Important: Elasticsearch is a indexing service and data store that stores all the events collected from the Activity Monitors, and enables fast searching for retrieval and reporting purpose. Elasticsearch is a heavy-weight tool and typically requires a DEDICATED server to run.
It is recommended that you install Elasticsearch in a location that is accessible by the Event Manager, Business Website, and Central Permissions Collection/Central Data Classification services with almost equal network latency.
Before installing or moving a service, the File Access Manager Server Installer must be installed on each of the servers involved (for example, in case of a move, on both the server a service is currently on, and the server it will be moved to).
Begin by setting up the Elasticsearch installation configuration on the core services server:
Continue by installing Elasticsearch on the server where you want it to be located:
File Access Manager Scheduled Task Handler service is responsible to poll for the health of Elasticsearch. This service sends out a query to Elasticsearch. In order to report the health of Elasticsearch in the Health Center and the Services Dashboard on the FAM business website, the server hosting the Scheduled Task Handler service should be able to communicate with the server hosting the Elasticsearch service on port 9200.
Services may sometimes need to be moved due to architecture or hardware changes in your environment.
If you have a retention policy and you have purged activities from Elasticsearch or your Elasticsearch server is no longer available and you have installed Elasticsearch again to address the issue, in order bring in all the activities into Elasticsearch for querying and reporting, you will have to reindex Elasticsearch from the File Access Manager database.
All recorded activities are stored in Elasticsearch and the File Access Manager database. The re-index task takes all activities from the database and restores them to Elasticsearch.
To perform a re-index:
This will launch a re-index task. The amount of time it takes for the task to complete depends on the number of events being re-indexed from the database back into Elasticsearch. Contact SailPoint Support if you need further assistance.
Elasticsearch service will not be available in the File Access Manager server installer uninstall options. Follow the below steps if are intending to uninstall Elasticsearch.
BEGIN TRAN
UPDATE [whiteops].[installed_service]
SET
[status_enum_id] = 5, [installed_server_id]=NULL, [version] = NULL
WHERE [id] = 20
COMMIT TRAN
Issue: Elasticsearch Java Heap - Out of Memory
Resolution: Sometimes out of memory (Java heap) issues are encountered when large volumes of events are coming into Elasticsearch. This can be mitigated with the following steps:
Viewing the Elasticsearch dashboard:
Navigate in a browser to the following URIs and log in with the credentials defined during the install:
https://esserver:9200/_cluster/health
https://esserver:9200/_cat/indices/
Both of these URIs provide information related to the health of Elasticsearch. Specifically, look for Green statuses as an indication of health.
In addition, you can have a look at the article below.
Elasticsearch DB Full or Almost There:https://community.sailpoint.com/t5/IdentityIQ-Wiki/Elasticsearch-DB-Full-or-Almost-There/ta-p/75676