All Products
Search

This Product

    Elasticsearch:Configure a private connection for an Elasticsearch cluster

    Document Center

    Elasticsearch:Configure a private connection for an Elasticsearch cluster

    Last Updated:Dec 09, 2025

    Some features of Alibaba Cloud Elasticsearch (ES) clusters are unavailable because of limitations in the new network architecture. You can use PrivateLink and Server Load Balancer (SLB) to establish a private connection between an Alibaba Cloud ES cluster and other cloud resources. These resources can include Elastic Compute Service (ECS) instances, elastic network interfaces (ENIs), elastic container instances (ECIs), or network resources at a specific IP address. This topic describes how to use Classic Load Balancer (CLB) and PrivateLink to establish a private connection between an Alibaba Cloud ES cluster and other Alibaba Cloud server resources. This topic also describes how to use Network Load Balancer (NLB) and PrivateLink to establish a private connection between Alibaba Cloud ES clusters. You can apply these solutions to other scenarios that are supported by PrivateLink and SLB.

    Note

    • Configuring a private connection is the only way to overcome the limitations that the new network architecture imposes on features such as X-Pack Watcher, reindex, Lightweight Directory Access Protocol (LDAP) authentication, and Active Directory (AD) user authentication.

    • Clusters created in or after October 2020 are deployed in the new network architecture and support private connections. Clusters created before October 2020 use the original network architecture and do not support private connections. This includes clusters in Alibaba Finance Cloud and Alibaba Gov Cloud.

    Application scenarios for Alibaba Cloud ES PrivateLink

    Terms

    To use PrivateLink for private access, you must create an endpoint and an endpoint service.

    Term

    Description

    Endpoint service

    An endpoint service is a service that can be connected to from other VPCs by creating an endpoint. You must manually create the related service resources.

    Endpoint

    An endpoint is associated with an endpoint service and can establish a network connection to access external services through a VPC private network. When you configure a private connection for an Alibaba Cloud ES cluster, an endpoint is automatically created in the network environment of the ES cluster.

    Use CLB and PrivateLink to establish a private connection between an Alibaba Cloud ES cluster and an ECS instance

    Prerequisites

    • An Alibaba Cloud ES cluster was created in VPC_1 in or after October 2020. For more information, see Create an Alibaba Cloud ES cluster.

    • An ECS instance was created in VPC_2 and the related applications are deployed. For more information, see Create an instance using the wizard.

      Note

      • The ECS instance serves as a backend server that receives requests forwarded by the SLB instance. When you create the ECS instance, you must select a region and a zone that support PrivateLink. For information about the regions that support PrivateLink, see Regions and zones that support PrivateLink.

      • The Alibaba Cloud ES, ECS, and SLB instances must be deployed in the same zone of the same region.

    Step 1: Create and configure an SLB instance

    1. Log on to the CLB console.

    2. Create an SLB instance that supports PrivateLink.

      1. On the Instances page, click Create CLB.

      2. On the CLB (Pay-As-You-Go) purchase page, select the same region as the Alibaba Cloud ES cluster, set Instance Type to Intranet, and click Buy Now to purchase the CLB instance.

      For more information, see Create and manage a CLB instance.

    3. Configure the SLB instance.

      1. On the Instances page, find the destination instance. In the Actions column, click Configure Listener.

      2. On the Configure Server Load Balancer page, configure the listener and backend servers, perform a health check, and review the configuration.

      For more information, see Configure an SLB instance and CLB listeners.

    Step 2: Create an endpoint service

    Note

    The private connection feature automatically creates an endpoint in the network environment of the ES cluster. You only need to manually create an endpoint service in the environment of the ECS instance.

    1. Log on to the endpoint service console.

    2. In the top navigation bar, select the region where you want to create the endpoint service.

      The endpoint service must be in the same region as the SLB instance.

    3. Click Create Endpoint Service.

    4. On the Create Endpoint Service page, select the SLB instance as the service resource, configure other parameters as needed, and click OK.

    For more information, see Create an endpoint service.

