Install and Configure APM Server

Note:Single Cluster with Multiple Nodes: Run the following commands on the master node server.

1. Open an elevated PowerShell window in C:\elastic\elasticsearch-x.x.x\bin.

2. Create CA by running:

   Copy

   .\elasticsearch-certutil.bat ca --silent --pem --out "C:\elastic\secrets\apm_ca.zip"
   

3. Extract apm_ca.zip contents into C:\elastic\secrets\apm-ca\ (you should have ca.crt and ca.key inside the folder).

4. Create server cert for APM. Build SAN args with your DNS and IPs, e.g., --dns <fqdn> --dns <shortname> --ip <server-ip>, then run:

   Copy

   .\elasticsearch-certutil.bat cert --silent --pem --ca-cert "C:\elastic\secrets\apm-ca\ca.crt" --ca-key "C:\elastic\secrets\apm-ca\ca.key" --name apm-server [SAN args] --out "C:\elastic\secrets\apm-server.zip"
   

5. Extract zip contents into C:\elastic\secrets\apm-server\ to get apm-server.crt and apm-server.key.

6. Create C:\elastic\apm-server-x.x.x\config\certs directory.

7. Copy the certificate files:

   Copy

   C:/elastic/secrets/apm-server/apm-server.crt -> C:/elastic/apm-server-x.x.x/config/certs/apm-server.crt
   C:/elastic/secrets/apm-server/apm-server.key -> C:/elastic/apm-server-x.x.x/config/certs/apm-server.key
   C:/elastic/secrets/apm-ca/ca.crt -> C:/elastic/apm-server-x.x.x/config/certs/ca.crt
   

8. Install CA to Windows trust (Local Machine Root) so browsers trust APM. Run mmc, add Certificates snap-in for Computer account, import ca.crt under Trusted Root Certification Authorities, or run:

   Copy

   certutil.exe -addstore -f Root "C:\elastic\apm-server-x.x.x\config\certs\ca.crt"
   

```bash
curl.exe -u <username>:<password> --cacert C:\elastic\secrets\ca\ca.crt https://<hostname_or_ip>:9200/_cat/health
```

Or with PowerShell:

Invoke-RestMethod -Uri https://<hostname_or_ip>:9200/_cat/health -Credential (Get-Credential)

Note: Optional for backup and recovery. Snapshot repositories enable backup and restore capabilities but are not required for basic Elasticsearch operation.

Official Documentation: For comprehensive snapshot and restore guidance, see Elastic's snapshot and restore documentation.

Important: For single cluster with multiple nodes, path.repo must be configured in elasticsearch.yml on every node. All nodes must have access to the same backup location (shared network drive or replicated storage).

Create and Configure Backup Directory

1. Create a backup directory on a dedicated high-performance volume (not C:):

   Copy

   # Use a dedicated volume for backups
   mkdir X:\es-backups
   

2. Grant the Elasticsearch service account full read/write permissions:

   Copy

   # For LocalSystem (default service account)
   icacls "X:\es-backups" /grant "NT AUTHORITY\SYSTEM:(OI)(CI)F" /T
   
   # For custom service account (replace DOMAIN\svc_elasticsearch)
   # icacls "X:\es-backups" /grant "DOMAIN\svc_elasticsearch:(OI)(CI)F" /T
   
   # Verify permissions
   icacls "X:\es-backups"
   

3. Configure the snapshot repository path in elasticsearch.yml on all nodes:

   Copy

   path.repo: ["X:/es-backups"]
   

4. Restart Elasticsearch on all nodes to apply the changes:

   Copy

   Restart-Service -Name "elasticsearch-service-x64"
   

Register Snapshot Repository

1. Open Kibana and navigate to Dev Tools (Management > Dev Tools).

2. Run the following command to register the repository:

   Copy

   PUT _snapshot/my_backup
   {
       "type": "fs",
       "settings": {
           "location": "X:/es-backups",
           "compress": true
       }
   }
   

   Note: Verify that the location path matches the path.repo value configured in elasticsearch.yml.

Verify Snapshot Repository

1. In Kibana Dev Tools, run the following command:

   Copy

   POST _snapshot/my_backup/_verify
   

2. You should see a response confirming the repository is valid:

   Copy

   {
       "nodes": {
           "node_id": {
               "name": "node_name"
           }
       }
   }
   

Test Snapshot and Restore Operations

CCR replicates indices from a leader cluster to a follower cluster.

Example: Create a Follower Index

Assume:

• Leader cluster alias: audit-cluster (registered in Register Remote Cluster Connection)
• Leader cluster name: secondary-cluster
• Leader index: my-index-000001
• Follower cluster (primary-cluster) is where you run this command

PUT /my-index-000001-follower/_ccr/follow
{
  "remote_cluster": "audit-cluster",
  "leader_index": "my-index-000001"
}

Check follower status:

GET /my-index-000001-follower/_ccr/info

Verify Cluster Health (local)

GET _cluster/health?pretty

Verify Nodes

GET _cat/nodes?v

Verify Remote Clusters (CCS/CCR)

GET _remote/info

Rolling Restart (High Level)

1. Stop one data node
2. Wait for shard relocation / health stabilization
3. Start the node
4. Repeat for remaining data nodes
5. Then master nodes (one at a time)