The Data Indexer (Indexer) provides persistence and search capabilities, as well as high-performance, distributed, and highly scalable indexing of machine and forensic data. Indexers can be clustered in a replicated configuration to enable high-availability, improved search performance, and support for a greater number of simultaneous users. Indexers store both the original and structured copy of data to enable search-based analytics. The Indexer is supported on Windows and Linux, as follows:
-
Windows. You can install the Indexer on an XM Appliance, an upgraded Data Processor Appliance, your own server, or a virtual machine. The Data Indexer services are "pinned" to the locally running Data Processor.
-
Linux. You can install one or 3-10 physical hot nodes, and 1-10 warm nodes (optional) on a Linux Indexer Appliance(s), your own server(s), or virtual machine(s). This configuration is called a DX or DX cluster
For more information about installing or upgrading the Indexer, see the LogRhythm Software Installation Guide on the LogRhythm Community.
Indexer Services
The Indexer is a highly scalable, open-source, full-text search and analytics engine based on OpenSearch. The full functionality of the Indexer is provided by the following micro services:
|
Service |
Description |
|---|---|
|
Bulldozer |
Registers the OpenSearch cluster name and nodes in the EMDB. Writes cluster statistics to the EMDB for use in the Deployment Monitor. |
|
Carpenter |
Synchronizes lists and reference data to Data Indexer reference indexes (EMDB_*). |
|
Columbo |
Executes query requests from LogRhythm components. |
|
OpenSearch Service |
Log persistence and indexing data store. |
|
GoMaintain |
Maintains Data Indexer Hot/Warm indices for disk space and time to live (TTL) |
|
Transporter |
Performs indexing operations from AIE/Data Processor into the OpenSearch cluster to ensure data reliability |
|
WatchTower |
Receives analytic data from CloudAI. If CloudAI is not in use in your deployment, this service remains idle, even though it is running. |
Data Indexer File Locations
|
Windows |
Linux |
|---|---|
|
Data Indexer File Binaries |
|
|
C:\Program Files\LogRhythm\Data Indexer |
/usr/local/logrhythm |
|
Data Indexer Log Files |
|
|
C:\Program Files\LogRhythm\Data Indexer\logs C:\Program Files\LogRhythm\Data Indexer\OpenSearch\logs |
/var/log/OpenSearch /var/log/persistent |
|
Data Indexer logs- Repository (Default Path) |
|
|
${DXDATAPATH}\OpenSearch\data ${DXDATAPATH} = D:\LRIndexer |
/usr/local/logrhythm/db/OpenSearch/data |
|
Data Indexer Service Start/Stop Scripts |
|
|
C:\Program Files\LogRhythm\Data Indexer\tools\start-allservices.bat C:\Program Files\LogRhythm\Data Indexer\tools\stop-allservices.bat |
/usr/local/logrhythm/tools/start-all-serviceslinux.sh /usr/local/logrhythm/tools/stop-all-serviceslinux.sh |