{"id":15151913,"url":"https://github.com/elastic/azure-marketplace","last_synced_at":"2025-09-29T22:31:18.884Z","repository":{"id":2750362,"uuid":"46870055","full_name":"elastic/azure-marketplace","owner":"elastic","description":"Elasticsearch Azure Marketplace offering + ARM template","archived":true,"fork":false,"pushed_at":"2023-03-30T21:56:22.000Z","size":83175,"stargazers_count":120,"open_issues_count":45,"forks_count":160,"subscribers_count":356,"default_branch":"master","last_synced_at":"2025-01-11T04:55:07.032Z","etag":null,"topics":["arm","arm-templates","azure","azure-marketplace","elasticsearch","kibana"],"latest_commit_sha":null,"homepage":"https://www.elastic.co/guide/en/elastic-stack-deploy/current/index.html","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/elastic.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2015-11-25T15:29:01.000Z","updated_at":"2024-05-07T13:20:13.000Z","dependencies_parsed_at":"2023-07-06T21:01:19.935Z","dependency_job_id":null,"html_url":"https://github.com/elastic/azure-marketplace","commit_stats":{"total_commits":571,"total_committers":22,"mean_commits":"25.954545454545453","dds":0.5884413309982487,"last_synced_commit":"ef3af3a17b84208940e87677e2af5cfdb23acf87"},"previous_names":[],"tags_count":61,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elastic%2Fazure-marketplace","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elastic%2Fazure-marketplace/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elastic%2Fazure-marketplace/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elastic%2Fazure-marketplace/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/elastic","download_url":"https://codeload.github.com/elastic/azure-marketplace/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":234673063,"owners_count":18869580,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["arm","arm-templates","azure","azure-marketplace","elasticsearch","kibana"],"created_at":"2024-09-26T15:40:27.263Z","updated_at":"2025-09-29T22:31:11.791Z","avatar_url":"https://github.com/elastic.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Elastic Stack Azure Marketplace offering\n\nEasily deploy the Elastic Stack of Elasticsearch, Kibana and Logstash to Azure.\n\n**IMPORTANT:** As a prefered solution, we recommend using our newer [Elastic Cloud (Elasticsearch Service)](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/elastic.ec-azure-pp?exp=ubp8\u0026tab=Overview) offering in the Azure Marketplace. To learn more, refer to the [Native Azure integration documentation](https://www.elastic.co/guide/en/cloud/current/ec-azure-marketplace-native.html).\n\nThis readme provides an overview of usage and features. For more comprehensive documentation, \nplease refer to the [**Azure Marketplace and ARM template documentation**](https://www.elastic.co/guide/en/elastic-stack-deploy/current/index.html)\n\nThis repository consists of:\n\n* [src/mainTemplate.json](src/mainTemplate.json) - The main Azure Resource Management (ARM) template. \nThe template itself is composed of many nested linked templates, with the main template acting as the entry point.\n* [src/createUiDefinition](src/createUiDefinition.json) - UI definition file for our Azure Marketplace offering. \nThis file produces an output JSON that the ARM template can accept as input parameters.\n\n## Building\n\nAfter pulling the source, call the following _once_\n\n```sh\nnpm install\n```\n\nto pull in all devDependencies. You may edit the [build/allowedValues.json](build/allowedValues.json) file, which the build uses to patch the ARM template and Marketplace UI definition. Then, run\n\n```sh\nnpm run build\n```\n\nwhich will validate EditorConfig settings, lint JSON files, patch the template using `build/allowedValues.json`, and create a zip in the `dist` folder.\nFor more details around developing the template, take a look at the [Development README](build/README.md)\n\n## Azure Marketplace\n\nThe [Azure Marketplace Elastic Stack offering](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/elastic.elasticsearch) offers a simplified UI and installation experience over the full power of the ARM template.\n\nIt will always bootstrap an Elasticsearch cluster complete with a trial license of the [Elastic Stack's platinum features](https://www.elastic.co/products/stack).\n\nDeploying through the Marketplace is great and easy way to get your feet wet for the first time with Elasticsearch on Azure, but in the long run, you'll want to deploy the templates directly from GitHub using the Azure CLI or PowerShell SDKs.\n\u003ca href=\"#command-line-deploy\"\u003eCheck out the CLI examples.\u003c/a\u003e\n\n---\n\n![Example UI Flow](images/ui.gif)\n\nYou can view the UI in developer mode by [clicking here](https://portal.azure.com/#blade/Microsoft_Azure_Compute/CreateMultiVmWizardBlade/internal_bladeCallId/anything/internal_bladeCallerParams/{\"initialData\":{},\"providerConfig\":{\"createUiDefinition\":\"https%3A%2F%2Fraw.githubusercontent.com%2Felastic%2Fazure-marketplace%2Fmaster%2Fsrc%2FcreateUiDefinition.json\"}}). If you feel something is cached improperly use [this client unoptimized link instead](https://portal.azure.com/?clientOptimizations=false#blade/Microsoft_Azure_Compute/CreateMultiVmWizardBlade/internal_bladeCallId/anything/internal_bladeCallerParams/{\"initialData\":{},\"providerConfig\":{\"createUiDefinition\":\"https%3A%2F%2Fraw.githubusercontent.com%2Felastic%2Fazure-marketplace%2Fmaster%2Fsrc%2FcreateUiDefinition.json\"}})\n\n## Reporting bugs\n\nHave a look at this [screenshot](images/error-output.png) to see how you can\nnavigate to the deployment error status message.\nPlease create an issue with that message and in which resource it occured on our\n[github issues](https://github.com/elastic/azure-marketplace/issues)\n\n## ARM template\n\nThe output from the Azure Marketplace UI is fed directly to the ARM deployment\ntemplate. You can use the ARM template independently, without going through the\nMarketplace. In fact, there are many features in the ARM template that are\nnot exposed within the Marketplace UI, such as configuring\n\n* Azure Storage account to use with Azure Repository plugin for Snapshot/Restore\n* Application Gateway to use for SSL/TLS and SSL offload\n\nCheck out our [**examples repository**](https://github.com/elastic/azure-marketplace-examples)\nfor examples of common scenarios and also take a look at the following blog\nposts for further information\n\n* [Spinning up a cluster with Elastic's Azure Marketplace template](https://www.elastic.co/blog/spinning-up-a-cluster-with-elastics-azure-marketplace-template)\n* [Elasticsearch and Kibana deployments on Azure](https://www.elastic.co/blog/elasticsearch-and-kibana-deployments-on-azure)\n* [SAML based Single Sign-On with Elasticsearch and Azure Active Directory](https://www.elastic.co/blog/saml-based-single-sign-on-with-elasticsearch-and-azure-active-directory?blade=tw\u0026hulk=social)\n\n### Elastic Stack features (formerly known as X-Pack)\n\nStarting with Elasticsearch, Kibana and Logstash 6.3.0, The template deploys with Elastic Stack features bundled as part of the deployment, and\nincludes the free features under the [Basic license](https://www.elastic.co/subscriptions) level.\nThe [`xpackPlugins`](#x-pack) parameter determines whether a self-generated trial license is applied,\noffering a trial period of 30 days to the Platinum license features. A value of `Yes` applies a trial license, a value of `No` applies the Basic license.\nThe license level applied determines the Elastic Stack features activated to use.\n\nFor Elasticsearch, Kibana and Logstash prior to 6.3.0, The [`xpackPlugins`](#x-pack) parameter determines whether X-Pack plugins are installed\nand a self-generated trial license is applied. In difference to 6.3.0 however, a value of `No` for `xpackPlugins` means that \nX-Pack plugins are not installed, and therefore does not provide the free features under the Basic license level, offering the Open Source features only.\nFor these versions, you can install X-Pack plugins and [**register for a free Basic license** to apply to the deployment](https://register.elastic.co/), in \norder to use the free features available under the Basic license level.\n\n## Parameters\n\nThe ARM template accepts a _lot_ of parameters, but don't fear! Most of them are **optional** and only used\nin conjunction with other parameters. Where a parameter value is not explicitly provided, it will take the default\nvalue defined in the template.\n\n\u003ctable\u003e\n  \u003ctr\u003e\u003cth\u003eParameter\u003c/td\u003e\u003cth\u003eType\u003c/th\u003e\u003cth\u003eDescription\u003c/th\u003e\u003cth\u003eDefault Value\u003c/th\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003e_artifactsLocation\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe base URI where artifacts required by this template are located, including a trailing '/'.