Search and analytics#

General information#

Elasticsearch automated service in K2 Cloud allows you to quickly deploy and configure search, analysis, and monitoring of all data types.

Elasticsearch is a distributed search and analytics system that provides a unified data storage for Elastic Stack based solutions: Elasticsearch, Elastic Agent, Beats, Logstash and Kibana. To learn more about Elasticsearch, visit the official website.

Along with Elasticsearch, K2 Cloud supports Kibana service for convenient data management and visualization.

Billing#

The PaaS search and analytics service Elasticsearch is free of charge. Payment is charged for actually consumed billable resources: instances, volumes, Elastic IP addresses, and other resources.

Before you begin#

We advise to preliminarily read the recommendations on how to work with the service in the cloud.

Required privileges#

To be able to work with the search and analysis service, a user needs to have PaaSFullAccess project grants. For instance, such grants are available to administrators in the CloudAdministrators group. If necessary, you can create a separate user, add the user to the project, and either attach the PaaSFullAccess policy to the user or add the user to the group of cloud administrators in this project.

The PaaSFullAccess project grants provide the user with permissions to all PaaS services. To provide permissions to the search and analysis service only, create a policy with the following grants:

  • paas:CreateElasticsearchSnapshotRepository;

  • paas:DeleteElasticsearchSnapshotRepository;

  • paas:DisableElasticsearchSnapshotRepository;

  • paas:EnableElasticsearchSnapshotRepository;

  • paas:ListElasticsearchServicesSuitableForRecovery;

  • paas:ListElasticsearchSnapshotRepositories;

  • paas:CreateLogstashPipeline;

  • paas:DeleteLogstashPipeline;

  • paas:ListLogstashPipelines;

  • paas:ModifyLogstashPipeline;

  • paas:ListServices;

  • paas:ModifyService;

  • paas:DescribeService;

  • paas:ListBackupUsers;

and assign it to the user.

For details, see the IAM documentation on how to create a policy and assign it to the user.

Required resources#

There should be the following resources in the project:

Starting the Elasticsearch service#

Important

The search and analysis service can be launched only in those subnets that have Internet access. To configure such access, you might need to attach an internet gateway to a VPC and create a default route in a route table.

Note

Creating a high-availability service also automatically creates placement groups for every three nodes. For example, in case of a five-node cluster in one availability zone, two placement groups are created, containing three and two nodes, respectively. Should it be a five-node cluster across three availability zones, one placement group is created in each zone, with two groups containing two nodes each, and one group containing only one node. Instances from the same group are deployed on different physical servers, which improves the service availability.

To start the service, go to the Services store or Running Services subsection, select the Elasticsearch service in the Search and analytics tab and click Create.

The service launch procedure comprises the following stages:

  1. Set the required network parameters for an Elasticsearch service:

    Note

    To run the service in the selected VPC, you must first create a subnet in the preferred availability zone (in a configuration with one zone), or one subnet in each availability zone (in a configuration with three zones). In addition, the same volume types must be supported in the availability zones used.

    Note

    The ability to attach network interfaces may be useful, for example, when you need to recreate a search and analytics service. If you delete the service, but do not delete attached network interfaces, you will be able to reuse them for connecting nodes of the new cluster to subnets, where the new cluster will be deployed. Thus, you can keep previous network settings, such as private IP addresses and security groups, rather than configure them again.

    Important

    It is not recommended to create a four-node cluster as otherwise any connectivity loss may lead to quorum loss due to split brain.

    • Cluster configuration where the service will be deployed.

      You can select only configurations with the following number of nodes:

      • one master node (the service without high availability);

      • two master nodes and one arbitrator node;

      • from three to nine master nodes 1.

      1

      We recommend selecting this configuration if the cluster scalability may be required in the future.

    • VPC where the search and analytics service will be deployed.

    • Security groups to control traffic through interfaces of the instances on which the search and analytics service will run.

    • Subnets to which instances with the running service will be attached, or network interfaces through which cluster nodes will be attached to subnets.

      Note

      When selecting subnets, you may specify either one or three subnets in different availability zones. In the former case, the service will be deployed in the same availability zone as the selected subnet.

      When selecting network interfaces for a multi-node configuration, you must specify as many interfaces as there are nodes in the cluster.

