You can use Network Load Balancer (NLB) and PrivateLink to connect two Elasticsearch clusters over a private network in the same region, and then configure cross-cluster replication (CCR) for near-real-time data synchronization and intra-region disaster recovery.
Prerequisites
-
You have created two Alibaba Cloud Elasticsearch instances in the same region, such as China (Hangzhou), as the leader cluster and the follower cluster. For instructions, see Create an Alibaba Cloud Elasticsearch cluster.
-
Both clusters use the v3 cloud-native management architecture. If your clusters use the v1 or v2 architecture, you must upgrade them first. For instructions, see Upgrade the architecture of an instance.
-
Both clusters are version 7.10.0 or later. The version of the follower cluster must be the same as or later than the version of the leader cluster.
Overview
Alibaba Cloud Elasticsearch instances are deployed in a dedicated management VPC, not in your VPC. Even if you use Cloud Enterprise Network (CEN) to connect different VPCs within the same region, the clusters cannot communicate over private networks by default. This solution uses NLB and PrivateLink on top of the CEN connection to bridge the management VPCs of the two clusters. The process is as follows:
-
Use CEN to connect the VPCs where the leader cluster and follower cluster reside. If both Elasticsearch instances are in the same VPC, you can skip this step and proceed to Step 2.
-
Create an NLB instance in the follower cluster's VPC to forward traffic to the private IP of the leader cluster.
-
Create an endpoint service based on the NLB instance.
-
In the Alibaba Cloud Elasticsearch console for the follower cluster, configure a private connection to obtain a PrivateLink domain name.
-
In the Kibana console of the follower cluster, add a remote cluster and configure CCR.
Procedure
Step 1: Connect same-region VPCs with CEN
If both Elasticsearch instances are in the same VPC, you can skip this step and proceed to Step 2.
Use Cloud Enterprise Network (CEN) to connect the VPC of the leader cluster and the VPC of the follower cluster. For detailed instructions, see Connect VPCs in the same region.
Step 2: Obtain the leader cluster's private IP
-
Log on to the Alibaba Cloud Elasticsearch console.
-
On the Basic Information page of the leader cluster, find the Internal Endpoint field and copy the private domain name.
-
From an ECS instance in the same VPC, run the following command to resolve the private IP of the leader cluster:
ping <Private domain name of the leader cluster>Record the resolved IP address for later use.
Step 3: Create an NLB instance and server group
Create an NLB instance in the VPC of the follower cluster to forward traffic to the leader cluster.
Make sure you have switched to the region where the follower cluster is located before you create the NLB instance and server group. The NLB instance must be in the same region as the follower cluster. Otherwise, you cannot create the endpoint service.
-
Log on to the Network Load Balancer (NLB) console.
-
Create a server group.
-
In the left-side navigation pane, click ServerGroup.
-
Click Create Server Group and configure the following parameters:
Parameter
Description
Server Group Type
Select IP type.
Forwarding Port
Enable All-port forwarding.
Health Check
Enter 9300 for the port.
-
In the server group you created, click Add backend servers. Add the private IP of the leader cluster that you obtained in Step 2. Keep the default port setting.
-
-
Create an NLB instance and a listener.
The NLB purchase page does not support the all-port feature during listener configuration. Create an NLB instance first without configuring a listener, and then enable the all-port feature when you create a listener on the instance details page.
If you already have an NLB instance, you can create a listener directly. Otherwise, create an NLB instance first.
-
In the left-side navigation pane, click Cluster, and then select or create an NLB instance.
-
Go to the instance details page, click the Listener tab, and then click Create Listener.
-
Enable the All-port feature and set the listener port range to 9200-9300.
-
For ServerGroup, select the IP type and the server group that you created in the previous step.
-
Step 4: Configure PrivateLink
Use PrivateLink to connect the management VPC of the follower cluster to the network of the leader cluster.
-
Log on to the PrivateLink console.
-
Create an endpoint service.
-
In the left-side navigation pane, click Endpoint Service.
-
Click Create Endpoint Service and configure the following parameters:
Parameter
Description
Service resource type
Select NLB.
Service Resource
Select the NLB instance created or used in Step 3.
