> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/elasticsearch/elasticsearch-overview.md).

# Elasticsearch Overview

Elasticsearch is a distributed, open-source search and analytics engine for all types of data. It enables processing and storing large amounts of data.

When you migrate the objects that exist in Cortex XSOAR to Elasticsearch, they are moved to a designated index used by a specific Elasticsearch instance. Every Elasticsearch index is composed of at least one primary shard where the data is stored. A replica shard is a copy of a primary shard. Replicas provide redundant copies of your data to protect against hardware failure and increase capacity to serve read requests, like searching or retrieving data.

The following diagram depicts a Cortex XSOAR environment with Elasticsearch.

![xsoar-elasticsearch-install.png](/files/tl19pB25vqqENmccxDOY)

The number of primary shards in an index is fixed at the time that an index is created, but the number of replica shards can be changed at any time, without interrupting indexing or query operations.

To migrate your data to Elasticsearch, you must be running Cortex XSOAR and have an Elasticsearch installation available. We recommend installing Elasticsearch on a different server from Cortex XSOAR due to the high memory consumption for both services.

{% hint style="info" %}

### Note

As Elasticsearch is a separate product from Cortex XSOAR, it does not bundle or include an Elasticsearch license. You are responsible for:.

* Procuring a license: Obtain the appropriate Elasticsearch license from Elastic.
* Deployment and Management: Installing, configuring, and maintaining the Elasticsearch cluster according to both Elastic's and Cortex XSOAR's best practices.
* Compatibility: Ensuring the deployed Elasticsearch version is compatible with your specific version of Cortex XSOAR.
  {% endhint %}

You perform the migration by running the migration tool, which is a standalone binary file. The binary file must be run with either sudo or admin permission. The migration tool uses the `demisto.conf` file to read the following information:

* Database location
* Partitions data

{% hint style="warning" %}

### Caution

You must stop the Cortex XSOAR server before you run the migration tool. This enables the tool to safely access the database and required configurations.
{% endhint %}

The migration tool begins by reading the Cortex XSOAR database to identify existing partitions and custom fields. It then creates the index (if it does not already exist) based on the Elasticsearch configuration in the `demisto.conf` file, or based on the Elasticsearch default configurations set in the Elasticsearch cluster setting. After Elasticsearch is successfully configured, the tool reads each partition, from older to newer, and copies all objects to the index. Duplicate objects are overridden, taking only the latest version of the object.

When working with Elasticsearch, Cortex XSOAR does not maintain, nor is it responsible, for the following:

* Redundancy
* Backups
* Security
* Elasticsearch clusters

{% hint style="info" %}

### Note

Moving data from the Elasticsearch database back to the Cortex XSOAR Bolt database is not supported.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/elasticsearch/elasticsearch-overview.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.