\n    \u003cstrong\u003eUse to target a specific branch or release tag\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003eRaw content of the current branch\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003e_artifactsLocationSasToken\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eThe sasToken required to access \u003ccode\u003e_artifactsLocation\u003c/code\u003e. When the template is deployed using \n    the accompanying scripts, a sasToken will be automatically generated. Use the defaultValue if the staging location is not secured.\"\u003c/td\u003e\n    \u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003elocation\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe location where to provision all the items in this template. Defaults to inheriting the location\n    from the resource group. Any other value must be a valid \u003ca href=\"https://azure.microsoft.com/regions/\"\u003eAzure region\u003c/a\u003e.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e[resourceGroup().location]\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmHostNamePrefix\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe prefix to use for hostnames when naming virtual machines in the cluster. Hostnames are used for resolution of master nodes on the network, so if you are deploying a cluster into an existing virtual network containing an existing Elasticsearch cluster, be sure to set this to a unique prefix, to differentiate the hostnames of this cluster from an existing cluster. Can be up to 5 characters in length, must begin with an alphanumeric character and can contain alphanumeric and hyphen characters.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd colspan=\"4\" style=\"font-size:120%\"\u003e\u003cstrong\u003eElasticsearch related settings\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eesVersion\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eA valid supported Elasticsearch version for the target template version. See \u003ca href=\"https://github.com/elastic/azure-marketplace/blob/master/src/mainTemplate.json\"\u003ethis list for supported versions\u003c/a\u003e.\n    \u003cstrong\u003eRequired\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003eLatest version supported by target template version\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eesClusterName\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003e The name of the Elasticsearch cluster. \u003cstrong\u003eRequired\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eloadBalancerType\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003e The load balancer to set up to access the cluster. Can be \u003ccode\u003einternal\u003c/code\u003e, \u003ccode\u003eexternal\u003c/code\u003e or \u003ccode\u003egateway\u003c/code\u003e. \n    \u003cul\u003e\n    \u003cli\u003eBy choosing \u003ccode\u003einternal\u003c/code\u003e, only an internal load balancer is deployed. Useful when connecting to the cluster happens from inside the Virtual Network\u003c/li\u003e\n    \u003cli\u003eBy choosing \u003ccode\u003eexternal\u003c/code\u003e, both internal and external load balancers will be deployed. Kibana communicates with the cluster through the internal\n    load balancer.\u003c/li\u003e\n    \u003cli\u003eBy choosing \u003ccode\u003egateway\u003c/code\u003e, \u003ca href=\"https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-introduction\"\u003eApplication Gateway\u003c/a\u003e will be deployed for load balancing, \n    allowing a PKCS#12 archive (.pfx/.p12) containing the certificate and key to be supplied for SSL/TLS to and from Application Gateway, and providing SSL offload.\n    An internal load balancer will also deployed. Application Gateway and Kibana communicate with the cluster through the internal\n    load balancer.\u003c/li\u003e\n    \u003c/ul\u003e\n    \u003cp\u003e\u003cstrong\u003eIf you are setting up Elasticsearch or Kibana on a publicly available IP address, it is highly recommended to secure access to the cluster with a product like \n    \u003ca href=\"https://www.elastic.co/products/x-pack/security\"\u003eElastic Stack Security\u003c/a\u003e, in addition to configuring SSL/TLS.\u003c/strong\u003e\u003c/p\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003einternal\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eloadBalancerInternalSku\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe internal load balancer SKU. Can be \u003ccode\u003eBasic\u003c/code\u003e or \u003ccode\u003eStandard\u003c/code\u003e.\u003c/td\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eBasic\u003c/code\u003e\u003c/td\u003e. When the \u003ccode\u003eStandard\u003c/code\u003e load balanacer is selected,\n    and the \u003ccode\u003eloadBalancerType\u003c/code\u003e is \u003ccode\u003einternal\u003c/code\u003e, A Network Security Group is also deployed\n    and a public IP address attached to each VM network interface card in the backend pool, to allow\n    outbound internet traffic to install the Elastic Stack and dependencies.\n  \u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eloadBalancerExternalSku\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe external load balancer SKU. Can be \u003ccode\u003eBasic\u003c/code\u003e or \u003ccode\u003eStandard\u003c/code\u003e.\n      Only relevant when \u003ccode\u003eloadBalancerType\u003c/code\u003e is \u003ccode\u003eexternal\u003c/code\u003e. When the \u003ccode\u003eStandard\u003c/code\u003e \n      load balancer SKU is selected, the public IP address SKU attached to the external load balancer \n      will also be \u003ccode\u003eStandard\u003c/code\u003e. A Network Security Group is also deployed, to allow inbound internet traffic\n      to the load balancer backend pool.\n    \u003c/td\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eBasic\u003c/code\u003e\u003c/td\u003e\n  \u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd id=\"x-pack\"\u003expackPlugins\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eEither \u003ccode\u003eYes\u003c/code\u003e or \u003ccode\u003eNo\u003c/code\u003e to install a trial license of the \u003ca href=\"https://www.elastic.co/products/x-pack\"\u003eElastic Stack features (formerly X-Pack)\u003c/a\u003e\n    such as \u003ca href=\"https://www.elastic.co/products/stack/monitoring\"\u003eMonitoring\u003c/a\u003e, \u003ca href=\"https://www.elastic.co/products/stack/security\"\u003eSecurity\u003c/a\u003e, \u003ca href=\"https://www.elastic.co/products/stack/alerting\"\u003eAlerting\u003c/a\u003e, \u003ca href=\"https://www.elastic.co/products/stack/graph\"\u003eGraph\u003c/a\u003e, \u003ca href=\"https://www.elastic.co/products/stack/machine-learning\"\u003eMachine Learning (5.5.0+)\u003c/a\u003e and \u003ca href=\"https://www.elastic.co/products/stack/elasticsearch-sql\"\u003eSQL\u003c/a\u003e. If also installing Kibana, it will have \u003ca href=\"https://www.elastic.co/products/stack/reporting\"\u003eReporting\u003c/a\u003e and Profiler installed.\n    \u003cbr /\u003e\u003cbr /\u003e\n    A value of \u003ccode\u003eNo\u003c/code\u003e for Elasticsearch and Kibana prior to 6.3.0,\n    will include only the Open Source features.\n    \u003cbr /\u003e\u003cbr /\u003e\n    A value of \u003ccode\u003eNo\u003c/code\u003e for Elasticsearch and Kibana 6.3.0+\n    will include the \u003ca href=\"https://www.elastic.co/subscriptions\"\u003efree Basic license features.\u003c/a\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eYes\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eazureCloudPlugin\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eEither \u003ccode\u003eYes\u003c/code\u003e or \u003ccode\u003eNo\u003c/code\u003e to install the Azure Repository plugin for snapshot/restore. \n    When set to \u003ccode\u003eYes\u003c/code\u003e, at least \u003ccode\u003eazureCloudStorageAccountName\u003c/code\u003e \n    must be specified to configure the plugin correctly.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eNo\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eazureCloudStorageAccountName\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003e The name of an existing storage account to use for snapshots with Azure Repository plugin. \n    Must be a valid Azure Storage Account name.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eazureCloudStorageAccountResourceGroup\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003e The name of an existing resource group containing the storage account \u003ccode\u003eazureCloudStorageAccountName\u003c/code\u003e \n    to use for snapshots with Azure Repository plugin. Must be a valid Resource Group name.