OpenSearch Migration between Servers

Introduction

The purpose of this topic is to serve as a guide to perform a migration from an OpenSearch server to another OpenSearch server, in the most efficient and simple way possible, copying absolutely everything on the source server to be imported into the target server.

Important points:

Default credentials applied in the automated installation via the online installation script of OpenSearch for Pandora FMS are indicated (admin:P4nd0r4!FMS).
The name given to the snapshot in the guide is migration, any other can be indicated for better identification if necessary.

Steps to follow

Prerequisites

The OpenSearch backup folders must be declared on the servers.

In the /etc/opensearch/opensearch.yml file, on both servers, add this line:

path.repo: ["/var/backups/opensearch"]

Restart the OpenSearch service on both servers with the following command:

sudo systemctl restart opensearch

Phase 1

On the source server, prepare the folder and permissions to host the backup:

sudo mkdir -p /var/backups/opensearch
sudo rm -rf /var/backups/opensearch/*
sudo chown -R opensearch:opensearch /var/backups/opensearch/
sudo chmod -R 775 /var/backups/opensearch/

An rm command is executed for security, in case it existed previously (for whatever reason), starting the process with a clean directory.

Register the repository in OpenSearch. If one was previously created, it is deleted and created again:

# Just in case, we’ll delete the old record from the memory
curl \
  -X DELETE \
  "https://localhost:9200/_snapshot/migration" -u 'admin:P4nd0r4!FMS' \
  -k
 
# We checked out the repository into the local folder
curl \
  -X PUT \
  "https://localhost:9200/_snapshot/migration" \
  -u 'admin:P4nd0r4!FMS' \
  -k \
  -H "Content-Type: application/json" \
  -d '{
    "type": "fs",
    "settings": {
      "location": "/var/backups/opensearch",
      "compress": true
    }
  }'

In this case, the repository is called migration, as indicated at the beginning of the document.

The snapshot is now generated with everything:

curl \
  -X PUT \
  "https://localhost:9200/_snapshot/migration/migration?wait_for_completion=true" \
  -u 'admin:P4nd0r4!FMS' \
  -k \
  -H "Content-Type: application/json" \
  -d '{
     "indices": "*",
     "include_global_state": true
  }'

Since wait_for_completion=true is indicated, the terminal will be stopped and locked until it finishes.

Upon completion, the obtained files can be compressed and sent to the target server:

# 1. Check actual size
sudo du -sh /var/backups/opensearch/
 
# 2. Compress into /tmp
sudo tar -czvf /tmp/opensearch_migration.tar.gz -C /var/backups/opensearch .
 
# 3. Send to the destination server (replace ‘user’ and the Target Server IP address)
scp /tmp/opensearch_migration.tar.gz user@TARGET_SERVER_IP_ADDRESS:/tmp/

Alternatively, any other preferred file transfer protocol can be used.

Phase 2

If Pandora FMS is running and connected to the target OpenSearch, it must be stopped:

sudo systemctl stop pandora_server

Next, unzip the backup and apply the appropriate permissions. If there is already something in the OpenSearch backup folder on the target server (for whatever reason), that content must be deleted first:

sudo mkdir -p /var/backups/opensearch
sudo rm -rf /var/backups/opensearch/* # Erase, just in case
sudo tar -xzvf /tmp/opensearch_migration.tar.gz -C /var/backups/opensearch/
 
sudo chown -R opensearch:opensearch /var/backups/opensearch/
sudo chmod -R 755 /var/backups/opensearch/

Next, we will register the repository on the target OpenSearch server:

curl \
  -X PUT \
  "https://localhost:9200/_snapshot/migration" \
  -u 'admin:P4nd0r4!FMS' \
  -k \
  -H "Content-Type: application/json" \
  -d '{
    "type": "fs",
    "settings": {
      "location": "/var/backups/opensearch",
      "compress": true
    }
  }'

And clear the default indexes to avoid any problem:

curl \
  -X DELETE \
  "https://localhost:9200/pandorafms-*,"\
  ".opensearch-observability,"\
  ".plugins-ml-config,"\
  "security-auditlog-*,"\
  "top_queries-*,"\
  ".opensearch-sap-*"\
  --cert /etc/opensearch/admin.pem \
  --key /etc/opensearch/admin-key.pem \
  -k

Finally, the copy made is imported into the new server:

curl \
  -X POST \
  "https://localhost:9200/_snapshot/migration/migration/_restore" \
  --cert /etc/opensearch/admin.pem \
  --key /etc/opensearch/admin-key.pem \
  -k \
  -H "Content-Type: application/json" \
  -d '{
    "indices": "*,-.opendistro_security",
    "include_global_state": true,
    "partial": false
  }'

.opendistro_security is omitted to prevent the security plugin from blocking itself.

You must wait for a response {“accepted”:true}.

Phase 3

Verification:

curl \
  -X GET \
  "https://localhost:9200/_cat/indices?v" \
  --cert /etc/opensearch/admin.pem \
  --key /etc/opensearch/admin-key.pem \
  -k

And restart the PFMS Server:

sudo systemctl start pandora_server

With this process you should have all the logs accessible and visible from the PFMS Web Console connected to the target OpenSearch server.

←Back to Pandora FMS documentation index

Table of Contents