---
title: "Search Guard"
url: "https://axoflow.com/docs/axosyslog-core/4.28/chapter-destinations/configuring-destinations-elasticsearch2/syslog-ng-elasticsearch2-search-guard/"
last_modified: "2024-11-20T12:51:45+01:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/4.28/llms.txt).

# Search Guard

## Purpose:

Version 3.9 and later supports the [Search Guard](https://search-guard.com/) Elasticsearch plugin (version 2.4.1.16 and newer) to encrypt and authenticate your connections to from AxoSyslog to Elasticsearch 2 and newer. To configure AxoSyslog to send messages to an Elasticsearch 2.x cluster that uses Search Guard, complete the following steps.

To connect to an Elasticsearch 5.x or newer cluster, use HTTPS mode.

## Steps:

1. Install the Search Guard plugin on your AxoSyslog host. Use the plugin version that matches the version of your Elasticsearch installation.

   ```shell
   sudo /usr/share/elasticsearch/bin/plugin install -b com.floragunn/search-guard-ssl/<version-number-of-the-plugin>
   ```
2. Create a certificate for your AxoSyslog host, and add the certificate to the `SYSLOG_NG-NODE_NAME-keystore.jks` file. You can configure the location of this file in the Elasticsearch resources file under the `path.conf` parameter. For details, see the [Search Guard documentation](https://docs.search-guard.com/latest/configuring-tls#using-keystore-and-truststore-files).
3. Configure an Elasticsearch destination in AxoSyslog that uses the `searchguard` client mode. For example:

   ```shell
       destination d_elasticsearch {
         elasticsearch2(
           client-lib-dir("/usr/share/elasticsearch/plugins/search-guard-ssl/*.jar:/usr/share/elasticsearch/lib")
           index("syslog-${YEAR}.${MONTH}.${DAY}")
           type("syslog")
           time-zone("UTC")
           client-mode("searchguard")
           resource("/etc/syslog-ng/elasticsearch.yml")
         );
       };
   ```
4. Configure the Elasticsearch resource file (for example, `/etc/syslog-ng/elasticsearch.yml`) as needed for your environment. Note the `searchguard:` section.

   ```shell
       cluster:
         name: elasticsearch
       discovery:
         zen:
           ping:
             unicast:
               hosts:
                 - <ip-address-of-the-elasticsearch-server>
       node:
         name: syslog_ng_secure
         data; false
         master: false
       path:
         home: /etc/syslog-ng
         conf: /etc/syslog-ng
       searchguard:
         ssl:
           transport:
             keystore_filepath: syslog_ng-keystore.jks
             keystore_password: changeit
             truststore_filepath: truststore.jks
             truststore_password: changeit
             enforce_hostname_verification: true
   ```

Last modified November 20, 2024: [Broken link updates (5644de9a)](https://github.com/axoflow/axosyslog-core-docs/commit/5644de9a8069da37e3bebf0ed5a4e73cf958a66b)