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eesAdditionalPlugins\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eAdditional Elasticsearch plugins to install. Each plugin must be separated by a semicolon. e.g. \u003ccode\u003eanalysis-icu;mapper-attachments\u003c/code\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eesAdditionalYaml\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eAdditional configuration for Elasticsearch yaml configuration file. Each line must be separated by a newline character \u003ccode\u003e\\n\u003c/code\u003e e.g. \u003ccode\u003e\"action.auto_create_index: +.*\\nindices.queries.cache.size: 5%\"\u003c/code\u003e. \u003cbr /\u003e\u003cbr /\u003e\u003cstrong\u003eThis is an expert level feature - It is recommended that you run your additional yaml through a \u003ca href=\"http://www.yamllint.com/\"\u003elinter\u003c/a\u003e before starting a deployment.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eesHeapSize\u003c/td\u003e\u003ctd\u003einteger\u003c/td\u003e\n    \u003ctd\u003eThe size, \u003cem\u003ein megabytes\u003c/em\u003e, of memory to allocate on each Elasticsearch node for the JVM heap. If unspecified, 50% of the available memory will be allocated to Elasticsearch heap, up to a maximum of 31744MB (~32GB). \n    Take a look at \u003ca href=\"https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html\" target=\"_blank\"\u003ethe Elasticsearch documentation\u003c/a\u003e for more information. \u003cbr /\u003e\u003cbr /\u003e \u003cstrong\u003eThis is an expert level feature - setting a heap size too low, or larger than available memory on the Elasticsearch VM SKU will fail the deployment.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e0\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eesHttpCertBlob\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eA Base-64 encoded form of the PKCS#12 archive (.p12/.pfx) containing the certificate and key to secure communication for HTTP layer to Elasticsearch. \u003cstrong\u003e\u003ccode\u003expackPlugins\u003c/code\u003e must be \u003ccode\u003eYes\u003c/code\u003e, or \u003ccode\u003eesVersion\u003c/code\u003e must be 6.8.0 or above (and less than 7.0.0) or 7.1.0 and above.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eesHttpCertPassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eThe password for the PKCS#12 archive (.p12/.pfx) containing the certificate and key to secure communication for HTTP layer to Elasticsearch. Optional as the archive may not be protected with a password. \u003cbr /\u003e\u003cbr /\u003e\n    If using \u003ccode\u003eesHttpCaCertBlob\u003c/code\u003e, this password will be used to protect the generated PKCS#12 archive on each node.\n    \u003cstrong\u003e\u003ccode\u003expackPlugins\u003c/code\u003e must be \u003ccode\u003eYes\u003c/code\u003e, or \u003ccode\u003eesVersion\u003c/code\u003e must be 6.8.0 or above (and less than 7.0.0) or 7.1.0 and above.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eesHttpCaCertBlob\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eA Base-64 encoded form of a PKCS#12 archive (.p12/.pfx) containing the Certificate Authority (CA) certificate and key to use to generate certificates on each Elasticsearch node, to secure communication for the HTTP layer to Elasticsearch. \u003cstrong\u003e\u003ccode\u003expackPlugins\u003c/code\u003e must be \u003ccode\u003eYes\u003c/code\u003e, or \u003ccode\u003eesVersion\u003c/code\u003e must be 6.8.0 or above (and less than 7.0.0) or 7.1.0 and above.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eesHttpCaCertPassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eThe password for the PKCS#12 archive (.p12/.pfx) containing the Certificate Authority (CA) certificate and key to secure communication for HTTP layer to Elasticsearch. Optional as the archive may not be be protected with a password. \u003cstrong\u003e\u003ccode\u003expackPlugins\u003c/code\u003e must be \u003ccode\u003eYes\u003c/code\u003e, or \u003ccode\u003eesVersion\u003c/code\u003e must be 6.8.0 or above (and less than 7.0.0) or 7.1.0 and above.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n  \n  \u003ctr\u003e\u003ctd\u003eesTransportCaCertBlob\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eA Base-64 encoded form of a PKCS#12 archive (.p12/.pfx) containing the Certificate Authority (CA) certificate and key to use to generate certificates on each Elasticsearch node, to secure communication for Transport layer to Elasticsearch. \u003cstrong\u003e\u003ccode\u003expackPlugins\u003c/code\u003e must be \u003ccode\u003eYes\u003c/code\u003e, or \u003ccode\u003eesVersion\u003c/code\u003e must be 6.8.0 or above (and less than 7.0.0) or 7.1.0 and above.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eesTransportCaCertPassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eThe password for the PKCS#12 archive (.p12/.pfx) containing the Certificate Authority (CA) certificate and key to secure communication for Transport layer to Elasticsearch. Optional as the archive may not be be protected with a password. \u003cstrong\u003e\u003ccode\u003expackPlugins\u003c/code\u003e must be \u003ccode\u003eYes\u003c/code\u003e, or \u003ccode\u003eesVersion\u003c/code\u003e must be 6.8.0 or above (and less than 7.0.0) or 7.1.0 and above.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eesTransportCertPassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eThe password to protect the generated PKCS#12 archive on each node. \u003cstrong\u003e\u003ccode\u003expackPlugins\u003c/code\u003e must be \u003ccode\u003eYes\u003c/code\u003e, or \u003ccode\u003eesVersion\u003c/code\u003e must be 6.8.0 or above (and less than 7.0.0) or 7.1.0 and above.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003esamlMetadataUri\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe URI from which the metadata file for the Identity Provider can be retrieved to configure SAML Single-Sign-On. For Azure Active Directory, this can be found in the Single-Sign-On settings of the Enterprise Application, and will look something like \u003ccode\u003ehttps://login.microsoftonline.com/\u0026lt;guid\u0026gt;/federationmetadata/2007-06/federationmetadata.xml?appid=\u0026lt;guid\u0026gt;\u003c/code\u003e\u003cul\u003e\n    \u003cli\u003e\u003cstrong\u003eSupported only for Elasticsearch 6.2.0+\u003c/strong\u003e\u003c/li\u003e\n    \u003cli\u003e\u003cstrong\u003eKibana must be installed\u003c/strong\u003e\u003c/li\u003e\n    \u003cli\u003e\u003cstrong\u003eX-Pack plugin must be installed with a level of license that enables the SAML realm.\u003c/strong\u003e\u003c/li\u003e\n    \u003cli\u003e\u003cstrong\u003eSSL/TLS must be configured for HTTP layer of Elasticsearch\u003c/strong\u003e\u003c/li\u003e\u003c/ul\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003esamlServiceProviderUri\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe public URI for the Service Provider to configure SAML Single-Sign-On. If \u003ccode\u003esamlMetadataUri\u003c/code\u003e is provided but no value is provided for \u003ccode\u003esamlServiceProviderUri\u003c/code\u003e, the public domain name for the deployed Kibana instance will be used.\u003cul\u003e\n    \u003cli\u003e\u003cstrong\u003eSupported only for Elasticsearch 6.2.0+\u003c/strong\u003e\u003c/li\u003e\n    \u003cli\u003e\u003cstrong\u003eKibana must be installed\u003c/strong\u003e\u003c/li\u003e\n    \u003cli\u003e\u003cstrong\u003eSSL/TLS must be configured for HTTP layer of Elasticsearch\u003c/strong\u003e\u003c/li\u003e\u003c/ul\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd colspan=\"4\" style=\"font-size:120%\"\u003e\u003cstrong\u003e\u003ca href=\"https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html#master-node\"\u003eMaster node\u003c/a\u003e related settings\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmSizeMasterNodes\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eAzure VM size of dedicated master nodes. See \u003ca href=\"https://github.com/elastic/azure-marketplace/blob/master/build/allowedValues.json\"\u003ethis list for supported sizes\u003c/a\u003e. By default the template deploys 3 dedicated master nodes, unless \u003ccode\u003edataNodesAreMasterEligible\u003c/code\u003e is set to \u003ccode\u003eYes\u003c/code\u003e.\n    \u003cstrong\u003eCheck that the size you choose is \u003ca href=\"https://azure.microsoft.com/en-au/regions/services/\"\u003eavailable in the region you choose\u003c/a\u003e\u003c/strong\u003e.