By default, without any network configuration, Elasticsearch connects to available loopback addresses and scans ports 9300 to 9305 to attempt to connect to other nodes running on the same server. This provides an automatic clustering experience without having to do any configuration.

 

When it's time to create a cluster with nodes on other servers, you'll need to provide a list of IPs from other nodes in the cluster that are likely to be active and contactable. For my lab, it was not necessary to configure this property.

 

discovery.zen.minimum_master_nodes

 

Step 6. Configurar a propriedade network.host

network.host: To form a cluster with nodes on other servers, your node will need to bind to a non-loopback address. Although there are many network configurations, generally all you need to configure is network.host.

For my environment, I left the defaults values configured.

NOTE: If you will configure X-Pack Security, the IP configured here should be used to create the certificates and keys.

Step 7: Configure Liferay DXP to connect to your Elasticsearch cluster.

Step 8: Restart Liferay DXP and reindex your search indexes.

• Stop Liferay
• Start Elasticsearsh:
  • ./bin/ elasticsearch
• Start Liferay
• Reindex all search indexes:
  • Control Panel → Setup → Search → Execute Reindex all Search Index.

Installing Liferay Enterprise Search

The X-Pack is an extension of Elasticsearch to protect and monitor Elasticsearch clusters. If you use Elasticsearch, X-Pack's security features include Elasticsearch cluster data access authentication and Elasticsearch internal and external communications encryption.

A Liferay Enterprise Search Premium subscription lets you access the two connectors, the X-Pack Connector and the Monitoring Connector. A Liferay Enterprise Search Standard subscription provides the monitoring integration, you only have access to the Monitoring Connector.

NOTE: The X-Pack comes out-of-the-box within the elasticsearch bundle.

• Download the connectors according to your subscription:
  • Enterprise Search Standard
  • Enterprise Search Premium
• Deploy connectors in Liferay at:
  • [Liferay_Home]/Deploy
• Restart Liferay

Enabling X-Pack Security

Before start the X-pack security enablement process you need the licenses, if you do not already have a subscription, you can generate a 30-day trial license.

Follow the steps in the link below to generate a 30-day trial license:

https://www.elastic.co/guide/en/elasticsearch/reference/6.5/start-trial.html

The first thing to do is enable X-Pack security.

1. Add the following property to the elasticsearch.yml file of each node in your elasticsearch cluster:
   • xpack .security.enabled: true
2. Restart the elasticsearch nodes

Setting Up X-Pack Users

 On a system that uses X-Pack Security and X-Pack Monitoring, these internal X-Pack users are important:

• kibana
• elastic

To create the passwords for these users run the following command:

./bin/ elasticsearch -setup-passwords interactive

NOTE: If a message that the elastic user password has already been changed appears, you can see this link to resolve.

Enabling Transport Layer Security

• Generate Node Certificates
  • Create a certificate authority, using X-Pack’s certutil command:

    • ./bin/elasticsearch-certutil ca --pem --ca-dn CN=localhost
    • This generates a ZIP file. Extract the contents in the [Elasticsearch Home]/config folder.

  • Generate X.509 certificates and private keys using the CA created:
    • ./bin/elasticsearch-certutil cert --pem --ca-cert /path/to/ca.crt --ca-key /path/to/ca.key --dns localhost --ip 127.0.0.1 --name localhost
    • This generates another ZIP file. Extract the contents in the [Elasticsearch Home]/config folder.

