# How to Configure SearchGuard on Elasticsearch Cluster

**URL:** <https://forum.search-guard.com/t/how-to-configure-searchguard-on-elasticsearch-cluster/1309>\
**Category:** Search Guard\
**Created:** [January 30, 2019, 9:39pm UTC](https://forum.search-guard.com/t/how-to-configure-searchguard-on-elasticsearch-cluster/1309 "2019-01-30T21:39:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![krishna85](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/krishna85/32/459_2.png) [@krishna85](https://forum.search-guard.com/u/krishna85)\
**Post date:** [January 30, 2019, 9:39pm UTC](https://forum.search-guard.com/t/how-to-configure-searchguard-on-elasticsearch-cluster/1309/1 "2019-01-30T21:39:12Z")

</div>

Hi,

I have installed Elasticsearch, kibana and SearchGuard version: 6.5.4 on 4 node cluster.

i have created 2 keystore and truststore jks one for nodes and one for admin using some offline tool. (if my understanding is correct).

placed all the 4 certificates on all 4 nodes under /etc/elasticsearch/ssl directory

-rw-r-----. 1 root elasticsearch 1573 Jan 30 17:55 elastic.server.truststore.jks

-rw-r-----. 1 root elasticsearch 6773 Jan 30 17:55 elastic.server.keystore.jks

-rw-r-----. 1 root elasticsearch 1573 Jan 30 17:55 elastic.client.truststore.jks

-rw-r-----. 1 root elasticsearch 6773 Jan 30 17:55 elastic.client.keystore.jks

> **···**
>
> \*\*
> 
> **Here is the elasticsearch.yml configuration:**
> 
> _searchguard.ssl.transport.keystore\_filepath: /etc/elasticsearch/ssl/elastic.server.keystore.jks_
> 
> _searchguard.ssl.transport.keystore\_password: changeme_
> 
> _searchguard.ssl.transport.truststore\_filepath: /etc/elasticsearch/ssl/elastic.server.truststore.jks_
> 
> _searchguard.ssl.transport.truststore\_password: changeme_
> 
> _searchguard.ssl.transport.enforce\_hostname\_verification: false_
> 
> _searchguard.ssl.http.enabled: true_
> 
> _searchguard.ssl.http.keystore\_filepath: /etc/elasticsearch/ssl/elastic.server.keystore.jks_
> 
> _searchguard.ssl.http.keystore\_password: changeme_
> 
> _searchguard.ssl.http.truststore\_filepath: /etc/elasticsearch/ssl/elastic.server.truststore.jks_
> 
> _searchguard.ssl.http.truststore\_password: changeme_
> 
> _searchguard.nodes\_dn:_
> 
> _- [CN=elasticnonprod-0.vpc.example.net](http://CN=elasticnonprod-0.vpc.example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> _- CN=elasticnonprod-1.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> _- CN=elasticnonprod-2.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> _- CN=elasticnonprod-3.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> _searchguard.authcz.admin\_dn:_
> 
> _- CN=nonprod-elastic-client.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> what ever i have provided in admin section is it correct?, how does it work, i have client keys placed in ssl folder are those going to be used if i want to access through admin?
> 
> _ **searchguard.authcz.admin\_dn:** _
> 
> _**- CN=nonprod-elastic-client.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example**_\*,DC=net\*\*\*
> 
> _What are the changes needs to be done from Kibana to access Elasticsearch, do i need to please admin/client keystore and trustore in kibana server and access it?_
> 
> _i have multiple sources to get logs into Elasticsearch like Kubernetes, Nginx, Kafka and so on…, every where do i need to place client keystore and trustore to access elasticsearch to push logs?_

---

<div class="post-metadata">

**Author:** ![Kasinaat\_Selvi\_Sukesh](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/kasinaat_selvi_sukesh/32/500_2.png) [@Kasinaat\_Selvi\_Sukesh](https://forum.search-guard.com/u/Kasinaat_Selvi_Sukesh)\
**Post date:** [January 31, 2019, 9:07am UTC](https://forum.search-guard.com/t/how-to-configure-searchguard-on-elasticsearch-cluster/1309/2 "2019-01-31T09:07:59Z")