      Network interfaces should be evenly distributed across all availability zones where the service will be deployed, if possible. For example, if you plan to create a cluster with five master nodes across three availability zones, you should specify two interfaces in each of two availability zones and one interface in the remaining zone.

    • Internal and/or internet-facing load balancers (for details, see Load balancer management).

      In the DNS name field, you can specify an arbitrary subdomain name in the paas.<region>.web.c2.croc.ru DNS service zone for an Internet-facing load balancer and in the paas.<vpc-id>.internal zone for an internal load balancer. The name may contain Latin letters, digits, and hyphens.

      If the DNS name field is left blank, the name will be specified automatically.

    Click Next to proceed to the next step.

  2. If the cluster configuration three to nine master nodes was selected in the previous step, you can set the number of master nodes in the cluster. However, if network interfaces were specified, the number of instances is fixed and equal to the number of selected network interfaces.

    В блоке Мастер-узел задайте конфигурацию экземпляров, которые будут использоваться в качестве мастер-узлов. Выберите тип экземпляра.

    Note

    The Elasticsearch service performance depends on the node components. We recommend using the Memory Optimized instance type.

    Если на предыдущем шаге была выбрана конфигурация с кластерным арбитром, то в блоке Арбитр задайте конфигурацию экземпляра, который будет использоваться в качестве арбитра. Выберите тип экземпляра.

    Click Next to proceed to the next step.

  3. Set the main service parameters:

    • Name tag — Optional arbitrary description of the service.

    • Service name – any unique name for the caching service.

    • Version.

    • Elasticsearch user password. It can be set manually or generated automatically.

    • Option to install Kibana, a visualization and reporting tool.

      Note

      To configure anonymous access, set a password first.

      Anonymous access to Kibana is allowed by default if the password is not set. Otherwise, you should authenticate with Kibana by default. You can modify this setting and allow anonymous access. In this case, select the role for anonymous access with viewing (viewer) or editing (editor) rights.

    • Whether to enable monitoring — For centralized monitoring of the search and analysis service, deploy the Prometheus-based monitoring service first.

      • Monitoring service – The selection of a monitoring service is only available when the Enable monitoring checkbox is checked.

      • Monitoring labels — Optionally, you can set monitoring labels, which the installed monitoring agents will assign to the collected metrics (for details, see Using labels). Labels can only be set when the Enable monitoring checkbox is selected.

    • Enable logging option – For centralized PaaS service logging, first create a logging service. Once a PaaS service is created, you will be able to install logging agents manually only.

      • Logging service – The selection of a logging service is only available when the Enable logging checkbox is checked.

      • Logging tags – Tags are assigned to logs when the latter are imported by the logging service. They simplify search for the required logs. Tags can only be set when the Enable logging checkbox is checked.

    Click Next to proceed to the next step.

  4. Set the maintenance window (see подробнее). If scheduled maintenance can be performed at any time, leave the Maintenance window option set to Custom. If there are time restrictions when maintenance can be performed, select the interval that is convenient for you. To do so, specify the following parameters:

    • the Scheduled value for the Maintenance window option;

    • a day of the week for the maintenance to take place;

    • hour interval for the maintenance window.

    To set additional parameters or tags for the service, click the respective button to move to the required step — Additional parameters or Add tags. If neither need to be set, click Create to launch the service.

  5. Set the advanced settings, if necessary. Click advanced settings and enter the settings and their values.

    Important

    The specified settings will be a part of the service configuration and, therefore, will affect its operation. Add only the settings you really need.

    To set tags for the service, click Add tags to go to the next step. If no tags are required, click Create to launch the service.

  6. To add a tag, click Add tag and enter tag key and value.

    Note

    If no tags have been set yet, you can add the Name tag by clicking Add Name tag and specifying its value.

    When done, click Create to launch the service.

Important

The service launching process usually takes 5 to 15 minutes.

Modifying service node options#

Add nodes for the service#

If the cluster configuration three to nine master nodes was selected at the Elasticsearch service creation and the cluster has fewer than nine nodes, you can scale it out by adding extra nodes. Scaling is only possible when the service is in the Running state.

Important

For the search and analytics service created before 30.01.2026, cluster scaling is not supported.

