ElasticSearch migration

[DenverTech]

I was eyeing the external ElasticSearch option and was curious about a few things there.
1) If we fully offload the ElasticSearch to something external, does that change anything with our reporting/graphs, etc? I wasn't clear on whether the "Kibana" portion of the directions was something required as part of the move to external.
2) If we offload to an external DB how do we move to the external database, or do we need to reinstall? I see the directions for attaching it as a stream target, or how to use external from the start, but wasn't sure how to switch after installing.
3) Lastly, what's the benefit of storing locally and also streaming to external? Wasn't sure what benefit that provided.

Thanks!

[mb]

Hi @DenverTech,

Very good questions. Please find my answers below:

If we fully offload the ElasticSearch to something external, does that change anything with our reporting/graphs, etc? I wasn't clear on whether the "Kibana" portion of the directions was something required as part of the move to external.

Nothing changes at all. You'll get the same reports as usual. With offloading to a remote, you get the additional benefit of being able to create your own graphs and dashboards. Kibana is not required; but allows you to do that.

If we offload to an external DB how do we move to the external database, or do we need to reinstall? I see the directions for attaching it as a stream target, or how to use external from the start, but wasn't sure how to switch after installing.

A simple re-install will do the job. Or, rm /usr/local/sensei/etc/.configdone file and re-do the initial configuration.

Lastly, what's the benefit of storing locally and also streaming to external? Wasn't sure what benefit that provided.

1. You have a backup of your reporting data
2. With a copy of the all reportign data, you can create lots of additional reports to your liking and business scenarios.

Some MSP partners of ours, offload their clients' reporting to a central location to be able to visualize and create a "consolidated" "big picture" view of the reports.

This way, they can utilize this to be able to better detect and respond to incidents as they occur, since the data is real-time.

PS: We'll put these onto our documentation.