Elasticsearch Access Log

Question

I'm trying to track down who is issuing queries to an ElasticSearch Cluster. Elastic doesn't appear to have an access log.

Is there a place where I can find out which IP is hitting the cluster?

Answer 1

Elasticsearch doesn't provide any security out of the box, and that is on purpose and by design.

So you have a couple solutions out there:

1. Don't let your ES cluster exposed to the open world, but put it behind a firewall (i.e. whitelist the hosts that can access ports 9200/9300 on your nodes)

2. Look into the Shield plugin for Elasticsearch in order to secure your environment.

3. Put an nginx server in front of your cluster to act as a reverse proxy.

4. Add simple basic authentication with either the elasticsearch-jetty plugin or simply the elasticsearch-http-basic plugin, which also allowws you to whitelist the client IPs that are allowed to access your cluster.

If you want to have access logs, you need either 2 or 3, but all solutions above will allow you to secure your ES environment.