Hosting and securing ElasticSearch

Elastic Stack Elasticsearch
1 
            I've been looking at ElasticSearch and I'm a huge fan of

what I'm seeing so far. I'm currently using Lucene.NET on my site
(sf4answers.com) to perform searching, but I feel that I'd rather not have
to deal with a lot of the overhead that comes with it.

            I was considering SOLR, but ElasticSearch is much, much more

appealing to me.

            However, I have a few questions, and I'm hoping I can find

some good answers here (and trust me, I've tried to look):

            My website is currently running on a shared hosting solution

with ASP.NET (on discountasp.net). To that end, I'd use the .NET client to
access ElasticSearch hosted on another domain/ip address.

            That said, are there hosting providers that will let me host

a JVM and expose the HTTP endpoint that ElasticSearch requires? If so,
could anyone point me to some trusted providers (I will admit to not knowing
much about non-Windows hosting platforms).

            Also, how would I secure the operations between the ASP.NET

host and whatever is hosting the JVM? I was hoping there would be an HTTPS
endpoint (with a self issued certificate), but there doesn't seem to be one.
This is a huge concern to me, because I don't want to just leave my search
index out in the wild open to anyone who wants to place entries into it.

            Any insight into this would be greatly appreciated, and

thanks in advance.

                            - Nick
2

Heya,

There isn't an HTTPS support (yet), but you can proxy ES with HTTPs (which might make more sense). As for suggesting a hosting env, donno..., Have you considered "the cloud" :wink:
On Monday, January 31, 2011 at 7:57 PM, Administrator wrote:

I’ve been looking at Elasticsearch and I’m a huge fan of what I’m seeing so far. I’m currently using Lucene.NET on my site (sf4answers.com) to perform searching, but I feel that I’d rather not have to deal with a lot of the overhead that comes with it.

I was considering SOLR, but Elasticsearch is much, much more appealing to me.

However, I have a few questions, and I’m hoping I can find some good answers here (and trust me, I’ve tried to look):

My website is currently running on a shared hosting solution with ASP.NET (on discountasp.net). To that end, I’d use the .NET client to access Elasticsearch hosted on another domain/ip address.

That said, are there hosting providers that will let me host a JVM and expose the HTTP endpoint that Elasticsearch requires? If so, could anyone point me to some trusted providers (I will admit to not knowing much about non-Windows hosting platforms).

Also, how would I secure the operations between the ASP.NET host and whatever is hosting the JVM? I was hoping there would be an HTTPS endpoint (with a self issued certificate), but there doesn’t seem to be one. This is a huge concern to me, because I don’t want to just leave my search index out in the wild open to anyone who wants to place entries into it.

Any insight into this would be greatly appreciated, and thanks in advance.

  • Nick
3

Shay,

            Thanks for the info.



            Can you elaborate on proxying ES with HTTPS?  How exactly is that achieved?  On the surface, to me (someone who admittedly doesn’t know), it seems like it’s just having and HTTPS portal in front of an HTTP portal and you still have to worry about the HTTP portal part (again, I think I’m wildly off base here).



            As for hosting in the cloud, I see that it would require using both EC2 and S3 from Amazon.  Does that solve the security issue?  It doesn’t seem that it would.



            Also, in regards to running in the “cloud”, it would seem that I would need to have the EC2 instance running all the time, which comes to about $62/month if I’ve done the math right for a small on demand instance (or does it have to be another type of instance)?



            Thanks in advance.



                            - Nick

From: Shay Banon [mailto:shay.banon@elasticsearch.com]
Sent: Monday, January 31, 2011 3:08 PM
To: users@elasticsearch.com
Subject: Re: Hosting and securing ElasticSearch.

Heya,

There isn't an HTTPS support (yet), but you can proxy ES with HTTPs (which might make more sense). As for suggesting a hosting env, donno..., Have you considered "the cloud" :wink:

On Monday, January 31, 2011 at 7:57 PM, Administrator wrote:

            I’ve been looking at ElasticSearch and I’m a huge fan of what I’m seeing so far.  I’m currently using Lucene.NET on my site (sf4answers.com) to perform searching, but I feel that I’d rather not have to deal with a lot of the overhead that comes with it.



            I was considering SOLR, but ElasticSearch is much, much more appealing to me.



            However, I have a few questions, and I’m hoping I can find some good answers here (and trust me, I’ve tried to look):



            My website is currently running on a shared hosting solution with ASP.NET (on discountasp.net).  To that end, I’d use the .NET client to access ElasticSearch hosted on another domain/ip address.



            That said, are there hosting providers that will let me host a JVM and expose the HTTP endpoint that ElasticSearch requires?  If so, could anyone point me to some trusted providers (I will admit to not knowing much about non-Windows hosting platforms).



            Also, how would I secure the operations between the ASP.NET host and whatever is hosting the JVM?  I was hoping there would be an HTTPS endpoint (with a self issued certificate), but there doesn’t seem to be one.  This is a huge concern to me, because I don’t want to just leave my search index out in the wild open to anyone who wants to place entries into it.



            Any insight into this would be greatly appreciated, and thanks in advance.



                            - Nick
4

This question is interesting for me too.

Isn't there something where my transportclient could use basic
authentication to feed and to query?

Would this basic auth make sense for REST API too?

Kind Regards,
Peter.

