Skip to main content

External Elasticsearch suite

spot-suite-external installs the SPOT UI, backend, connector, and services, but no Elasticsearch binary, configuration, user, or service.

Install​

sudo rpm -Uvh spot-suite-external-X.Y.Z-1.el10.x86_64.rpm
# or
sudo dpkg -i spot-suite-external_X.Y.Z_amd64.deb

Confirm that spot-license.service is active and open /setup. Activate the online key or install the offline file before configuring Elasticsearch and SAP. The complete procedure, including renewal, is in Licenses and renewal.

For non-root use spot-suite-external-portable_X.Y.Z_linux_amd64.tar.gz in a new $SPOT_HOME. It contains no Elasticsearch scripts or directories.

Configure now or defer​

/setup never offers embedded mode. Enter and test an HTTPS Elasticsearch destination, or defer it, create the first administrator, and enter limited mode. While deferred, Elasticsearch pending remains visible. Users, configuration, and health stay available; data views are explicitly blocked and data APIs return 503 elastic_not_configured.

Connector topologies​

Setup offers three choices:

  • Connector on this server (local): local service enabled, one writer, and one or more SAP entries sharing its namespace.
  • Connectors on other servers (remote): local service disabled; the backend configures read scopes and waits for standalone data.
  • Local and external connectors (hybrid): combines both models. The local writer binds to one scope; standalone connectors may use that or other scopes.

Configuration can add several Elasticsearch read scopes. Every discovered SAP target binds to exactly one, and a failed cluster does not block the others. A connector still writes to one scope even with N SAP entries; run several instances to split them across clusters. HA and failover are not included.

Use system CAs, an imported CA, or explicitly disable certificate validation. The last option keeps encryption but does not authenticate the server, remains visible, and never permits HTTP or redirects. ILM management starts disabled.

The Configuration assistant supports embedded to external after a cold backup. It tests twice, saves backend and connector, and requires a real ingestion receipt: a canary write with the connector credential and an exact read with the backend credential. Only then does it stop local Elasticsearch. It does not copy historical indices; canary cleanup is best-effort and does not require delete. Returning to embedded requires backup and reinstall; portable requires a new $SPOT_HOME.