Configure nginx and Elasticsearch

This section discusses the minimum settings you must choose to test Elasticsearch with Magento 2. For additional details about configuring Elasticsearch, see the Magento Commerce User Guide.

To configure Magento to use Elasticsearch:

1. Log in to the Magento Admin as an administrator.
2. Click Stores > Settings > Configuration > Catalog > Catalog > Catalog Search.

3. From the Search Engine list, click Elasticsearch or Elasticsearch 5.0+ as the following figure shows. (The Elasticsearch 5.0+ option is not available for Magento 2.1.)

   

4. The following table discusses only the configuration options required to test the connection with Magento.

   Unless you changed Elasticsearch server settings, the defaults should work. Skip to the next step.

   Option	Description
   Elasticsearch Server Hostname	Enter the fully qualified host name or IP address of the machine running Elasticsearch. Magento Commerce (Cloud): Get this value from your integration system.
   Elasticsearch Server Port	Enter the Elasticsearch web server proxy port. In our example, the port is 8080 but if you're using a secure proxy, it's typically 443. Magento Commerce (Cloud): Get this value from your integration system.
   Elasticsearch Index Prefix	Enter the Elasticsearch index prefix. If you use a single Elasticsearch instance for more than one Magento installation (Staging and Production environments), you must specify a unique prefix for each installation. Otherwise, you can use the default prefix magento2.
   Enable Elasticsearch HTTP Auth	Click Yes only if you enabled authentication for your Elasticsearch server. If so, provide a user name and password in the provided fields.

5. Click Test Connection.

One of the following displays:

Result	Meaning
	Magento successfully connected to the Elasticsearch server. Continue with Configure Apache and Elasticsearch or Configure nginx and Elasticsearch.
	Try the following: Make sure the Elasticsearch server is running. If the Elasticsearch server is on a different host from Magento, log in to the Magento server and ping the Elasticsearch host. Resolve network connectivity issues and test the connection again. Examine the command window in which you started Elasticsearch for stack traces and exceptions. You must resolve those before you continue. In particular, make sure you started Elasticsearch as a user with root privileges. Make sure that UNIX firewall and SELinux are both disabled, or set up rules to enable Elasticsearch and Magento to communicate with each other. Verify the value of the Elasticsearch Server Hostname field. Make sure the server is available. You can try the server's IP address instead. Use the command netstat -an | grep listen-port command to verify that the port specified in the Elasticsearch Server Port field is not being used by another process. For example, to see if Elasticsearch is running on its default port, use the following command: netstat -an | grep 9200 If Elasticsearch is running on port 9200, it displays similar to the following: tcp 0 0 :::9200 :::* LISTEN

Reindexing catalog search and refreshing the full page cache

After you change Magento’s Elasticsearch configuration, you must reindex the catalog search index and refresh the full page using the Admin or command line.

To refresh the cache using the Admin:

1. In the Admin, click System > Cache Management.
2. Select the check box next to Page Cache.
3. From the Actions list in the upper right, click Refresh.
   The following figure shows an example.
   

To clean the cache using the command line, use the magento cache:clean command.

To reindex using the command line:

1. Log in to your Magento server as, or switch to, the Magento file system owner.

2. Enter any of the following commands:

   Enter the following command to reindex the catalog search index only:

   php <your Magento install dir>/bin magento indexer:reindex catalogsearch_fulltext
   

   Enter the following command to reindex all indexers:

   php <your Magento install dir>/bin magento indexer:reindex
   

3. Wait while the reindexing completes.

Secure communication with nginx

This section discusses how to set up HTTP Basic authentication with your secure proxy. Use of TLS and HTTP Basic authentication together prevents anyone from intercepting communication with Elasticsearch or with your Magento server.

Because nginx natively supports HTTP Basic authentication, we recommend it over, for example, Digest authentication, which isn’t recommended in production.

Additional resources:

• How To Set Up Password Authentication with Nginx on Ubuntu 14.04 (Digitalocean)
• Basic HTTP Authentication With Nginx (HowtoForge)
• Example Nginx Configurations for Elasticsearch

See the following sections for more information:

• Step 1: Create passwords
• Step 2: Set up access to nginx
• Step 3: Set up a restricted context for Elasticsearch
• Verify communication is secure

Step 1: Create a password

We recommend you use the Apache htpasswd command to encode passwords for a user with access to Elasticsearch (named magento_elasticsearch in this example).

