How security works

An Elasticsearch cluster is typically made out of many moving parts. There are the Elasticsearch nodes that form the cluster, and often Logstash instances, Kibana instances, Beats agents an clients, all communicating with the it. It should not come as a surprise that securing such clusters has many facets and layers.

The Elastic Stack security features provide the means to secure the Elastic cluster on several levels:

The security features support configuring SSL/TLS for securing the communication channels to, from and within the cluster. This support accounts for:

For more information, see Encrypting Communications.

The security features also enable you to configure IP Filters which can be seen as a light mechanism for node/client authentication. With IP filtering, you can restrict the nodes and clients that can connect to the cluster based on their IP addresses. The IP filters configuration provides whitelisting and blacklisting of IPs, subnets and DNS domains.

When dealing with any secure system, it is critical to have a audit trail mechanism set in place. Audit trails log various activities/events that occur in the system, enabling you to analyze and back track past events when things go wrong (e.g. security breach).

The security features provide such audit trail functionality for all nodes in the cluster. You can configure the audit level which accounts for the type of events that are logged. These events include failed authentication attempts, user access denied, node connection denied, and more.

For more information on auditing see Auditing security events.