</div>

The filepath that you have mentioned should be relative to the config folder in elasticsearch

> _searchguard.ssl.transport.keystore\_filepath: /etc/elasticsearch/ssl/elastic.server.keystore.jks_

So the above should be like

> _searchguard.ssl.transport.keystore\_filepath: …/ssl/elastic.server.keystore.jks_

In all places where you mention certificates It should be relative path to config folder

> **···**
>
> On Thursday, January 31, 2019 at 3:09:12 AM UTC+5:30, Krishna G wrote:
> 
> > Hi,
> 
> > 
> 
> > I have installed Elasticsearch, kibana and SearchGuard version: 6.5.4 on 4 node cluster.
> 
> > 
> 
> > i have created 2 keystore and truststore jks one for nodes and one for admin using some offline tool. (if my understanding is correct).
> 
> > 
> 
> > placed all the 4 certificates on all 4 nodes under /etc/elasticsearch/ssl directory
> 
> > 
> 
> > -rw-r-----. 1 root elasticsearch 1573 Jan 30 17:55 elastic.server.truststore.jks
> 
> > -rw-r-----. 1 root elasticsearch 6773 Jan 30 17:55 elastic.server.keystore.jks
> 
> > -rw-r-----. 1 root elasticsearch 1573 Jan 30 17:55 elastic.client.truststore.jks
> 
> > -rw-r-----. 1 root elasticsearch 6773 Jan 30 17:55 elastic.client.keystore.jks
> 
> > \*\*
> 
> > 
> 
> > **Here is the elasticsearch.yml configuration:**
> 
> > 
> 
> > _searchguard.ssl.transport.keystore\_filepath: /etc/elasticsearch/ssl/elastic.server.keystore.jks_
> 
> > _searchguard.ssl.transport.keystore\_password: changeme_
> 
> > _searchguard.ssl.transport.truststore\_filepath: /etc/elasticsearch/ssl/elastic.server.truststore.jks_
> 
> > _searchguard.ssl.transport.truststore\_password: changeme_
> 
> > _searchguard.ssl.transport.enforce\_hostname\_verification: false_
> 
> > _searchguard.ssl.http.enabled: true_
> 
> > _searchguard.ssl.http.keystore\_filepath: /etc/elasticsearch/ssl/elastic.server.keystore.jks_
> 
> > _searchguard.ssl.http.keystore\_password: changeme_
> 
> > _searchguard.ssl.http.truststore\_filepath: /etc/elasticsearch/ssl/elastic.server.truststore.jks_
> 
> > _searchguard.ssl.http.truststore\_password: changeme_
> 
> > _searchguard.nodes\_dn:_
> 
> > _- CN=[elasticnonprod-0.vpc.example.net](http://elasticnonprod-0.vpc.example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> > _- CN=elasticnonprod-1.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> > _- CN=elasticnonprod-2.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> > _- CN=elasticnonprod-3.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> > _searchguard.authcz.admin\_dn:_
> 
> > _- CN=nonprod-elastic-client.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> > 
> 
> > what ever i have provided in admin section is it correct?, how does it work, i have client keys placed in ssl folder are those going to be used if i want to access through admin?
> 
> > 
> 
> > _ **searchguard.authcz.admin\_dn:** _
> 
> > _**- CN=nonprod-elastic-client.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example**_\*,DC=net\*\*\*
> 
> > _What are the changes needs to be done from Kibana to access Elasticsearch, do i need to please admin/client keystore and trustore in kibana server and access it?_
> 
> > _i have multiple sources to get logs into Elasticsearch like Kubernetes, Nginx, Kafka and so on…, every where do i need to place client keystore and trustore to access elasticsearch to push logs?_
> 
> >

---

<div class="post-metadata">

**Author:** ![Vijay](https://avatars.discourse-cdn.com/v4/letter/v/4bbf92/32.png) [@Vijay](https://forum.search-guard.com/u/Vijay)\
**Post date:** [March 7, 2019, 5:44pm UTC](https://forum.search-guard.com/t/how-to-configure-searchguard-on-elasticsearch-cluster/1309/3 "2019-03-07T17:44:03Z")

</div>

Thanks that works.