    Step 3: Configure a private connection for the Alibaba Cloud ES cluster

    1. Log on to the Alibaba Cloud Elasticsearch console.

    2. In the left-side navigation pane, click Elasticsearch Clusters.

    3. Navigate to the desired cluster.

      1. In the top navigation bar, select the resource group to which the cluster belongs and the region where the cluster resides.

      2. On the Elasticsearch Clusters page, find the cluster and click its ID.

    4. In the navigation pane on the left, choose Configuration and Management > Security.

    5. In the Network Settings section, click Modify to the right of Configure Private Connection.

    6. In the Configure Private Connection panel, click Add Private Connection.

    7. In the Associated Endpoint Service dialog box that appears, select a Zone, select the acknowledgment checkbox, and then click OK.

    8. In the Actions column of the endpoint, click Allow Connection.

      After the endpoint and the endpoint service are connected, the Endpoint Connection Status changes to Connected. This indicates that communication is enabled between the ES cluster in VPC_1 and VPC_2.

    9. (Optional) View the domain name of the endpoint.

      You can use the domain name of the endpoint for other service configurations, such as Watcher, single sign-on (SSO), and LDAP.

      1. In the Configure Private Connection panel, click the ID of the destination Endpoint ID.

      2. On the Endpoint Connections tab, click the 展开符 icon next to the destination endpoint ID to view the domain name that corresponds to the endpoint.

    Use NLB and PrivateLink to establish a private connection between Alibaba Cloud ES clusters

    This section describes how to use a Network Load Balancer (NLB) instance to connect an Alibaba Cloud ES_1 cluster to an Alibaba Cloud ES_2 cluster. You can mount the IP address of the ES_2 cluster to the NLB instance. This method is often used when two Alibaba Cloud ES clusters cannot communicate with each other because of network architecture limitations.

    Note

    • After a private connection is established between the ES_1 and ES_2 clusters, you can migrate data from the ES_2 cluster to the ES_1 cluster.

    • Alibaba Cloud NLB supports IP address mounting. For more information, see Features.

    Prerequisites

    Two Alibaba Cloud ES clusters were created in the same region and zone.

    Note

    When you create the ES clusters, you must select a region and a zone that support PrivateLink. For information about the regions that support PrivateLink, see Regions and zones that support PrivateLink.

    Step 1: Create an NLB instance

    An NLB instance receives requests from clients and forwards the requests to backend servers based on listening rules. To use the NLB service, you must create an NLB instance and add a listener and backend servers to the instance.

    1. Create an NLB instance.

      1. Log on to the NLB console.

      2. On the Instances page, click Create NLB.

      3. On the purchase page, configure the instance parameters.

        Select the region for the ES_2 cluster, set the network type to Internal-facing, and select the zone.

        For more information, see Create and manage an NLB instance.

    2. Create an NLB server group.

      A server group is used to route requests from clients to one or more backend servers. NLB determines the service availability of backend servers by performing health checks. When you add a listener to an NLB instance, you must specify a server group. The listener uses the configured protocol and port to check client connection requests and forward traffic to the corresponding server group.

      1. Go to the NLB server groups page.

      2. On the Server Groups page, click Create Server Group.

      3. In the dialog box that appears, configure the server group.

        Set the server group type to IP, enter a custom name, and select the VPC associated with the ES_2 cluster.

    3. Add the ES_2 cluster to the NLB instance as a backend server.

      Add the private IP address and port of the ES_2 cluster to the server group that you created.

      1. Run the ping command to retrieve the private IP address of the ES_2 cluster.

        image.png

      2. In the Actions column for the destination server group, click Modify Backend Server.

      3. On the Backend Servers tab, click Add IP Address.

      4. Add the private IP address of the ES_2 cluster to the backend servers and click Next.

      5. Add the ES port that is used for the operation. For example, reindex requires port 9200 for communication.

      6. Click OK.

    4. Add a listener.

      1. Log on to the NLB console.

      2. On the Instances page, click Create Listener in the Actions column for the target NLB instance.

      3. Set the listener protocol to TCP and the listener port to 9200, and then click Next.

      4. Set the server group type to IP, select the backend server group, and click Next.

      5. Click Submit.

    Step 2: Create an endpoint service

    Note

    The private connection feature automatically creates an endpoint in the network environment of the ES cluster. You only need to manually create an endpoint service in the environment of the other ES cluster.