On 31 Jan., 21:22, "Administrator" ad...@sf4answers.com wrote:

Shay,

            Thanks for the info.

            Can you elaborate on proxying ES with HTTPS?  How exactly is that achieved?  On the surface, to me (someone who admittedly doesn’t know), it seems like it’s just having and HTTPS portal in front of an HTTP portal and you still have to worry about the HTTP portal part (again, I think I’m wildly off base here).

            As for hosting in the cloud, I see that it would require using both EC2 and S3 from Amazon.  Does that solve the security issue?  It doesn’t seem that it would.

            Also, in regards to running in the “cloud”, it would seem that I would need to have the EC2 instance running all the time, which comes to about $62/month if I’ve done the math right for a small on demand instance (or does it have to be another type of instance)?

            Thanks in advance.

                            - Nick

From: Shay Banon [mailto:shay.ba...@elasticsearch.com]
Sent: Monday, January 31, 2011 3:08 PM
To: us...@elasticsearch.com
Subject: Re: Hosting and securing Elasticsearch.

Heya,

There isn't an HTTPS support (yet), but you can proxy ES with HTTPs (which might make more sense). As for suggesting a hosting env, donno..., Have you considered "the cloud" :wink:

On Monday, January 31, 2011 at 7:57 PM, Administrator wrote:

            I’ve been looking at ElasticSearch and I’m a huge fan of what I’m seeing so far.  I’m currently using Lucene.NET on my site (sf4answers.com) to perform searching, but I feel that I’d rather not have to deal with a lot of the overhead that comes with it.

            I was considering SOLR, but ElasticSearch is much, much more appealing to me.

            However, I have a few questions, and I’m hoping I can find some good answers here (and trust me, I’ve tried to look):

            My website is currently running on a shared hosting solution with ASP.NET (on discountasp.net).  To that end, I’d use the .NET client to access ElasticSearch hosted on another domain/ip address.

            That said, are there hosting providers that will let me host a JVM and expose the HTTP endpoint that ElasticSearch requires?  If so, could anyone point me to some trusted providers (I will admit to not knowing much about non-Windows hosting platforms).

            Also, how would I secure the operations between the ASP.NET host and whatever is hosting the JVM?  I was hoping there would be an HTTPS endpoint (with a self issued certificate), but there doesn’t seem to be one.  This is a huge concern to me, because I don’t want to just leave my search index out in the wild open to anyone who wants to place entries into it.

            Any insight into this would be greatly appreciated, and thanks in advance.

                            - Nick
5

One further question: can I disallow requests which do not come from
localhost? Or is this the default?

On 31 Jan., 22:54, Karussell tableyourt...@googlemail.com wrote:

This question is interesting for me too.

Isn't there something where my transportclient could use basic
authentication to feed and to query?

Would this basic auth make sense for REST API too?

Kind Regards,
Peter.

On 31 Jan., 21:22, "Administrator" ad...@sf4answers.com wrote:

Shay,

            Thanks for the info.

            Can you elaborate on proxying ES with HTTPS?  How exactly is that achieved?  On the surface, to me (someone who admittedly doesn’t know), it seems like it’s just having and HTTPS portal in front of an HTTP portal and you still have to worry about the HTTP portal part (again, I think I’m wildly off base here).

            As for hosting in the cloud, I see that it would require using both EC2 and S3 from Amazon.  Does that solve the security issue?  It doesn’t seem that it would.

            Also, in regards to running in the “cloud”, it would seem that I would need to have the EC2 instance running all the time, which comes to about $62/month if I’ve done the math right for a small on demand instance (or does it have to be another type of instance)?

            Thanks in advance.

                            - Nick

From: Shay Banon [mailto:shay.ba...@elasticsearch.com]
Sent: Monday, January 31, 2011 3:08 PM
To: us...@elasticsearch.com
Subject: Re: Hosting and securing Elasticsearch.

Heya,

There isn't an HTTPS support (yet), but you can proxy ES with HTTPs (which might make more sense). As for suggesting a hosting env, donno..., Have you considered "the cloud" :wink:

On Monday, January 31, 2011 at 7:57 PM, Administrator wrote:

            I’ve been looking at ElasticSearch and I’m a huge fan of what I’m seeing so far.  I’m currently using Lucene.NET on my site (sf4answers.com) to perform searching, but I feel that I’d rather not have to deal with a lot of the overhead that comes with it.

            I was considering SOLR, but ElasticSearch is much, much more appealing to me.

            However, I have a few questions, and I’m hoping I can find some good answers here (and trust me, I’ve tried to look):

            My website is currently running on a shared hosting solution with ASP.NET (on discountasp.net).  To that end, I’d use the .NET client to access ElasticSearch hosted on another domain/ip address.

            That said, are there hosting providers that will let me host a JVM and expose the HTTP endpoint that ElasticSearch requires?  If so, could anyone point me to some trusted providers (I will admit to not knowing much about non-Windows hosting platforms).

            Also, how would I secure the operations between the ASP.NET host and whatever is hosting the JVM?  I was hoping there would be an HTTPS endpoint (with a self issued certificate), but there doesn’t seem to be one.  This is a huge concern to me, because I don’t want to just leave my search index out in the wild open to anyone who wants to place entries into it.

            Any insight into this would be greatly appreciated, and thanks in advance.

                            - Nick