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. Find the desired service in the table and click the service ID to go to its page.

  3. Open the Information tab and click Add instances.

  4. In the window that opens, specify the number of instances to be added. If network interfaces were specified at the service creation, you can either create interfaces automatically by pushing Create automatically or specifying the existing ones by pushing Select manually and selecting the interfaces in the specified availability zones.

  5. Click Add to complete the operation.

Modify the instance type for the node#

You can modify the instance type for cluster nodes running the search and analytics service. You can do it only when the service is in the Ready state.

Important

Instance type cannot be modified for nodes with the arbitrator role.

To modify the instance type:

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. Find the desired service in the table and click the service ID to go to its page.

  3. In the Information tab, edit the Instance type field in the configuration section of master node. To do this, click the edit icon and selecting the instance type.

  4. Click to save changes.

Modify data volume parameters#

You can only change the data volume parameters when the service is in the Ready state.

You can configure the data volume size and its performance in IOPS right from the cloud web interface.

Important

You can change IOPS only for a data volume of the type io2.

To change the volume parameters, follow these steps:

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. Find the desired service in the table and click the service ID to go to its page.

  3. In the Information tab, edit the required fields (Data volume size and/or Data volume IOPS) by clicking the edit icon .

    Important

    The new data volume size must exceed the current one.

  4. Click to save changes.

Load balancer management#

For Elasticsearch service, you can create an internal and/or internet-facing load balancer (for details, see load balancers). They automatically distribute incoming requests among fully functional cluster nodes (requests are not sent to the arbitrator if there is any).

Load balancers are created automatically; their parameters and associated resources cannot be modified. To modify the DNS name of an existing load balancer, delete it first and then create a new one. For information about the created load balancers and, in particular, the service addresses, open the Load balancers tab on the service page.

Attention

Load balancer running together with PaaS service can be deleted only on the page of this service.

Important

To run the external load balancer, give external access to service ports, which is denied by default. Add enabling rule for the corresponding ports to the security group that was specified when creating the service. The ports listened by Elasticsearch service can be found in the Information tab on its page.

Create a load balancer#

A search and analytics service load balancer can only be created when the service is in Running status. You can create one internal and one external load balancer per service.

Important

You can create an internal load balancer only if route propagation is enabled in VPC.

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. Find the desired service in the table and click the service ID to go to its page.

  3. Open the Load balancers tab and click Create.

  4. In the window that opens, select a balancer you want to create. If none has been created yet, you can create both internal and internet-facing balancers at once.

    In the DNS name field, you can specify an arbitrary subdomain name in the paas.<region>.web.c2.croc.ru DNS service zone for an Internet-facing load balancer and in the paas.<vpc-id>.internal zone for an internal load balancer. The name may contain Latin letters, digits, and hyphens.

    If the DNS name field is left blank, the name will be specified automatically.

  5. Click Create to complete the action.

Delete load balancer#

Load balancer associated with the service can only be deleted when the service is in Running status.

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. Find the desired service in the table and click the service ID to go to its page.

  3. Open the Load balancers tab and click Delete.

  4. In the window that opens, select a load balancer you want to delete. If two load balancers have been created for the service, you can delete both at the same time.

  5. Click Delete to confirm the action.

Elasticsearch service configuration#

If you have not enabled monitoring and/or logging when creating the search and analysis service, or you want to disable them, you can do it when the service is in the Ready state. You can also change the advanced settings.

Note

To enable monitoring and logging, first deploy Prometheus-based monitoring service and ELK-based logging service.

Important

If an attempt to modify some settings fails, then the service will be reset to default ones.

To set up the Elasticsearch service parameters:

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. Find the desired service in the table and click the service ID to go to its page.

  3. Open the Parameters tab and click Modify.

  4. In the window that opens, you can configure monitoring and logging (or disable them if they are already enabled).

  5. To change the advanced settings, click Additional parameters. Then click Advanced settings and set the new settings and their values.

  6. To save settings, click Modify.

Assigning tags#

Important

Tags are only supported for PaaS services with an fm-cluster-xxxxxxxxxxx ID. If you want to add tag support for the installed services with a UUID as an ID, please contact the support service.

Tags allow you to classify PaaS services by various attributes, such as purpose, owner, etc. Their usage simplifies the management of many similar resources.

