OpenSearch Cluster Installation

Preparation

Do this on each cluster node (unless otherwise noted

Create Opensearch User

Debian/Ubuntu:

sudo adduser --system -uid 968 --shell /bin/bash --gecos 'OpenSearch User'  --group  --disabled-password --home /opt/opensearch opensearch

Fedora:

sudo adduser --system --uid 968 --shell /bin/bash --home-dir /opt/opensearch -m opensearch

Then add your normal user to the group:

sudo usermod -aG opensearch ewilliam

Set vm.max_map_count

Create /etc/sysctl.d/vm.maxmap_count (as root) and add the following line:

vm.max_map_count=262144

Run the following commands as root:

sysctl --system

Install Java 11 (optional)

The OpenSearch distro comes with Java 8 integrated into the packages. If this won't work for some reason, run the following commands as root:

apt update
apt install -y openjdk-11-jdk

Install Opensearch Tarball

Change to the opensearch user (from root):

su - opensearch
cd ~

Run the following commands as opensearch user (from the opensearch home directory /opt/opensearch):

wget https://artifacts.opensearch.org/releases/bundle/opensearch/1.0.0/opensearch-1.0.0-linux-x64.tar.gz
tar -xvzf opensearch-1.0.0-linux-x64.tar.gz
rm opensearch-1.0.0-linux-x64.tar.gz

Create the systemd unit file (since the tarball install doesn't provide one:

Configure OpenSearch

Configuration varies depending on the type of node, but these are the places that need to be touched.

jvm.options

Set the heap size:

• 4G for master and cold data nodes
• 16G for hot data nodes

In general, it shouldn't be more than 50% of available memory

config.yml

On the initial master node only, configure /opt/opensearch/opensearch-1.1.0/plugins/opensearch-security/securityconfig/config.yml to allow certificate authentication. Enable both http and transport under clientcert_auth_domain

opensearch.yml:

• cluster.name
• node.name- can be the hostname, but doesn't have to be
• path.data - data nodes only -- must be unique to the node
• path.logs - must be unique to the node
• network.host -- host's IP where all traffic will be received
• http.port -- leave it as the default (9200) but uncomment it to lock it in
• discovery.seed_hosts -- IP addresses of all the masters (same for all nodes)
• cluster.initial_master_nodes -- put the master node names here (not the hostnames) -- same for all nodes
• node.[master|data|ingest|remote] - set the type of the node (specify all four)
• node.attr.temp - (data nodes only) defines data storage tiers (hot/warm/cold)

Certificates

Copy the following certificates/keys from /work/osdata/certs to the config directory:

• WilliamsNetCA.pem
• <hostname>.crt
• <hostname>-pkcs8.key
• admin.crt
• admin-pkcs8.crt