    1. Log on to the endpoint service console.

    2. Click Create Endpoint Service.

    3. On the Create Endpoint Service page, you can configure the service.

      The following table describes some of the parameters. For more information, see Create an NLB instance.

      Configuration

      Description

      Region

      Select the same region as the ES cluster.

      Service Resource Type

      Select Network Load Balancer (NLB).

      Select Service Resource

      The NLB instance that you created.

      Service Payer

      You can select either option.

    4. Click OK.

      After the endpoint service is created, it is attached to the NLB instance and appears in the Endpoint Service section.

      image

    Step 3: Configure a private connection on the Alibaba Cloud ES cluster

    Configure a private connection on the Alibaba Cloud ES_1 cluster. The system automatically creates an endpoint in the network environment of the ES_1 cluster to connect to the endpoint service.

    1. Log on to the Alibaba Cloud Elasticsearch console.

    2. In the left-side navigation pane, click Elasticsearch Clusters.

    3. Navigate to the desired cluster.

      1. In the top navigation bar, select the resource group to which the cluster belongs and the region where the cluster resides.

      2. On the Elasticsearch Clusters page, find the cluster and click its ID.

    4. In the navigation pane on the left, choose Configuration and Management > Security.

    5. In the Network Settings section, click Edit to the right of Configure Private Connection.

    6. In the Configure Private Connection panel, click Add Private Connection.

    7. In the dialog box that appears, select the endpoint service that you created, complete the other configurations, and then click OK.

    8. In the Actions column of the endpoint, click Allow Connection.

      After the endpoint and the endpoint service are connected, the Endpoint Connection Status changes to Connected. This indicates that the ES_1 and ES_2 clusters are connected.

    9. (Optional) View the domain name of the endpoint.

      You can use the domain name of the endpoint and add it to a whitelist for other service configurations, such as Watcher, SSO, and LDAP.

      1. In the Configure Private Connection panel, click the ID of the destination Endpoint ID.

      2. On the Endpoint Connections tab, click the 展开符 icon next to the destination endpoint ID to view the domain name that corresponds to the endpoint.

    (Optional) Step 4: Test the connectivity between the ES clusters using reindex

    You can use reindex to migrate an index from the Alibaba Cloud ES_2 cluster to the Alibaba Cloud ES_1 cluster to verify the network connectivity between the ES_1 and ES_2 clusters.

    1. Configure a reindex whitelist in the YML file of the ES_1 cluster.

      1. In the navigation pane on the left of the details page for the ES_1 cluster, choose Configuration and Management > Cluster Configuration.

      2. In the upper-right corner of the YML File Configuration section, click Modify Configuration.

        reindex.remote.whitelist: ["Domain name of the endpoint:9200"]

    2. Prepare the data to migrate in the ES_2 cluster. Then, create an index in the ES_1 cluster and perform the reindex migration.

      POST _reindex
{
 "source": {
 "remote": {
 "host": "http://ep-bp1i4db71e6adaa29718-cn-hangzhou-i.epsrv-bp1fm3v8kc2qr2td6lrm.cn-hangzhou.privatelink.aliyuncs.com:9200",
 "username": "Username",
 "password": "Password"
 },
 "index": "myindex"
 },
 "dest": {
 "index": "myindex2"
 }
}

      Category

      Parameter

      Description

      source

      host

      The access address of the PrivateLink endpoint service. The address must contain the protocol, endpoint domain name, and port number. Example: https://<Endpoint domain name>:9200.

      username

      Optional. The default username for an Alibaba Cloud Elasticsearch cluster is elastic.

      password

      The password that corresponds to the username. The password for the elastic user of an Alibaba Cloud Elasticsearch cluster is set when you create the cluster. If you forget the password, you can reset it. For information about how to reset the password, see Reset the access password for an instance.

      index

      The source index in the remote cluster.

      query

      Use a query to specify the data to migrate. For more information, see Reindex API.

      dest

      index

      The destination index in the local cluster.

    3. In the ES_1 cluster, check whether the data from the ES_2 cluster was successfully migrated.

    References