# How to initialize SG using sgctl?

**URL:** <https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393>\
**Category:** Search Guard\
**Created:** [January 18, 2023, 1:26pm UTC](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393 "2023-01-18T13:26:15Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kosmonafft](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/kosmonafft/32/1010_2.png) [@Kosmonafft](https://forum.search-guard.com/u/Kosmonafft)\
**Post date:** [January 18, 2023, 1:26pm UTC](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393/1 "2023-01-18T13:26:15Z")

</div>

Hi,

I am struggeling to find the exact command to initialize my cluster using SG FLX.

I executed `./sgctl.sh connect`, but still have in my logs:

`Not yet initialized (you may need to run sgctl)`

The documentation leads me to here: [Using sgctl | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/sgctl-overview).

Can you help me please?

---

<div class="post-metadata">

**Author:** ![Kosmonafft](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/kosmonafft/32/1010_2.png) [@Kosmonafft](https://forum.search-guard.com/u/Kosmonafft)\
**Post date:** [January 18, 2023, 1:43pm UTC](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393/2 "2023-01-18T13:43:16Z")

</div>

Also I see logs like:

`.searchguard_authtokens is not yet ready`

basically for all .`searchguard*` indices I guess.

I am implementing a hot warm architecture of 3 master, 2 hot, 2 warm nodes. Do I need to disable automatic sharding and configure replica shards manually for every internal search guard index?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\
**Post date:** [January 18, 2023, 2:13pm UTC](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393/3 "2023-01-18T14:13:54Z")

</div>

@Kosmonafft As per Search Guard documentation you need to upload the configuration to initialize all .searchguard indices.

> **[Search Guard Installation](https://docs.search-guard.com/latest/search-guard-installation)**
>
> Step by step instructions for setting up Search Guard on a new or existing Elastcsearch cluster.

> **[Basic Usage](https://docs.search-guard.com/latest/sgctl)**
>
> Use the powerful and easy-to-use sgctl command line tool to manage and configure everything in Search Guard.

---

<div class="post-metadata">

**Author:** ![Kosmonafft](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/kosmonafft/32/1010_2.png) [@Kosmonafft](https://forum.search-guard.com/u/Kosmonafft)\
**Post date:** [January 20, 2023, 10:10am UTC](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393/4 "2023-01-20T10:10:44Z")

</div>

Hi @pablo . Thanks for the response. Got it.

What about using SG in a hot/warm architecture? Seems like my cluster does not start because of unassigned shards for a range of searchguard indices. How can proceed here? Adjust the shards manually for every single searchguard index or is there another way of dealing with that?

Thanks

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\
**Post date:** [January 23, 2023, 2:59pm UTC](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393/5 "2023-01-23T14:59:56Z")

</div>

@Kosmonafft Could you share your current shards and indices? ( \_cat/indices, \_cat/shards)

---

<div class="post-metadata">

**Author:** ![Kosmonafft](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/kosmonafft/32/1010_2.png) [@Kosmonafft](https://forum.search-guard.com/u/Kosmonafft)\
**Post date:** [January 24, 2023, 2:17pm UTC](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393/6 "2023-01-24T14:17:22Z")

</div>

When I execute:

`curl https://elastic1.node.com:9200/_cat/indices -k`

I got:

`Search Guard not initialized (SG11)`

and in the logs I see:

```auto
[2023-01-24T14:12:10,929][ERROR][c.f.s.c.ProtectedConfigIndexService] [elastic1.node.com] Index .signals_watches is not yet ready:
{"cluster_name":"es-cluster","status":"red","timed_out":true,"number_of_nodes":7,"number_of_data_nodes":4,"active_primary_shards":0,"active_shards":0,"relocating_shards":0,"initializing_shards":0,"unassigned_shards":10,"delayed_unassigned_shards":0,"number_of_pending_tasks":0,"number_of_in_flight_fetch":0,"task_max_waiting_in_queue_millis":0,"active_shards_percent_as_number":13.793103448275861}
Retrying.
[2023-01-24T14:13:41,245][ERROR][c.f.s.c.ProtectedConfigIndexService] [elastic1.node.com] Index .searchguard_sessions is not yet ready:
{"cluster_name":"es-cluster","status":"red","timed_out":true,"number_of_nodes":7,"number_of_data_nodes":4,"active_primary_shards":0,"active_shards":0,"relocating_shards":0,"initializing_shards":0,"unassigned_shards":2,"delayed_unassigned_shards":0,"number_of_pending_tasks":0,"number_of_in_flight_fetch":0,"task_max_waiting_in_queue_millis":0,"active_shards_percent_as_number":13.793103448275861}
Retrying.
[2023-01-24T14:14:11,333][ERROR][c.f.s.c.ProtectedConfigIndexService] [elastic1.node.com] Index .searchguard_resource_owner is not yet ready:
{"cluster_name":"es-cluster","status":"red","timed_out":true,"number_of_nodes":7,"number_of_data_nodes":4,"active_primary_shards":0,"active_shards":0,"relocating_shards":0,"initializing_shards":0,"unassigned_shards":2,"delayed_unassigned_shards":0,"number_of_pending_tasks":0,"number_of_in_flight_fetch":0,"task_max_waiting_in_queue_millis":0,"active_shards_percent_as_number":13.793103448275861}

```

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\
**Post date:** [January 24, 2023, 2:54pm UTC](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393/7 "2023-01-24T14:54:28Z")

</div>

@Kosmonafft How did you start your cluster? Did data nodes start first?  
Is this a new cluster?

Please share elasticsearch.yml files.

---

<div class="post-metadata">

**Author:** ![Kosmonafft](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/kosmonafft/32/1010_2.png) [@Kosmonafft](https://forum.search-guard.com/u/Kosmonafft)\
**Post date:** [January 24, 2023, 3:30pm UTC](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393/8 "2023-01-24T15:30:13Z")

</div>

I guess I found what have caused the issue:

on my hot and warm data nodes I had configured:

`node.roles: [data_hot, ingest]` and `node.roles: [data_warm]`

I learned that I have missed that `data_content` role must also be added to the data nodes. So correct configuration is:

`node.roles: [data_hot, data_content, ingest]` and `node.roles: [data_warm, data_content]`

**After applying these changes SG could be successfully initialized and the cluster runs.**

However, since I have 2 hot nodes and 2 warm nodes:

- How search guard will behave? how many shards it will create?
- How should I configure the sharding for the internal indices? Should I always keep them according to the number of my hot nodes?
- Should I apply the manual sharding configuration on every internal search guard index?
- Or should I not bother with that at all?

Thanks for any advice

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\
**Post date:** [January 24, 2023, 3:48pm UTC](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393/9 "2023-01-24T15:48:28Z")

</div>

@Kosmonafft The data\_content is the default tier preference when creating any index in the Elasticsearch cluster.

> **[Data tiers | Elasticsearch Guide \[8.6\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/data-tiers.html#data-tier-allocation)**

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\
**Post date:** [January 24, 2023, 3:52pm UTC](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393/10 "2023-01-24T15:52:10Z")

</div>

@Kosmonafft In regards to your questions, please find some more information in regard to SearchGuard indices and cluster configuration.

> **[Configuration index maintenance](https://docs.search-guard.com/latest/search-guard-index-maintenance#disable-auto-expand-replicas-of-the-search-guard-index)**
>
> Search Guard stores its configuration in an Elasticsearch index. This allows for configuration hot-reloading

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [February 14, 2023, 3:52pm UTC](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393/11 "2023-02-14T15:52:54Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.