cmd --permanent --add-port=5601/tcp
       systemctl reload firewalld
       netstat -an | grep 5601

8. Give permission to kibana respect folders
        chown -R kibana:kibana /etc/kibana/certs
        chown -R kibana:kibana /opt/kibana
        chown -R kibana:kibana /var/log/kibana

9. restart kibana service
    sudo systemctl daemon-reload
    sudo systemctl enable kibana
    sudo systemctl start kibana
    sudo systemctl restart kibana
    sudo systemctl status kibana

10. Command to reset kibana_system user password from elasticsearch
master node.
         Cd /usr/share/elasticsearch
         Sudo ./bin/elasticsearch-reset-password -u kibana_system

11. Now go to search engine and access kiban dashboard or url

    https://kibanalocalhost:5601

       Enter elastic and its password
     Username :- elastic
     Password :- custom or auto generated.

Note: The same process will be followed for the other Kibana node.