This topic describes how to connect SQL Audit to an ElasticSearch data source.
Prerequisites
- Ensure the current OCP user is an admin, organization administrator, or cluster administrator.
- Ensure network connectivity between the OCP Agent and ES.
Procedure
Log in to OCP.
In the left navigation bar, click System Management > External Integration.
On the top ElasticSearch tab, click Create in the upper-right corner.
In the dialog box that appears, configure the following parameters.
ParameterDescriptionData Source Name 2 to 32 characters, can contain Chinese, English, numbers, and underscores. Access Address opensearch connection string. - For single-node, enter in the format ip:port, for example: 127.0.0.1:9200
- For multi-node, separate with commas. For example: ip1:port,ip2:port,ip3:port
Username opensearch cluster username. Password opensearch cluster user password. Remarks Optional. Click Verify in the lower-right corner of the dialog box.
After verification passes, click Create.
Related operations
Verify ElasticSearch data source: In the Data Source Actions column, click Verify. If verification passes, Verified. will be displayed after the data source name.
Edit ElasticSearch data source: In the Data Source Actions column, select ... > Edit, modify the relevant information in the dialog box that appears, then click Save.
Delete ElasticSearch data source: In the Data Source Actions column, select ... > Delete, then click OK in the dialog box that appears.