NOTE: Use the IP that was configured in the network.host property of the elasticsearch.yml file

• Enable TLS

On each node in the elasticsearch.yml file add the following properties:

• Enable transport layer TLS (on each node in the file elasticsearch.yml add the following properties):

• Enable TLS on the HTTP layer to encrypt client communication (on each node in the file elasticsearch.yml add the following property):

xpack.security.http.ssl.enabled: true

Configure the Liferay Connector to X-Pack Security

• Create the following file in [Liferay_Home]/osgi/configs:

com.liferay.portal.search.elasticsearch6.xpack.security.internal.configuration.XPackSecurityConfiguration.config

• Add the following properties:

Configure Liferay Enterprise Search Monitoring

• xpack .monitoring.collection.enabled: true

Install Kibana

• Download Kibana according to the version of elasticsearch you are using;
• Unzip Kibana in the desired directory;
• Tell Kibana which elastic you will monitor through the kibana.yml file;
  • elasticsearch.url: "http://localhost:9200"

NOTE: If SSL is enabled on Elasticsearch, this is an https URL.

If you’re using X-Pack’s security features on the Elasticsearch server.

CONFIGURE KIBANA WITH AUTHENTICATION

If X-Pack requires authentication to access the Elasticsearch cluster, follow these steps:

• Set the password for the built-in kibana user in [Kibana Home]/config/kibana.yml:
  • elasticsearch.username: "kibana"
  • elasticsearch.password: "liferay"

NOTES:

1. The password used in this step was created before the topic above Setting Up X-Pack Users.
2. Once Kibana is installed, you can change the built-in user passwords from the Management user interface.

CONFIGURING KIBANA WITH ENCRYPTION

Add these settings to kibana.yml:

Configuring the Liferay Connector to X-Pack Monitoring

• Once the connector is installed and Kibana and Elasticsearch are securely configured, create a configuration file named:

com.liferay.portal.search.elasticsearch6.xpack.monitoring.web.internal.configuration.XPackMonitoringConfiguration.config

• Place these settings in the .config file:

• Deploy this configuration file to [Liferay Home]/osgi/configs, and your running instance applies the settings. There’s need to restart the server.

IF YOU WANT TO USE LIFERAY X-PACK MONITORING PORTLET INSTEAD THE KIBANA ADMIN DASHBOARD, CONFIGURE THE FOLLOWING SETTINGS

• There are two more settings to add to Kibana itself. The first forbids Kibana from rewriting requests prefixed with server.basePath. The second sets Kibana’s base path for the Monitoring portlet to act as a proxy for Kibana’s monitoring UI. Add this to kibana.yml:
  • server.rewriteBasePath: false
  • server.basePath: "/o/portal-search- elasticsearch - xpack -monitoring/ xpack -monitoring-proxy"

• Because you’re using the Monitoring portlet in Liferay DXP as a proxy to Kibana’s UI, if you are using X-Pack Security, you must configure the application server’s startup JVM parameters to recognize a valid truststore and password.

• Navigate to Elasticsearch Home and generate a PKSC#12 certificate from the CA you created when setting up X-Pack security:

./bin/elasticsearch-certutil cert --ca-cert /path/to/ca.crt --ca-key /path/to/ca.key --ip 127.0.0.1 --dns localhost --name localhost --out /path/to/Elasticsearch_Home/config/localhost.p12

NOTE: If the network.host property of the elasticsearch.yml file has been configured, you must use it here.

• Next  use the  keytool  command to generate a  truststore :

keytool -importkeystore -deststorepass liferay -destkeystore /path/to/truststore.jks -srckeystore /path/to/Elasticsearch_Home/config/localhost.p12 -srcstoretype PKCS12 -srcstorepass liferay

• Add the trustore path and password to your application server’s startup JVM parameters. Here are example truststore and path parameters for appending to a Tomcat server’s CATALINA_OPTS:

-Djavax.net.ssl.trustStore=/path/to/truststore.jks -Djavax.net.ssl.trustStorePassword=liferay

Monitoring in Liferay DXP

1. Open the Add menu on a page and choose Widgets

2. Search for monitoring and drag the X-Pack Monitoring widget from the Search category onto the page.

References

https://help.liferay.com/hc/en-us/articles/360017896852-Installing-Liferay-Enterprise-Search-
https://www.elastic.co/guide/en/elasticsearch/reference/6.5/index.html
https://qbox.io/blog/split-brain-problem-elasticsearch