You must be logged in as an Administrator to take this action.
Whether your Data Indexer cluster is one node or 3 to 20 nodes, you only have to access the Configuration Manager on the Platform Manager.
Do not attempt to modify any configuration files manually. If you have any issues, contact LogRhythm Support.
To configure the Data Indexer:
-
Open the Configuration Manager.
-
On the left, click Data Indexers.
-
To enable the Advanced View, on the bottom of the page, click Show.
-
Modify or verify the following settings:
Transporter
Transporter Max Log Size (bytes)
Maximum allowable size of a log, above which Transporter rejects the log
Transporter Webserver Port
Port number bound by the Transporter web server
Transporter Route Handler Timer (sec)
Maximum number of seconds that an indexing HTTP request lives before timing out
Database Information
Database User ID
SQL user name used by the Data Indexer to connect to the LogRhythm database server
Database Password
SQL password used the Data Indexer to connect to the LogRhythm database server
Elasticsearch Data Path
Fully qualified path where Elasticsearch stores cluster data; value of path.data
GoMaintain
GoMaintain TTL Logs (#indices)
Maximum number of logs indices to store. Default value is -1 to manage automatically based on available resources
GoMaintain ForceMerge
Periodic Elasticsearch defragmentation of indices to reduce heap consumption
Potentially resource intensive.
GoMaintain IndexManage Elasticsearch Sample Interval (sec)
Number of seconds between GoMaintain samples of Elasticsearch heap and disk utilization for index TTL management
GoMaintain IndexManage Elasticsearch Samples (#samples)
Maximum number of accumulated samples before GoMaintain performs index TTL management
GoMaintain IndexManage Disk HWM (%diskutil)
Maximum disk utilization above which GoMaintain performs index TTL management
GoMaintain IndexManage Elasticsearch Heap HWM (%esheap)
Maximum Elasticsearch heap usage (filtered) above which GoMaintain performs index TTL management
Integrated Security
Integrated Security
Enable domain credential access and encryption for EMDB connections
Carpenter
Carpenter SQL Paging Size (#records)
The number of records per EMDB request used by Carpenter to sync metadata to Elasticsearch
Carpenter EMDB Sync Interval (#minutes)
The number of minutes between Carpenter metadata sync operations with the EMDB
Enabling Warm Replicas
Enable Warm Replicas
Enables replicas on warm indices when cluster has more than one DXW node
-
Click Save after making changes to the configuration. You can also click Save in the Edit menu in the upper-left corner of the Configuration Manager.