Add custom bundles and plugins to your deployment

From the Deployments page, select your deployment.

Narrow the list by name, ID, or choose from several other filters. To further define the list, use a combination of filters.

Within the Deployment configuration JSON find the section:

resources > elasticsearch > plan > elasticsearch

If there is an existing user_plugins section, then add the new plugin there, otherwise add a user_plugins section.

{
...
  "resources": {
    "elasticsearch": [
	 ...
        "plan": {
	 	 ...
          "elasticsearch": {
            ...
            "user_bundles": [
            {
                ....
            } ] ,
            "user_plugins": [
              {
                "url" : "<some static non_expirable url>", 
                "name" : "plugin_name",
                "elasticsearch_version" : "<es_version>" 
              },
              {
                "url": "http://www.MYURL.com/my-custom-plugin.zip",
                "name": "my-custom-plugin",
                "elasticsearch_version": "7.17.1"
              }
            ]
          }

In the advanced configuration editor, update your new Elasticsearch cluster with the custom bundle you have just created. Modify the user_bundles JSON attribute of each Elasticsearch instance type as shown in the following example:

{
...
  "resources": {
    "elasticsearch": [
	 ...
        "plan": {
	 	 ...
          "elasticsearch": {
            ...
            "user_bundles": [
            {
              "name": "ldap-cert",
              "url": "http://www.MYURL.com/ldapcert.zip", 
              "elasticsearch_version": "*"
            }
          ]
        }
        ...

Custom bundles are unzipped in /app/config/BUNDLE_DIRECTORY_STRUCTURE, where BUNDLE_DIRECTORY_STRUCTURE is the directory structure within the bundle ZIP file itself. These file locations are needed in the next step.

$ tree .
.
└── truststore
      └── keystore.ks

In this example, the unzipped keystore file gets placed under /app/config/truststore/keystore.ks.

If your Identity Provider doesn’t publish its SAML metadata at an HTTP URL, or if your Elasticsearch cluster cannot reach that URL, you can upload the SAML metadata as a file.

Prepare the custom JVM trust store:

Create the bundle:

 zip cacerts.zip cacerts 

In the advanced configuration editor, update your Elasticsearch cluster configuration with the bundle you prepared in the previous step. Modify the user_bundles JSON attribute of each Elasticsearch instance type as shown in the following example:

{
...
  "resources": {
    "elasticsearch": [
	 ...
        "plan": {
	 	 ...
          "elasticsearch": {
            ...
            "user_bundles": [
            {
              "name": "custom-ca-certs",
              "url": "http://www.MYURL.com/cacerts.zip", 
              "elasticsearch_version": "*" 
            }
          ]
        }
    ...

If you prefer to use a different file name and/or password for the trust store, you also need to add an additional configuration section to the cluster metadata before adding the bundle. This configuration should be added to the Elasticsearch cluster data section of the page:

  "jvm_trust_store": {
    "name": "<filename included into bundle>", 
    "password": "<password used to create keystore>" 
  }

Prepare a ZIP file with a custom bundle that contains a: GeoLite2 database. The folder has to be named ingest-geoip, and the file name can be anything that is appended -(City|Country|ASN) with the mmdb file extension, and it must have a different name than the original name GeoLite2-City.mmdb.

The file my-geoip-file.zip should look like this:

$ tree .
.
└── ingest-geoip
    └── MyGeoLite2-City.mmdb

In the advanced configuration editor, update your Elasticsearch cluster configuration with the bundle you prepared in the previous step. Modify the user_bundles JSON attribute of each Elasticsearch instance type as shown in the following example.

{
...
  "resources": {
    "elasticsearch": [
	 ...
        "plan": {
	 	 ...
          "elasticsearch": {
            ...
            "user_bundles": [
            {
              "name": "custom-geoip-db",
              "url": "http://www.MYURL.com/my-geoip-file.zip",
              "elasticsearch_version": "*"
            }
          ]
        }

To use this bundle, you can refer it in the GeoIP processor of an ingest pipeline as MyGeoLite2-City.mmdb under database_file such as:

...
{
  "geoip": {
    "field": ...
    "database_file": "MyGeoLite2-City.mmdb",
    ...
  }
}
...

Prepare a ZIP file with a custom bundle that contains a dictionary of synonyms in a text file.

The file synonyms.zip should look like this:

$ tree .
.
└── dictionaries
    └── synonyms.txt

In the advanced configuration editor, update your Elasticsearch cluster configuration with the bundle you prepared in the previous step. Modify the user_bundles JSON attribute of each Elasticsearch instance type as shown in the following example.

{
...
  "resources": {
    "elasticsearch": [
	 ...
        "plan": {
	 	 ...
          "elasticsearch": {
            ...
            "user_bundles": [
            {
              "name": "custom-synonyms",
              "url": "http://www.MYURL.com/synonyms.zip",
              "elasticsearch_version": "*"
            }
          ]
        }