To create a password:

1. Enter the following command to determine if htpasswd is already installed:

   which htpasswd
   

   If a path displays, it is installed; if the command returns no output, htpasswd is not installed.

2. If necessary, install htpasswd:

   • Ubuntu: apt-get -y install apache2-utils
   • CentOS: yum -y install httpd-tools

3. Create a /etc/nginx/passwd directory to store passwords:

   mkdir -p /etc/nginx/passwd
   htpasswd -c /etc/nginx/passwd/.<filename> <username>
   

   For security reasons, <filename> should be hidden; that is, it must start with a period. An example follows.

   Example:

   mkdir -p /etc/nginx/passwd
   htpasswd -c /etc/nginx/passwd/.magento_elasticsearch magento_elasticsearch
   

   Follow the prompts on your screen to create the user’s password.

4. (Optional). To add another user to your password file, enter the same command without the -c (create) option:

   htpasswd /etc/nginx/passwd/.<filename> <username>
   

5. Verify that the contents of /etc/nginx/passwd is correct.

Step 3: Set up access to nginx

This section discusses how to specify who can access the nginx server.

Use a text editor to modify either /etc/nginx/conf.d/magento_es_auth.conf (unsecure) or your secure server block with the following contents:

server {
	listen 8080;
	server_name 127.0.0.1;

	location / {
		limit_except HEAD {
		   auth_basic "Restricted";
		   auth_basic_user_file  /etc/nginx/passwd/.htpasswd_magento_elasticsearch;
		}
		proxy_pass http://127.0.0.1:9200;
		proxy_redirect off;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	}

	location /_aliases {
		auth_basic "Restricted";
		auth_basic_user_file  /etc/nginx/passwd/.htpasswd_magento_elasticsearch;
		proxy_pass http://127.0.0.1:9200;
		proxy_redirect off;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	}

	include /etc/nginx/auth/*.conf;
}

Step 4: Set up a restricted context for Elasticsearch

This section discusses how to specify who can access the Elasticsearch server.

1. Enter the following command to create a new directory to store the authentication configuration:

   mkdir /etc/nginx/auth/
   

2. Use a text editor to create a new file /etc/nginx/auth/magento_elasticsearch.conf with the following contents:

   location /elasticsearch {
   auth_basic "Restricted - elasticsearch";
   auth_basic_user_file /etc/nginx/passwd/.htpasswd_magento_elasticsearch;
   
   proxy_pass http://127.0.0.1:9200;
   proxy_redirect off;
   proxy_set_header Host $host;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   }
   

3. If you set up a secure proxy, delete /etc/nginx/conf.d/magento_es_auth.conf.

4. Restart nginx and continue with the next section:

   service nginx restart
   

curl -i http://<host name, ip, or localhost>:<proxy port>/_cluster/health

curl -i http://localhost:8080/_cluster/health

HTTP/1.1 401 Unauthorized
Date: Tue, 23 Feb 2016 20:35:29 GMT
Content-Type: text/html
Content-Length: 194
Connection: keep-alive
WWW-Authenticate: Basic realm="Restricted"

<html>
<head><title>401 Authorization Required</title></head>
<body bgcolor="white">
<center><h1>401 Authorization Required</h1></center>
</body>
</html>

curl -i -u <user name>:<password> http://<host name, ip, or localhost>:<proxy port>/_cluster/health

curl -i -u magento_elasticsearch:mypassword http://localhost:8080/_cluster/health

HTTP/1.1 200 OK
Date: Tue, 23 Feb 2016 20:38:03 GMT
Content-Type: application/json; charset=UTF-8
Content-Length: 389
Connection: keep-alive

{"cluster_name":"elasticsearch","status":"yellow","timed_out":false,"number_of_nodes":1,"number_of_data_nodes":1,"active_primary_shards":5,"active_shards":5,"relocating_shards":0,"initializing_shards":0,"unassigned_shards":5,"delayed_unassigned_shards":0,"number_of_pending_tasks":0,"number_of_in_flight_fetch":0,"task_max_waiting_in_queue_millis":0,"active_shards_percent_as_number":50.0}