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eStandard_DS1_v2\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmMasterNodeAcceleratedNetworking\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eWhether to enable \u003ca href=\"https://azure.microsoft.com/en-us/blog/maximize-your-vm-s-performance-with-accelerated-networking-now-generally-available-for-both-windows-and-linux/\"\u003eaccelerated networking\u003c/a\u003e for Master nodes, which enables single root I/O virtualization (SR-IOV) \n    to a VM, greatly improving its networking performance. Valid values are\n    \u003cul\u003e\n      \u003cli\u003e\u003ccode\u003eDefault\u003c/code\u003e: enables accelerated networking for VMs known to support it\u003c/li\u003e\n      \u003cli\u003e\u003ccode\u003eYes\u003c/code\u003e: enables accelerated networking.\u003c/li\u003e\n      \u003cli\u003e\u003ccode\u003eNo\u003c/code\u003e: does not enable accelerated networking\u003c/li\u003e\n    \u003c/ul\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eDefault\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd colspan=\"4\" style=\"font-size:120%\"\u003e\u003cstrong\u003e\u003ca href=\"https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html#data-node\"\u003eData node\u003c/a\u003e related settings\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003edataNodesAreMasterEligible\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eEither \u003ccode\u003eYes\u003c/code\u003e or \u003ccode\u003eNo\u003c/code\u003e to make all data nodes master eligible. This can be useful for small Elasticsearch clusters however, for larger clusters it is recommended to have dedicated master nodes.\n    When \u003ccode\u003eYes\u003c/code\u003e no dedicated master nodes will be provisioned.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eNo\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmSizeDataNodes\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eAzure VM size of the data nodes. See \u003ca href=\"https://github.com/elastic/azure-marketplace/blob/master/build/allowedValues.json\"\u003ethis list for supported sizes\u003c/a\u003e.\n    \u003cstrong\u003eCheck that the size you choose is \u003ca href=\"https://azure.microsoft.com/en-au/regions/services/\"\u003eavailable in the region you choose\u003c/a\u003e\u003c/strong\u003e.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eStandard_DS1_v2\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmDataNodeAcceleratedNetworking\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eWhether to enable \u003ca href=\"https://azure.microsoft.com/en-us/blog/maximize-your-vm-s-performance-with-accelerated-networking-now-generally-available-for-both-windows-and-linux/\"\u003eaccelerated networking\u003c/a\u003e for Data nodes, which enables single root I/O virtualization (SR-IOV) \n    to a VM, greatly improving its networking performance. Valid values are\n    \u003cul\u003e\n      \u003cli\u003e\u003ccode\u003eDefault\u003c/code\u003e: enables accelerated networking for VMs known to support it\u003c/li\u003e\n      \u003cli\u003e\u003ccode\u003eYes\u003c/code\u003e: enables accelerated networking.\u003c/li\u003e\n      \u003cli\u003e\u003ccode\u003eNo\u003c/code\u003e: does not enable accelerated networking\u003c/li\u003e\n    \u003c/ul\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eDefault\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmDataNodeCount\u003c/td\u003e\u003ctd\u003eint\u003c/td\u003e\n    \u003ctd\u003eThe number of data nodes you wish to deploy. \u003cstrong\u003eMust be greater than 0\u003c/strong\u003e.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e3\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd colspan=\"4\" style=\"font-size:120%\"\u003e\u003cstrong\u003eData node disk related settings\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmDataDiskCount\u003c/td\u003e\u003ctd\u003eint\u003c/td\u003e\n    \u003ctd\u003eNumber of \u003ca href=\"https://azure.microsoft.com/en-au/services/managed-disks/\"\u003emanaged disks\u003c/a\u003e to attach to each data node in RAID 0 setup.\n    Must be equal to or greater than \u003ccode\u003e0\u003c/code\u003e.\n    \u003cp\u003eIf the number of disks selected is more than can be attached to the data node VM (SKU) size,\n    the maximum number of disks that can be attached for the data node VM (sku) size will be used. Equivalent to\n    taking \u003ccode\u003emin(vmDataDiskCount, max supported disks for data node VM size)\u003c/code\u003e\u003c/p\u003e\n    \u003cul\u003e\n    \u003cli\u003eWhen 1 disk is selected, the disk is not RAIDed.\u003c/li\u003e\n    \u003cli\u003eWhen 0 disks are selected, no disks will be attached to each data node. Instead, the temporary disk will be used to store Elasticsearch data.\n    \u003cstrong\u003eThe temporary disk is ephemeral in nature and not persistent. Consult \u003ca href=\"https://blogs.msdn.microsoft.com/mast/2013/12/06/understanding-the-temporary-drive-on-windows-azure-virtual-machines/\"\u003eMicrosoft Azure documentation on temporary disks\u003c/a\u003e\n    to understand the trade-offs in using it for storage.\u003c/strong\u003e\n    \u003c/li\u003e\n    \u003c/ul\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://docs.microsoft.com/en-us/azure/virtual-machines/linux/sizes\"\u003eMaximum number supported disks for data node VM size\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmDataDiskSize\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe disk size of each attached disk. Choose \u003ccode\u003e32TiB\u003c/code\u003e, \u003ccode\u003e16TiB\u003c/code\u003e, \u003ccode\u003e8TiB\u003c/code\u003e, \u003ccode\u003e4TiB\u003c/code\u003e, \u003ccode\u003e2TiB\u003c/code\u003e, \u003ccode\u003e1TiB\u003c/code\u003e, \u003ccode\u003e512GiB\u003c/code\u003e, \u003ccode\u003e256GiB\u003c/code\u003e, \u003ccode\u003e128GiB\u003c/code\u003e, \u003ccode\u003e64GiB\u003c/code\u003e or \u003ccode\u003e32GiB\u003c/code\u003e.\n    For Premium Storage, disk sizes equate to \u003ca href=\"https://docs.microsoft.com/en-us/azure/storage/storage-premium-storage#premium-storage-disks-limits\"\u003eP80, P70, P60, P50, P40, P30, P20, P15, P10 and P6\u003c/a\u003e\n    storage disk types, respectively.\n    \u003c/td\u003e\n  \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e1TiB\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003estorageAccountType\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe storage account type of the attached disks. Choose either \u003ccode\u003eDefault\u003c/code\u003e or \u003ccode\u003eStandard\u003c/code\u003e. \n    The \u003ccode\u003eDefault\u003c/code\u003e storage account type will be Premium Storage for VMs that \n    support Premium Storage and Standard Storage for those that do not. \u003ccode\u003eStandard\u003c/code\u003e will use Standard Storage.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eDefault\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd colspan=\"4\" style=\"font-size:120%\"\u003e\u003cstrong\u003e\u003ca href=\"https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html#coordinating-only-node\"\u003eCoordinating node\u003c/a\u003e related settings\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmClientNodeCount\u003c/td\u003e\u003ctd\u003eint\u003c/td\u003e\n    \u003ctd\u003e The number of coordinating nodes to provision. Must be a positive integer. By default, the data nodes are added to the backend pool of the loadbalancer but\n    if you provision coordinating nodes, these will be added to the loadbalancer instead. Coordinating nodes can be useful in offloading the \u003cem\u003egather\u003c/em\u003e process from data nodes and are necessary to scale an Elasticsearch cluster deployed with this template beyond 100 data nodes (the maximum number of VMs that can be added to a load balancer backend pool).\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e0\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmSizeClientNodes\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003e Azure VM size of the coordinating nodes see \u003ca href=\"https://github.com/elastic/azure-marketplace/blob/master/build/allowedValues.json\"\u003ethis list for supported sizes\u003c/a\u003e.\n    \u003cstrong\u003eCheck that the size you choose is \u003ca href=\"https://azure.microsoft.com/en-au/regions/services/\"\u003eavailable in the region you choose\u003c/a\u003e\u003c/strong\u003e.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eStandard_DS1_v2\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmClientNodeAcceleratedNetworking\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eWhether to enable \u003ca href=\"https://azure.microsoft.com/en-us/blog/maximize-your-vm-s-performance-with-accelerated-networking-now-generally-available-for-both-windows-and-linux/\"\u003eaccelerated networking\u003c/a\u003e for coordinating nodes, which enables single root I/O virtualization (SR-IOV) \n    to a VM, greatly improving its networking performance. Valid values are\n    \u003cul\u003e\n      \u003cli\u003e\u003ccode\u003eDefault\u003c/code\u003e: enables accelerated networking for VMs known to support it\u003c/li\u003e\n      \u003cli\u003e\u003ccode\u003eYes\u003c/code\u003e: enables accelerated networking.