To add, modify or delete tag for the search and analytics service:

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. In the resource table, find the service for which you want to assign tags, and click on its ID to go to the service page.

  3. Open the Tags tab.

  4. To add a tag, click Add tag and specify the Key and Value fields.

    To modify a tag, edit the required fields (Value and/or Key) of the respective tag.

    To delete a tag, click the icon next to the tag you no longer need.

    Note

    If no tags have been set earlier, you can add the Name tag by clicking Add Name tag.

  5. Click Apply to save the changes.

Connecting snapshot repository#

Elasticsearch built-in snapshot creation mechanism can backup indexes, data flows, and cluster state. The resultant snapshots can be used to recover data after failure or migrate data between Elasticsearch services. K2 Cloud automates the creation and registration of the snapshot repository for an Elasticsearch service.

Snapshots are stored in object storage buckets. Along with a repository, a directory is created in the bucket and mounted on each node of the Elasticsearch cluster as an s3fs file system. Thus, you can use the same bucket to store snapshots of different services and types. Storing snapshots as files simplifies snapshot sharing: users can upload their own snapshots for service recovery or download existing ones.

Cloud tools can be used only to connect the snapshot repository, so Elasticsearch built-in tools should be used to manage the snapshots. Snapshots can be created using Elasticsearch own API or Snapshot Lifecycle Management (SLM). To be able to recover the index and other data, the index, the snapshot and the cluster version should be compatible with each other.

Add a snapshot repository#

You can create a new snapshot repository or connect an existing one of another service. To add the repository, follow two steps: first create/connect it and then register in Elasticsearch.

The ability to connect the existing repository can be useful for recovering the service or migrating data from one service to another. You can also reuse an existing repository if it is not registered to another service.

Note

If the repository is registered to another service, it can be connected as read-only. Only one repository can be connected to a service, so disconnect the repository after data recovery/migration and create a new one if you want to back up the service.

Add a new repository#

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. Find the desired service in the table and click the service ID to go to its page.

  3. Open the Snapshot repositories tab and click Create.

  4. In the window that opens, set the following parameters (the Existing repository option should be disabled):

    • The bucket where the snapshot repository will be created.

    • User with PaaSBackupUser privileges; backups will be written to the bucket under this user.

    • The directory that will be mounted as the repository.

  5. Click Add to create the repository.

  6. Wait until the service status changes to Running and enable Repository registration.

Add a registered repository#

You can connect a registered repository to another service only as a read-only repository.

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. Find the desired service in the table and click the service ID to go to its page.

  3. Open the Snapshot repositories tab and click Create.

  4. In the window that opens, select the Existing repository checkbox and in the Recovery service field select the service, whose storage you want to connect.

  5. Click Add to create the repository.

  6. Wait until the service status changes to Running and enable Repository registration.

Add an unregistered repository#

The process of connecting an unregistered repository is similar to creating a new one. The difference is that in this case, you have to specify an existing directory previously used as the snapshot repository.

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. Find the desired service in the table and click the service ID to go to its page.

  3. Open the Snapshot repositories tab and click Create.

  4. In the window that opens, set the following parameters (the Existing repository option should be disabled):

    • The bucket where the snapshot repository will be created.

    • User with PaaSBackupUser privileges; backups will be written to the bucket under this user.

    • The directory previously used as the repository.

  5. Click Add to create the repository.

  6. Wait until the service status changes to Running and enable Repository registration.

Disconnect a snapshot repository#

Disconnect the repository in the reverse order: first unregister the repository in the service, and then remove it. The file system is unmounted, but the snapshot directory is not deleted.

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. Find the desired service in the table and click the service ID to go to its page.

  3. Open the Snapshot repositories tab and disable Repository registration.

  4. Wait until the service status changes to Running and click Delete.

  5. In the window that opens, confirm the deletion.

Service start and stop#

You can stop the search and analytics service, if you don’t need it, and start it when necessary, thus saving money on computing resources, because only attached volumes are billed when the service is stopped.

You can also restart the service in case of an error, and synchronize the service status with those of the instances where it is installed.

Stop service#

The service can be stopped when it is in the Running or Error state.

