Access to port 8000, Search Head Clustering

[JacquesJessen]

When I use the template to create a distributed deployment and enable Search Head clustering, I run into a couple of issues that seem related to the security groups setup for port 8000. Neither situation manifests itself when dealing with a single Search Head.

First, while my network CIDR (##.0.0.0/8) should have access to the Search Head ELB on port 8000 via the security group, it does not work - my connection times out. I can see that the ELB can see the SH instances, but I cannot seem to connect. I noticed that the same security group used for the ELB is used for the Search Head instances themselves and wondered if since I am not connecting with them directly, and hence ##.0.0.0/8 is not what the SH is seeing, if I added the VPC CIDR instead (I have used 172.31.0.0/16 or 10.0.0.0/16) if the traffic would pass, and in fact it did resolve the situation but it felt an awkward solution.

Second, when Search Head clustering is employed, you cannot use the Add Data function via the Search Heads. You must connect to any of the Indexers and import the data directly. However, neither of the security groups for the Indexers permitted access to port 8000. Once I added my network CIDR (##.0.0.0/8) and port 8000 to the security group, I was able to access the web interface and had access to the Add Data function.

[bseenu]

I have resolved this issue by allowing the inbound access to port 8000 from VPC CIDR
and got the elb route the requests to search head clusters

I am happy to submit the PR for this if you guys think this is the right fix for this

-srini

[JacquesJessen]

Srini - That is very much appreciated. Thank you very much for your effort!

…

On Wed, Mar 14, 2018 at 9:03 PM, Srinivas Boga ***@***.***> wrote: I have resolved this issue by allowing the inbound access to port 8000 from VPC CIDR and got the elb route the requests to search head clusters I am happy to submit the PR for this if you guys think this is the right fix for this -srini — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#16 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AbdIm9i24lixEsbXtTiFdJLQl9iLagOSks5teb3lgaJpZM4QhBL0> .

[bseenu]

Created the PR #21

-srini

[sshvans]

@billbartlett Can you comment on it?