\u003c/li\u003e\n      \u003cli\u003e\u003ccode\u003eNo\u003c/code\u003e: does not enable accelerated networking\u003c/li\u003e\n    \u003c/ul\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eDefault\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd colspan=\"4\" style=\"font-size:120%\"\u003e\u003cstrong\u003eSecurity related settings\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eadminUsername\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eAdmin username used when provisioning virtual machines. Must be a valid Linux username i.e. \u003ca target=\"_blank\" href=\"https://azure.microsoft.com/en-us/documentation/articles/virtual-machines-linux-usernames/#ubuntu\"\u003eavoid any of the following usernames for Ubuntu\u003c/a\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eauthenticationType\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe authentication type for the Admin user. Either \u003ccode\u003epassword\u003c/code\u003e or \u003ccode\u003esshPublicKey\u003c/code\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003epassword\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eadminPassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eWhen \u003ccode\u003eauthenticationType\u003c/code\u003e is \u003ccode\u003epassword\u003c/code\u003e this sets the OS level user's password\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003esshPublicKey\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eWhen \u003ccode\u003eauthenticationType\u003c/code\u003e is \u003ccode\u003esshPublicKey\u003c/code\u003e this sets the OS level sshKey that can be used to login.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003esecurityBootstrapPassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eSecurity password for 6.x \u003ca href=\"https://www.elastic.co/guide/en/elasticsearch/reference/current/built-in-users.html#bootstrap-elastic-passwords\"\u003e\u003ccode\u003ebootstrap.password\u003c/code\u003e key\u003c/a\u003e that is added to the keystore. If no value is supplied, a 13 character password\n    will be generated using the ARM template \u003ccode\u003euniqueString()\u003c/code\u003e function. The bootstrap password is used to seed the built-in\n    users. Used only in 6.0.0+\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003esecurityAdminPassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eSecurity password Admin user.\n    \u003cbr /\u003e\n    This is the built-in \u003ccode\u003eelastic\u003c/code\u003e user.\n    \u003cbr /\u003e\n    should be a minimum of 12 characters, and must be greater than 6 characters.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003esecurityKibanaPassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eSecurity password Kibana.\n    \u003cbr /\u003e\n     This is the built-in \u003ccode\u003ekibana\u003c/code\u003e user.\n    \u003cbr /\u003e\n    should be a minimum of 12 characters, and must be greater than 6 characters.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003esecurityLogstashPassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eThis is the built-in \u003ccode\u003elogstash_system\u003c/code\u003e user.\n    \u003cbr /\u003e\n    should be a minimum of 12 characters, and must be greater than 6 characters.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003esecurityBeatsPassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eThis is the built-in \u003ccode\u003ebeats_system\u003c/code\u003e user. Valid for Elasticsearch 6.3.0+\n    \u003cbr /\u003e\n    should be a minimum of 12 characters, and must be greater than 6 characters.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003esecurityApmPassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eThis is the built-in \u003ccode\u003eapm_system\u003c/code\u003e user. Valid for Elasticsearch 6.5.0+\n    \u003cbr /\u003e\n    should be a minimum of 12 characters, and must be greater than 6 characters.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n  \n  \u003ctr\u003e\u003ctd\u003esecurityRemoteMonitoringPassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eThis is the built-in \u003ccode\u003eremote_monitoring_user\u003c/code\u003e user. Valid for Elasticsearch 6.5.0+\n    \u003cbr /\u003e\n    should be a minimum of 12 characters, and must be greater than 6 characters.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd colspan=\"4\" style=\"font-size:120%\"\u003e\u003cstrong\u003eKibana related settings\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003ekibana\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eEither \u003ccode\u003eYes\u003c/code\u003e or \u003ccode\u003eNo\u003c/code\u003e to provision a machine with Kibana installed and a public IP address to access it.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eYes\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmSizeKibana\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eAzure VM size of the Kibana instance. See \u003ca href=\"https://github.com/elastic/azure-marketplace/blob/master/build/allowedValues.json\"\u003ethis list for supported sizes\u003c/a\u003e.\n    \u003cstrong\u003eCheck that the size you select is \u003ca href=\"https://azure.microsoft.com/en-au/regions/services/\"\u003eavailable in the region you choose\u003c/a\u003e\u003c/strong\u003e.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eStandard_A2_v2\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmKibanaAcceleratedNetworking\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eWhether to enable \u003ca href=\"https://azure.microsoft.com/en-us/blog/maximize-your-vm-s-performance-with-accelerated-networking-now-generally-available-for-both-windows-and-linux/\"\u003eaccelerated networking\u003c/a\u003e for Kibana, which enables single root I/O virtualization (SR-IOV) \n    to a VM, greatly improving its networking performance. Valid values are\n    \u003cul\u003e\n      \u003cli\u003e\u003ccode\u003eDefault\u003c/code\u003e: enables accelerated networking for VMs known to support it\u003c/li\u003e\n      \u003cli\u003e\u003ccode\u003eYes\u003c/code\u003e: enables accelerated networking.\u003c/li\u003e\n      \u003cli\u003e\u003ccode\u003eNo\u003c/code\u003e: does not enable accelerated networking\u003c/li\u003e\n    \u003c/ul\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eDefault\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003ekibanaCertBlob\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eA Base-64 encoded form of the certificate (.crt) in PEM format to secure HTTPS communication between the browser and Kibana.\u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003ekibanaKeyBlob\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eA Base-64 encoded form of the private key (.key) in PEM format to secure HTTPS communication between the browser and Kibana.\u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003ekibanaKeyPassphrase\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eThe passphrase to decrypt the private key. Optional as the key may not be encrypted.\u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003ekibanaAdditionalYaml\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eAdditional configuration for Kibana yaml configuration file. Each line must be separated by a \u003ccode\u003e\\n\u003c/code\u003e newline character e.g. \u003ccode\u003e\"server.name: \\\"My server\\\"\\nkibana.defaultAppId: home\"\u003c/code\u003e. \u003cbr /\u003e\u003cbr /\u003e\u003cstrong\u003eThis is an expert level feature - It is recommended that you run your additional yaml through a \u003ca href=\"http://www.yamllint.com/\"\u003elinter\u003c/a\u003e before starting a deployment.\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd colspan=\"4\" style=\"font-size:120%\"\u003e\u003cstrong\u003eLogstash related settings\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003elogstash\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eEither \u003ccode\u003eYes\u003c/code\u003e or \u003ccode\u003eNo\u003c/code\u003e to provision Logstash VMs.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eNo\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmSizeLogstash\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eAzure VM size of the Logstash instance. See \u003ca href=\"https://github.com/elastic/azure-marketplace/blob/master/build/allowedValues.json\"\u003ethis list for supported sizes\u003c/a\u003e.\n    \u003cstrong\u003eCheck that the size you select is \u003ca href=\"https://azure.microsoft.com/en-au/regions/services/\"\u003eavailable in the region you choose\u003c/a\u003e\u003c/strong\u003e.