> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/elasticsearch-overview.md).

# Elasticsearch Overview

Understand Cortex XSOAR 6.14 Elasticsearch deployments and how XSOAR data is migrated to Elasticsearch indices.

Elasticsearch is a distributed, open-source search and analytics engine for all types of data. It enables processing and storing large amounts of data.

When you migrate the objects that exist in Cortex XSOAR to Elasticsearch, they are moved to a designated index used by a specific Elasticsearch instance. Every Elasticsearch index is composed of at least one primary shard where the data is stored. A replica shard is a copy of a primary shard. Replicas provide redundant copies of your data to protect against hardware failure and increase capacity to serve read requests, like searching or retrieving data.

The following diagram depicts a Cortex XSOAR environment with Elasticsearch.

![xsoar-elasticsearch-install.png](https://3548014557-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOHlpKeFtqCLUYKuYyccd%2Fuploads%2Fgit-blob-c246cad3c84c27a6940ebb4c94d7dfc498f7fc46%2Ffde8f96c090a1cbdba6c9e36fae71be8215ecd2f91ea535eca523d6ecc6c7a1d.png?alt=media)

The number of primary shards in an index is fixed at the time that an index is created, but the number of replica shards can be changed at any time, without interrupting indexing or query operations.

To migrate your data to Elasticsearch, you must be running Cortex XSOAR and have an Elasticsearch installation available. We recommend installing Elasticsearch on a different server from Cortex XSOAR due to the high memory consumption for both services.

{% hint style="info" %}

### Note

As Elasticsearch is a separate product from Cortex XSOAR, it does not bundle or include an Elasticsearch license. You are responsible for:.

* Procuring a license: Obtain the appropriate Elasticsearch license from Elastic.
* Deployment and Management: Installing, configuring, and maintaining the Elasticsearch cluster according to both Elastic's and Cortex XSOAR's best practices.
* Compatibility: Ensuring the deployed Elasticsearch version is compatible with your specific version of Cortex XSOAR.
  {% endhint %}

You perform the migration by running the migration tool, which is a standalone binary file. The binary file must be run with either sudo or admin permission. The migration tool uses the `demisto.conf` file to read the following information:

* Database location
* Partitions data

{% hint style="warning" %}

### Caution

You must stop the Cortex XSOAR server before you run the migration tool. This enables the tool to safely access the database and required configurations.
{% endhint %}

The migration tool begins by reading the Cortex XSOAR database to identify existing partitions and custom fields. It then creates the index (if it does not already exist) based on the Elasticsearch configuration in the `demisto.conf` file, or based on the Elasticsearch default configurations set in the Elasticsearch cluster setting. After Elasticsearch is successfully configured, the tool reads each partition, from older to newer, and copies all objects to the index. Duplicate objects are overridden, taking only the latest version of the object.

When working with Elasticsearch, Cortex XSOAR does not maintain, nor is it responsible, for the following:

* Redundancy
* Backups
* Security
* Elasticsearch clusters

{% hint style="info" %}

### Note

Moving data from the Elasticsearch database back to the Cortex XSOAR Bolt database is not supported.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/elasticsearch-overview.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.