Zone
Select the availability zone where the NLB instance is located.
Automatically Accept Endpoint Connections
Select Yes.
-
-
Add a private connection in the follower cluster.
-
Log on to the Alibaba Cloud Elasticsearch console and go to the details page of the follower cluster instance.
-
In the left-side navigation pane, choose Configuration and Management > Security Settings.
-
In the Network Settings section, click Configure Private Connection.
-
Click Add Private Connection and select the endpoint service that you created in the previous step.
-
Wait until the connection status changes to Connected.
-
-
Obtain the PrivateLink domain name.
After the connection is established, return to the PrivateLink console. On the Endpoint Connection Status tab of the endpoint service, find the automatically created endpoint connection. You will use this PrivateLink domain name to configure the remote cluster.
Step 5: Configure CCR
-
Log on to the Kibana console of the follower cluster. For alternative instructions on using a public endpoint, see Log on to the Kibana console of a v2/v3 cluster by using a public endpoint.
On the instance details page of the follower cluster, click Data Visualization in the left-side navigation pane, and then click Go to Kibana.
-
Add a remote cluster.
-
In the left-side navigation pane of Kibana, click Stack Management.
-
In the Data section, click Remote clusters.
-
Click Add a remote cluster and configure the following parameters:
Parameter
Description
Name
Enter the instance ID of the leader cluster.
Proxy mode
Enable proxy mode.
Proxy address
Enter the PrivateLink domain name obtained in Step 4 in the format
<PrivateLink domain name>:9300. -
Click Save and make sure the connection status is connected.
-
-
Configure a CCR follow mode.
CCR supports two modes:
Mode
Description
Follower indices
Replicates a single, specified index.
Auto-follow pattern
Automatically replicates indices that match a specified index pattern. This mode is suitable for bulk synchronization.
After you create an auto-follow pattern, new indices created in the leader cluster are automatically replicated to the follower cluster. Existing indices are not automatically replicated. To replicate an existing index, you must manually create a follower index in the follower cluster.
The following steps use the auto-follow pattern as an example:
-
In Stack Management, click Cross-Cluster Replication.
-
Click the Auto-follow patterns tab, and then click Create an auto-follow pattern.
-
For Remote cluster, select the remote cluster you just added. For Index patterns, enter
*to replicate all indices. To replicate specific indices, you can enter a specific index pattern, such aslogs-*. -
Click Create.
-
Step 6: Verify data synchronization
Verify synchronization for existing indices
If the leader cluster already contains indices before you create the auto-follow pattern, those indices are not automatically replicated. You must manually create follower indices in the follower cluster's Kibana console by navigating to Stack Management > Cross-cluster replication > Follower indices.
After you create a follower index, run the following command in the follower cluster's Kibana console to verify data synchronization:
GET /<index_name>/_search
If the returned result is consistent with the result from the leader cluster, the existing data is synchronized.
Verify synchronization for new data
-
In the leader cluster's Kibana console, create a new index and write a document to it:
PUT /test-increment-index POST /test-increment-index/_doc { "title": "increment test", "content": "This is a test document for CCR incremental sync." } -
In the follower cluster's Kibana console, query the index:
GET /test-increment-index/_searchIf the returned document matches what you wrote, new data is being synchronized in real time.
FAQ
Why is the remote cluster not connected?
Check the following items:
-
Verify that bandwidth is allocated for the CEN intra-region connection and whether the network connection between the two VPCs is established.
-
Verify that the NLB listener port range includes 9200-9300.
-
Verify that the private IP of the leader cluster in the server group is correct.
-
Verify that the health check for the server group uses port 9300.
-
Verify that the PrivateLink endpoint connection status is Connected.
What is the latency for same-region CCR?
Same-region CCR replication latency is typically in the seconds range, though slightly higher than replication within a single network. Actual latency depends on your CEN bandwidth configuration, data volume, and network conditions. Configure the CEN intra-region bandwidth based on your business requirements.
What are the version requirements for CCR?
The version of the follower cluster cannot be earlier than the version of the leader cluster. Both clusters must be version 7.10.0 or later and use the v3 cloud-native management architecture.