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eStandard_DS1_v2\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmLogstashCount\u003c/td\u003e\u003ctd\u003eint\u003c/td\u003e\n    \u003ctd\u003eThe number of Logstash instances\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e1\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evmLogstashAcceleratedNetworking\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eWhether to enable \u003ca href=\"https://azure.microsoft.com/en-us/blog/maximize-your-vm-s-performance-with-accelerated-networking-now-generally-available-for-both-windows-and-linux/\"\u003eaccelerated networking\u003c/a\u003e for Logstash, which enables single root I/O virtualization (SR-IOV) \n    to a VM, greatly improving its networking performance. Valid values are\n    \u003cul\u003e\n      \u003cli\u003e\u003ccode\u003eDefault\u003c/code\u003e: enables accelerated networking for VMs known to support it\u003c/li\u003e\n      \u003cli\u003e\u003ccode\u003eYes\u003c/code\u003e: enables accelerated networking.\u003c/li\u003e\n      \u003cli\u003e\u003ccode\u003eNo\u003c/code\u003e: does not enable accelerated networking\u003c/li\u003e\n    \u003c/ul\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eDefault\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003elogstashHeapSize\u003c/td\u003e\u003ctd\u003einteger\u003c/td\u003e\n    \u003ctd\u003eThe size, \u003cem\u003ein megabytes\u003c/em\u003e, of memory to allocate for the JVM heap for Logstash. If unspecified, Logstash will be configured with the default heap size for the distribution and version. \n    Take a look at \u003ca href=\"https://www.elastic.co/guide/en/logstash/current/tuning-logstash.html#profiling-the-heap\" target=\"_blank\"\u003ethe Logstash documentation\u003c/a\u003e on profiling heap size for more information. \u003cbr /\u003e\u003cbr /\u003e \u003cstrong\u003eThis is an expert level feature - setting a heap size too low, or larger than available memory on the Logstash VM SKU will fail the deployment.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e0\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003elogstashConf\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eA Base-64 encoded form of a \u003ca href=\"https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html#configuration-file-structure\" target=\"_blank\"\u003eLogstash config file\u003c/a\u003e to deploy.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e  \n\n  \u003ctr\u003e\u003ctd\u003elogstashKeystorePassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eThe password to protect the Logstash keystore. If no value is supplied, a value will be generated using the ARM template \u003ccode\u003euniqueString()\u003c/code\u003e function. Used only in 6.2.0+\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e  \n\n  \u003ctr\u003e\u003ctd\u003elogstashAdditionalPlugins\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eAdditional Logstash plugins to install. Each plugin must be separated by a semicolon. e.g. \u003ccode\u003elogstash-input-heartbeat;logstash-input-twitter\u003c/code\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003elogstashAdditionalYaml\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eAdditional configuration for Logstash yaml configuration file. Each line must be separated by a newline character \u003ccode\u003e\\n\u003c/code\u003e e.g. \u003ccode\u003e\"pipeline.batch.size: 125\\npipeline.batch.delay: 50\"\u003c/code\u003e. \u003cbr /\u003e\u003cbr /\u003e\u003cstrong\u003eThis is an expert level feature - It is recommended that you run your additional yaml through a \u003ca href=\"http://www.yamllint.com/\"\u003elinter\u003c/a\u003e before starting a deployment.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e  \n\n  \u003ctr\u003e\u003ctd colspan=\"4\" style=\"font-size:120%\"\u003e\u003cstrong\u003eJumpbox related settings\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003ejumpbox\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eEither \u003ccode\u003eYes\u003c/code\u003e or \u003ccode\u003eNo\u003c/code\u003e to optionally add a virtual machine with a public IP to the deployment, which you can use to connect and manage virtual machines on the internal network.\n    \u003cstrong\u003eNOTE:\u003c/strong\u003e If you are deploying Kibana, the Kibana VM can act\n    as a jumpbox, so a separate jumpbox VM is not needed.\n  \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eNo\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd colspan=\"4\" style=\"font-size:120%\"\u003e\u003cstrong\u003eVirtual network related settings\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evNetNewOrExisting\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eWhether the Virtual Network is \u003ccode\u003enew\u003c/code\u003e or \u003ccode\u003eexisting\u003c/code\u003e. An \u003ccode\u003eexisting\u003c/code\u003e Virtual Network in\n    another Resource Group in the same Location can be used.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003enew\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evNetName\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe name of the Virtual Network.\n    \u003cstrong\u003eThe Virtual Network must already exist when using an \u003ccode\u003eexisting\u003c/code\u003e Virtual Network\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003ees-net\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evNetExistingResourceGroup\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe name of the Resource Group in which the Virtual Network resides when using an existing Virtual Network.\n    \u003cstrong\u003eRequired when using an \u003ccode\u003eexisting\u003c/code\u003e Virtual Network\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evNetNewAddressPrefix\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe address prefix when creating a new Virtual Network. \u003cstrong\u003eRequired when creating a new Virtual Network\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e10.0.0.0/24\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evNetLoadBalancerIp\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe internal static IP address to use when configuring the internal load balancer. Must be an available\n    IP address on the provided \u003ccode\u003evNetClusterSubnetName\u003c/code\u003e.\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e10.0.0.4\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evNetClusterSubnetName\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe name of the subnet to which Elasticsearch nodes will be attached.\n    \u003cstrong\u003eThe subnet must already exist when using an \u003ccode\u003eexisting\u003c/code\u003e Virtual Network\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003ees-subnet\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evNetNewClusterSubnetAddressPrefix\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe address space of the subnet.\n    \u003cstrong\u003eRequired when creating a \u003ccode\u003enew\u003c/code\u003e Virtual Network\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e10.0.0.0/25\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evNetAppGatewaySubnetName\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eSubnet name to use for the Application Gateway. \n    \u003cstrong\u003eRequired when selecting \u003ccode\u003egateway\u003c/code\u003e for load balancing.\u003c/strong\u003e\u003cbr /\u003e\n    \u003cstrong\u003eThe subnet must already exist when using an \u003ccode\u003eexisting\u003c/code\u003e Virtual Network\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003ees-gateway-subnet\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003evNetNewAppGatewaySubnetAddressPrefix\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe address space of the Application Gateway subnet.\n    \u003cstrong\u003eRequired when creating a \u003ccode\u003enew\u003c/code\u003e Virtual Network and selecting \u003ccode\u003egateway\u003c/code\u003e for load balancing.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e10.0.0.128/28\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n   \u003ctr\u003e\u003ctd colspan=\"4\" style=\"font-size:120%\"\u003e\u003cstrong\u003eApplication Gateway related settings\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\n\n   \u003ctr\u003e\u003ctd\u003eappGatewayTier\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe tier of the Application Gateway, either \u003ccode\u003eStandard\u003c/code\u003e or \u003ccode\u003eWAF\u003c/code\u003e.\n    \u003cstrong\u003eRequired when selecting \u003ccode\u003egateway\u003c/code\u003e for load balancing.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eStandard\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n   \u003ctr\u003e\u003ctd\u003eappGatewaySku\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe size of the Application Gateway. Choose \u003ccode\u003eSmall\u003c/code\u003e, \u003ccode\u003eMedium\u003c/code\u003e or \u003ccode\u003eLarge\u003c/code\u003e. \n    When choosing appGatewayTier \u003ccode\u003eWAF\u003c/code\u003e, the size must be at least \u003ccode\u003eMedium\u003c/code\u003e.