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. In the resource table, find the service you want to stop and click the shutdown icon in the Actions field. Alternatively, click the service ID to go to its page and then click Stop in the Information tab.

  3. In the dialog window, confirm the action.

Restart the service#

Note

You can only restart services with the environment version 3.6 or higher. You can find out the current version of the environment in the Information tab on the service page.

The service can be restarted when it is in the Running or Error state.

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. In the resource table, find the service you want to restart and click the restart icon in the Actions field. Alternatively, click the service ID to go to its page and then click Restart in the Information tab.

  3. In the dialog window, confirm the action.

Synchronize the service with instances#

Synchronization allows you to match the states of the service and the instances on which it is installed, when instances were manually started after the service was stopped. It can also be used to match the states if an error occurred when stopping, starting, or restarting the service and instances had to be manually stopped/started.

Attention

Synchronization is not possible if the error cannot be eliminated (the error status can be viewed, for example, using the DescribeService method).

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. In the resource table, find the service you want to synchronize and click the synchronization icon in the Actions field. Alternatively, click the service ID to go to its page and then click Synchronize with confirmation in the Information tab.

  3. In the dialog window, confirm the action.

Start the service#

You can only start the service, when it is in the Stopped state.

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. In the resource table, find the service you want to start and click the start icon in the Actions field. Alternatively, click the service ID to go to its page and then click Start in the Information tab.

  3. In the dialog window, confirm the action.

Configuring the maintenance window#

During scheduled maintenance, critical security patches and other important updates are installed.

Attention

During maintenance, operations with the service, including its deletion, are not available, but the service itself will continue to operate. In some cases, it may be necessary to stop and restart the cluster nodes.

Maintenance is carried out strictly during a preset time period (if a maintenance window is specified). All actions of K2 Cloud specialists during maintenance are logged.

Note

You can modify the maintenance window settings when the service is in the Running state only.

To modify the maintenance window settings:

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. Find the desired service in the table and click the service ID to go to its page.

  3. In the Maintenance tab, click Set up.

  4. In the window that opens, specify the maintenance interval that is convenient for you. To do so, select the following parameters:

    • the Scheduled value for the Maintenance window option;

    • a day of the week for the maintenance to take place;

    • hour interval for the maintenance window.

    Or select the Custom value for the Maintenance window option, if maintenance can be performed at any time.

  5. Click Save to modify the maintenance window.

Viewing metrics#

For the logging service, the following metrics are available:

Metrics

Description

elasticsearch_cluster_health_unassigned_shards

Number of unassigned shards in cluster

elasticsearch_indices_search_query_total

Total number of search queries

elasticsearch_indices_segments_count

Number of indices segments

elasticsearch_indices_segments_terms_memory_in_bytes

Memory used for terms in index segments

elasticsearch_indices_translog_size_in_bytes

Current size of transaction log

elasticsearch_jvm_memory_committed_bytes

Committed JVM memory

elasticsearch_jvm_memory_max_bytes

Maximum JVM memory available

elasticsearch_scrape_success

Indicates whether metrics were scraped successfully

elasticsearch_thread_pool_active_count

Number of active threads in thread pools

elasticsearch_thread_pool_queue_count

Number of queued jobs in thread pools

elasticsearch_thread_pool_rejected_count

Number of rejected jobs in thread pools

To view the metrics of a specific service:

  1. Go to PaaS Running services and open the Search and analytics tab.

  2. Find the desired service in the table and click the service ID to go to its page.

  3. Open the Monitoring tab and select:

    • metrics,

    • instance to collect metric from.

    Note

    Instances available for a particular metric depend on their role. For certain metrics, there can be additional selectors apart from instance choice.

    Go to Display parameters to set the period the metric graph covers, statistics, and metric calculation interval. To automatically refresh the graph, enable Auto-refresh; to refresh it manually, click Refresh.

Deleting an Elasticsearch service#

Deleting the Elasticsearch service deletes all instances, volumes and placement groups created with it.

You can delete the service using one of the following methods.

  1. Go to the section PaaS Running services.

  2. Open the Search and analytics tab.

  3. Find the service in the table and click on the icon .

  1. Go to the section PaaS Running services.

  2. Open the Search and analytics tab.

  3. Find the service in the table and go to the service page.

  4. Click :Delete in the Information tab.