Remote Elasticsearch Database not showing up as an option in Zenarmor wizard

Started by mlenje, December 02, 2025, 08:21:59 AM

Previous topic - Next topic
A couple of days ago, I successfully installed the free version of Zenarmor on OPNsense v25.7.8. During the install, Remote Elasticsearch Database was an option that appeared during the wizard. I used it and setup Elasticsearch on a separate computer. Everything was working great.

Today, I upgraded the hard drives in my OPNsense box and did a clean re-install of OPNsense. Installing Zenarmor was the last step. During the install, Remote Elasticsearch Databas is not listed as an option, only local Elasticsearch or local SQLite.

Any thoughts on why it's not showing up as an option in the wizard?

They decided to put remote elasticsearch option and log streaming behind a paywall.

I think Zenarmor is one of the worst examples of reverse feature creep I've ever seen in an application.

At the time, Sensei was actually one of the reasons that made me decide to switch from pf to OPN. Paid for home license for two years but after losing features year after year it was not worth it in the end. Looks like they are still trying to find ways to limit their application.
25.7.8 Proxmox VM, 4x 2.1GHz, 8GB
Cisco L3 switch OSPF + FRR
DoT, Chrony, HAProxy + NAXSI, Suricata
VPN: IPSec, OpenVPN, Wireguard
MultiWAN: Fiber 500/500Mbit dual stack + 4G failover

--
Available for private support.
Did my answer help you? Feel free to click [applaud] to the left

Hi all,

We sincerely apologize for the inconvenience, but we have detected extensive misuse of such features for commercial purposes. Despite our warnings, the misuse continues. We understand that this is not the fault of those who are not abusing the system, but unfortunately, we are compelled to take some measures due to the majority who do misuse it. While taking this step, we have also considered our valuable free user base. We believe you can continue using local Elasticsearch by increasing existing resources instead of creating a new Elasticsearch server.

Quote from: sy on Today at 01:08:33 PMWe believe you can continue using local Elasticsearch by increasing existing resources instead of creating a new Elasticsearch server.

Yea I am sorry but no.
You can not do this on a bare-metal devices, such as any miniPC or DEC used to run OPNsense, which is the majority of the user base. You are resource limited.

This actually created another performance problem for ZA and Throughput. Cause one of the ways how to get higher throughput, e.g better performance, was to move the DB on a remote destination so it is not eating up into the Single core performance.

Regards,
S.
Networking is love. You may hate it, but in the end, you always come back to it.

OPNSense HW
APU2D2 - deceased
N5105 - i226-V | Patriot 2x8G 3200 DDR4 | L 790 512G - VM HA(SOON)
N100   - i226-V | Crucial 16G  4800 DDR5 | S 980 500G - PROD