> **···**
>
> On Thursday, January 31, 2019 at 1:07:59 AM UTC-8, Kasinaat Selvi Sukesh wrote:
> 
> > The filepath that you have mentioned should be relative to the config folder in elasticsearch
> > 
> > > _searchguard.ssl.transport.keystore\_filepath: /etc/elasticsearch/ssl/elastic.server.keystore.jks_
> 
> > So the above should be like
> > 
> > > _searchguard.ssl.transport.keystore\_filepath: …/ssl/elastic.server.keystore.jks_
> 
> > In all places where you mention certificates It should be relative path to config folder
> 
> > 
> 
> > 
> 
> > On Thursday, January 31, 2019 at 3:09:12 AM UTC+5:30, Krishna G wrote:
> > 
> > > Hi,
> 
> > >
> 
> > > I have installed Elasticsearch, kibana and SearchGuard version: 6.5.4 on 4 node cluster.
> 
> > >
> 
> > > i have created 2 keystore and truststore jks one for nodes and one for admin using some offline tool. (if my understanding is correct).
> 
> > >
> 
> > > placed all the 4 certificates on all 4 nodes under /etc/elasticsearch/ssl directory
> 
> > >
> 
> > > -rw-r-----. 1 root elasticsearch 1573 Jan 30 17:55 elastic.server.truststore.jks
> 
> > > -rw-r-----. 1 root elasticsearch 6773 Jan 30 17:55 elastic.server.keystore.jks
> 
> > > -rw-r-----. 1 root elasticsearch 1573 Jan 30 17:55 elastic.client.truststore.jks
> 
> > > -rw-r-----. 1 root elasticsearch 6773 Jan 30 17:55 elastic.client.keystore.jks
> 
> > > \*\*
> 
> > >
> 
> > > **Here is the elasticsearch.yml configuration:**
> 
> > >
> 
> > > _searchguard.ssl.transport.keystore\_filepath: /etc/elasticsearch/ssl/elastic.server.keystore.jks_
> 
> > > _searchguard.ssl.transport.keystore\_password: changeme_
> 
> > > _searchguard.ssl.transport.truststore\_filepath: /etc/elasticsearch/ssl/elastic.server.truststore.jks_
> 
> > > _searchguard.ssl.transport.truststore\_password: changeme_
> 
> > > _searchguard.ssl.transport.enforce\_hostname\_verification: false_
> 
> > > _searchguard.ssl.http.enabled: true_
> 
> > > _searchguard.ssl.http.keystore\_filepath: /etc/elasticsearch/ssl/elastic.server.keystore.jks_
> 
> > > _searchguard.ssl.http.keystore\_password: changeme_
> 
> > > _searchguard.ssl.http.truststore\_filepath: /etc/elasticsearch/ssl/elastic.server.truststore.jks_
> 
> > > _searchguard.ssl.http.truststore\_password: changeme_
> 
> > > _searchguard.nodes\_dn:_
> 
> > > _- CN=[elasticnonprod-0.vpc.example.net](http://elasticnonprod-0.vpc.example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> > > _- CN=elasticnonprod-1.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> > > _- CN=elasticnonprod-2.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> > > _- CN=elasticnonprod-3.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> > > _searchguard.authcz.admin\_dn:_
> 
> > > _- CN=nonprod-elastic-client.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example,DC=net_
> 
> > >
> 
> > > what ever i have provided in admin section is it correct?, how does it work, i have client keys placed in ssl folder are those going to be used if i want to access through admin?
> 
> > >
> 
> > > _ **searchguard.authcz.admin\_dn:** _
> 
> > > _**- CN=nonprod-elastic-client.vpc. [example.net](http://example.net),OU=Corp,O= example, Inc.,DC= example**_\*,DC=net\*\*\*
> 
> > > _What are the changes needs to be done from Kibana to access Elasticsearch, do i need to please admin/client keystore and trustore in kibana server and access it?_
> 
> > > _i have multiple sources to get logs into Elasticsearch like Kubernetes, Nginx, Kafka and so on…, every where do i need to place client keystore and trustore to access elasticsearch to push logs?_
> 
> > >