\n    \u003cstrong\u003eRequired when selecting \u003ccode\u003egateway\u003c/code\u003e for load balancing.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eMedium\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n   \u003ctr\u003e\u003ctd\u003eappGatewayCount\u003c/td\u003e\u003ctd\u003eint\u003c/td\u003e\n    \u003ctd\u003eThe number instances of the Application Gateway. Can be a value between \u003ccode\u003e1\u003c/code\u003e and \u003ccode\u003e10\u003c/code\u003e.\n    A minimum of \u003ccode\u003e2\u003c/code\u003e is recommended for production.\n    \u003cstrong\u003eRequired when selecting \u003ccode\u003egateway\u003c/code\u003e for load balancing.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e2\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n   \u003ctr\u003e\u003ctd\u003eappGatewayCertBlob\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eA Base-64 encoded form of the PKCS#12 archive (.p12/.pfx) containing the certificate and key for Application Gateway.\n    This certificate is used to secure HTTPS connections to and from the Application Gateway.\n    \u003cstrong\u003eRequired when selecting \u003ccode\u003egateway\u003c/code\u003e for load balancing.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n   \u003ctr\u003e\u003ctd\u003eappGatewayCertPassword\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eThe password for the PKCS#12 archive (.p12/.pfx) containing the certificate and key for Application Gateway.\n    \u003cstrong\u003eRequired when selecting \u003ccode\u003egateway\u003c/code\u003e for load balancing.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n  \u003ctr\u003e\u003ctd\u003eappGatewayEsHttpCertBlob\u003c/td\u003e\u003ctd\u003esecurestring\u003c/td\u003e\n    \u003ctd\u003eThe Base-64 encoded public certificate (.cer) used to secure the HTTP layer of Elasticsearch. Used by the Application Gateway to whitelist certificates used by the backend pool. Required when using \u003ccode\u003eesHttpCertBlob\u003c/code\u003e to secure the HTTP layer of Elasticsearch and selecting \u003ccode\u003egateway\u003c/code\u003e for load balancing. \u003cstrong\u003eX-Pack plugin must be installed\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003e\"\"\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n   \u003ctr\u003e\u003ctd\u003eappGatewayWafStatus\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe firewall status of the Application Gateway, either \u003ccode\u003eEnabled\u003c/code\u003e or \u003ccode\u003eDisabled\u003c/code\u003e.\n    \u003cstrong\u003eRequired when selecting \u003ccode\u003egateway\u003c/code\u003e for load balancing and using appGatewayTier \u003ccode\u003eWAF\u003ccode\u003e.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eEnabled\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n   \u003ctr\u003e\u003ctd\u003eappGatewayWafMode\u003c/td\u003e\u003ctd\u003estring\u003c/td\u003e\n    \u003ctd\u003eThe firewall mode of the Application Gateway, either \u003ccode\u003eDetection\u003c/code\u003e or \u003ccode\u003ePrevention\u003c/code\u003e.\n    \u003cstrong\u003eRequired when selecting \u003ccode\u003egateway\u003c/code\u003e for load balancing and using appGatewayTier \u003ccode\u003eWAF\u003ccode\u003e.\u003c/strong\u003e\n    \u003c/td\u003e\u003ctd\u003e\u003ccode\u003eDetection\u003c/code\u003e\u003c/td\u003e\u003c/tr\u003e\n\n\u003c/table\u003e\n\n### Web based deploy\n\n\u003ca href=\"https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Felastic%2Fazure-marketplace%2Fmaster%2Fsrc%2FmainTemplate.json\" target=\"_blank\"\u003e\n   \u003cimg alt=\"Deploy to Azure\" src=\"http://azuredeploy.net/deploybutton.png\"/\u003e\n\u003c/a\u003e\n\nThe above button will take you to the autogenerated web based UI based on the \nparameters from the ARM template.\n\n### Command line deploy\n\nYou can deploy using the template directly from Github using the Azure CLI or Azure PowerShell\n\n### Azure CLI 1.0\n\nAzure CLI 1.0 is no longer supported as the `apiVersion`s of resources are newer than those\nsupported by the last release. It's recommended to update to [Azure CLI 2.0](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest).\n\n### Azure CLI 2.0\n\n1. Log into Azure\n\n```sh\n  az login\n```\n2. Create a resource group `\u003cname\u003e` in a `\u003clocation\u003e` (e.g `westeurope`) where we can deploy too\n\n  ```sh\n  az group create --name \u003cname\u003e --location \u003clocation\u003e\n  ```\n\n3. Use our template directly from GitHub using `--template-uri`\n\n```sh\naz group deployment create \\\n  --resource-group \u003cname\u003e \\\n  --template-uri https://raw.githubusercontent.com/elastic/azure-marketplace/master/src/mainTemplate.json \\\n  --parameters @parameters/password.parameters.json\n```\n\nwhere `\u003cname\u003e` refers to the resource group you just created.\n\n### Azure PowerShell\n\n1. Log into Azure\n\n  ```powershell\n  Login-AzureRmAccount\n  ```\n\n2. Select a Subscription Id\n\n  ```powershell\n  Select-AzureRmSubscription -SubscriptionId \"\u003csubscriptionId\u003e\"\n  ```\n\n3. Define the parameters object for your deployment as a PowerShell hashtable. The keys\n  correspond the parameters defined in the [Parameters section](#parameters)\n\n  ```powershell\n  $branch = \"master\"\n  $esVersion = \"7.11.1\"\n\n  $clusterParameters = @{\n      \"_artifactsLocation\" = \"https://raw.githubusercontent.com/elastic/azure-marketplace/$branch/src/\"\n      \"esVersion\" = $esVersion\n      \"esClusterName\" = \"elasticsearch\"\n      \"loadBalancerType\" = \"internal\"\n      \"vmDataDiskCount\" = 1\n      \"adminUsername\" = \"russ\"\n      \"adminPassword\" = \"Password1234\"\n      \"securityBootstrapPassword\" = \"Password1234\"\n      \"securityAdminPassword\" = \"Password1234\"     \n      \"securityKibanaPassword\" = \"Password1234\"\n      \"securityLogstashPassword\" = \"Password1234\"\n      \"securityBeatsPassword\" = \"Password1234\"\n      \"securityApmPassword\" = \"Password1234\"\n      \"securityRemoteMonitoringPassword\" = \"Password1234\"\n  }\n  ```\n\n4. Create a resource group `\u003cname\u003e` in a `\u003clocation\u003e` (e.g `westeurope`) where we can deploy too\n\n  ```powershell\n  New-AzureRmResourceGroup -Name \"\u003cname\u003e\" -Location \"\u003clocation\u003e\"\n  ```\n\n5. Use our template directly from GitHub\n\n  ```powershell\n  New-AzureRmResourceGroupDeployment -Name \"\u003cdeployment name\u003e\" -ResourceGroupName \"\u003cname\u003e\" -TemplateUri \"https://raw.githubusercontent.com/elastic/azure-marketplace/master/src/mainTemplate.json\" -TemplateParameterObject $clusterParameters\n  ```\n\n## Targeting a specific template version\n\nYou can target a specific version of the template by modifying the URI of the template and \nthe `_artifactsLocation` parameter of the template to point to a specific tagged release.\n\n**Targeting a specific template version is recommended for repeatable production deployments.**\n\nFor example, to target the [`7.11.1` tag release with PowerShell](https://github.com/elastic/azure-marketplace/tree/7.11.1)\n\n```powershell\n$templateVersion = \"7.11.1\"\n$_artifactsLocation = \"https://raw.githubusercontent.com/elastic/azure-marketplace/$templateVersion/src/\"\n\n# minimum parameters required to deploy\n$clusterParameters = @{\n  \"_artifactsLocation\" = $_artifactsLocation\n  \"esVersion\" = \"7.11.1\"\n  \"adminUsername\" = \"russ\"\n  \"adminPassword\" = \"Password1234\"\n  \"securityBootstrapPassword\" = \"Password1234\"\n  \"securityAdminPassword\" = \"Password1234\"\n  \"securityKibanaPassword\" = \"Password1234\"\n  \"securityLogstashPassword\" = \"Password1234\"\n  \"securityBeatsPassword\" = \"Password1234\"\n  \"securityApmPassword\" = \"Password1234\"\n  \"securityRemoteMonitoringPassword\" = \"Password1234\"\n}\n\n$resourceGroup = \"my-azure-cluster\"\n$location = \"Australia Southeast\"\n$name = \"my-azure-cluster\"\n\nNew-AzureRmResourceGroup -Name $resourceGroup -Location $location\nNew-AzureRmResourceGroupDeployment -Name $name -ResourceGroupName $resourceGroup -TemplateUri \"$_artifactsLocation/mainTemplate.json\" -TemplateParameterObject $clusterParameters\n```\n\n## Configuring TLS\n\n**It is strongly recommended that you secure communication using Transport Layer Security when using the template**. \nThe Elastic Stack security features can provide Basic Authentication, \nRole Based Access control, and Transport Layer Security (TLS)\nfor both Elasticsearch and Kibana. For more details, please refer to \n[the Security documentation](https://www.elastic.co/guide/en/elastic-stack-deploy/current/azure-arm-template-security.html).\n\nFor Elasticsearch versions 6.8.0+ (and less than 7.0.0), and 7.1.0+, the Elastic Stack security features\nthat allow configuring TLS and role based access control are available in the free basic license tier. \nFor all other versions, the Elastic Stack security features require a license level higher than basic; \nThey can be configured with a trial license, which provides access to the Security features for 30 days.\n\n### TLS for Kibana\n\nYou can secure external access from the browser to Kibana with TLS by supplying\na certificate and private key in PEM format with `kibanaCertBlob` and\n`kibanaKeyBlob` parameters, respectively.\n\n### TLS for Elasticsearch Transport layer\n\nYou can secure communication between nodes in the cluster with TLS on the\nTransport layer. Configuring TLS for the Transport layer requires\n`xPackPlugins` be set to `Yes`, or an Elasticsearch version 6.8.0+ (and less than 7.0.0) or 7.1.0+.\n\nYou must supply a PKCS#12 archive with the `esTransportCaCertBlob` parameter (and optional\npassphrase with `esTransportCaCertPassword`) containing the CA cert which should be used to generate\na certificate for each node within the cluster. An optional\npassphrase can be passed with `esTransportCertPassword` to encrypt the generated certificate\non each node.\n\nOne way to generate a PKCS#12 archive containing a CA certificate and key is using \n[Elastic's `elasticsearch-certutil` command](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html).\nThe simplest command to generate a CA certificate is\n\n```sh\n./elasticsearch-certutil ca\n```\n\nand follow the instructions.\n\n### TLS for Elasticsearch HTTP layer\n\nYou can secure external access to the cluster with TLS with an external\nloadbalancer or Application Gateway. Configuring TLS for the HTTP layer requires\n`xPackPlugins` be set to `Yes`, or an Elasticsearch version 6.8.0+ (and less than 7.0.0) or 7.1.0+.\n\n#### External load balancer\n\nIf you choose `external` as the value for `loadBalancerType`, you must either\n\n* supply a PKCS#12 archive containing the key and certificate with the `esHttpCertBlob` parameter (and optional \npassphrase with `esHttpCertPassword`) containing the certs and private key to\nsecure the HTTP layer. This certificate will be used by all nodes within the cluster, and\n\n**_or_**\n\n* supply a PKCS#12 archive containing the key and certificate with the `esHttpCaCertBlob` parameter (and optional \npassphrase with `esHttpCaCertPassword`) containing the CA which should be used to generate\na certificate for each node within the cluster to secure the HTTP layer.\nKibana will be configured to trust the CA and perform hostname verification for presented\ncertificates. One way to generate a PKCS#12 archive is using [Elastic's certutil command](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html).\n\n#### Application Gateway\n\nIf you choose `gateway` as the value for `loadBalancerType`, you must\n\n* supply a PKCS#12 archive containing the key and certificate with the `appGatewayCertBlob` parameter (and optional \npassphrase with `appGatewayCertPassword`) to secure communication to Application Gateway.\nOne way to generate a PKCS#12 archive is using [Elastic's certutil command](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html)\n\n[Application Gateway](https://azure.microsoft.com/en-au/services/application-gateway/)\nperforms SSL offload, so communication from Application Gateway to\nElasticsearch is not encrypted with TLS by default. TLS to Application Gateway may be sufficient for your \nneeds, but if you would like end-to-end encryption by also configuring TLS for Elasticsearch HTTP layer, you can\n\n* supply a PKCS#12 archive containing the key and certificate with the `esHttpCertBlob` parameter (and optional \npassphrase with `esHttpCertPassword`) containing the certs and private key to\nsecure the HTTP layer. This certificate will be used by all nodes within the cluster, and\nKibana will be configured to trust the certificate CA (if CA certs are present within the archive).\nOne way to generate a PKCS#12 archive is using [Elastic's certutil command](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html), and you must\nspecify a `--dns \u003cname\u003e` argument with a name that matches that in the `--name \u003cname\u003e` argument.\n\n**_and_**\n\n* supply the public certificate in PEM format from the PKCS#12 archive\npassed with `esHttpCertBlob` parameter, using the `appGatewayEsHttpCertBlob` parameter.\nApplication Gateway whitelists certificates used by VMs in the backend pool. This can\nbe extracted from the PKCS#12 archive of the `esHttpCertBlob` parameter using\n[`openssl pkcs12`](https://www.openssl.org/docs/man1.0.2/apps/pkcs12.html)\n\n    ```sh\n    openssl pkcs12 -in http_cert.p12 -out http_public_cert.cer -nokeys\n    ```\n\n    and provide the passphrase for the archive when prompted.\n\n**IMPORTANT**: When configuring [end-to-end encryption with Application Gateway](https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-end-to-end-ssl-powershell),\nthe certificate to secure the HTTP layer **must** include a x509v3 Subject Alternative Name\nextension with a DNS entry that matches the Subject CN, to work with Application\nGateway's whitelisting mechanism. This can be checked using\n[`openssl x509`](https://www.openssl.org/docs/man1.0.2/apps/x509.html)\n\n```sh\nopenssl x509 -in http_public_cert.cer -text -noout\n```\n\nwhich will output something similar to\n\n```text\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number:\n            // omitted for brevity ...\n    Signature Algorithm: sha256WithRSAEncryption\n        Issuer: CN=Elastic Certificate Tool Autogenerated CA\n        Validity\n            Not Before: Jul  5 02:37:40 2018 GMT\n            Not After : Jul  4 02:37:40 2021 GMT\n        Subject: CN=custom\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    // omitted for brevity ...\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Subject Key Identifier:\n                // omitted for brevity ...\n            X509v3 Authority Key Identifier:\n                // omitted for brevity ...\n\n            X509v3 Subject Alternative Name:\n                DNS:custom\n            X509v3 Basic Constraints:\n                CA:FALSE\n    Signature Algorithm: sha256WithRSAEncryption\n         // omitted for brevity ...\n```\n\n_Without_ this, Application Gateway will return [502 Bad Gateway errors](https://docs.microsoft.com/en-gb/azure/application-gateway/application-gateway-troubleshooting-502),\nas the health probe for the backend pool will fail when the whitelisted certificate does\nnot contain this certificate extension.\nYou can typically understand if there is a problem with the key format when\n\n1. TLS has been configured on the HTTP layer\n2. Kibana is able to communicate to the cluster correctly _but_ Application Gateway returns 502 errors.\n\nThis may not always be the case, but can be indicative. You should also check the description for Backend Health\nof the Application Gateway in the Azure portal.\n\n### Passing certificate parameters\n\nParameters such as \u003ccode\u003eesHttpCertBlob\u003c/code\u003e and \u003ccode\u003ekibanaCertBlob\u003c/code\u003e must be provided in Base-64 encoded form. A Base-64 encoded value can be obtained using\n\n1. [base64](https://linux.die.net/man/1/base64) on Linux, or [openssl](https://www.openssl.org/docs/man1.0.2/apps/openssl.html) on Linux and MacOS\n\n    base64\n\n    ```sh\n    httpCert=$(base64 http-cert.p12) \n    ```\n\n    openssl\n\n    ```sh\n    httpCert=$(openssl base64 -in http-cert.p12)\n    ```\n\n    and including the value assigned to \u003ccode\u003e$httpCert\u003c/code\u003e in the parameters.json file as the value for certificate parameter passed to the Azure CLI command\n\n2. PowerShell on Windows\n\n    ```powershell\n    $httpCert = [Convert]::ToBase64String([IO.File]::ReadAllBytes(\"c:\\http-cert.p12\"))\n    ```\n\n    and then pass this in the template parameters object passed to the Azure PowerShell command\n\n    ```powershell\n    $clusterParameters = @{\n        # Other parameters skipped for brevity\n        \"esHttpCertBlob\"= $httpCert\n    }\n    ```\n\n## License\n\nThis project is [MIT Licensed](https://github.com/elastic/azure-marketplace/blob/master/LICENSE.txt) and was originally forked from \nthe [Elasticsearch Azure quick start arm template](https://github.com/Azure/azure-quickstart-templates/tree/master/elasticsearch)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Felastic%2Fazure-marketplace","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Felastic%2Fazure-marketplace","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Felastic%2Fazure-marketplace/lists"}