Migrate Cortex XSOAR Objects to Elasticsearch for Multi-Tenant

Download the migration tool by appending
downloadName=elasticsearch_migration_tool_6_5_0
to the end of the download link that you received, when installing Cortex XSOAR.
For each host you want to migrate copy your database and migrate data from the copy database to Elasticsearch.
Copy the Cortex XSOAR database by doing one of the following:
Take a snapshot of the database.
Manually create a copy of the
/var/lib/demisto/
directory.
Copy the
demisto.conf
file.
Edit the copy of the
demisto.conf
file, by adding your Elasticsearch configuration.
Ensure that
elasticsearch
is the top-level object in the
demisto.config
file (within the main curly brackets).
From the host, using the
demisto
or
sudo
permissions, run the following command: command with either
demisto
or
sudo
permissions. Specify the following:
sudo ./elasticMigrator -config-path <
path-of-copy-of-demisto.conf
> -db-path <
path-of-the-copy-of-the-demisto-data
> -
<flags>
For a full list of flags, see Migration Tool Flags.
For example, to exclude the last 3 months partitions, add the
-only-old-partitions
and
-partitions-back flags
:
sudo ./elasticMigrator -config-path /usr/local/dev/copy_of_demisto.conf -db-path /usr/local/dev/lib_demisto_copy/data -only-old-partitions -partitions-back 3
By default, the migration migrates the entire contents of the database and the tenants on the host.
To migrate only the host, use the
skip-accounts
flag.
To migrate all accounts, use the
skip-main
flag.
To migrate specific accounts, use the
accounts
and
skip-main
flags.
Complete steps 1 to 3 in Validate the migration
After the migration of the data is complete and validated, migrate your data from the active database to Elasticsearch.
Create a backup copy of the
demisto.conf
file for your active database.
Edit the demisto.conf for your active database to add your Elasticsearch configuration.
On the host (main or any other) stop the Cortex XSOAR server by running one of the following commands:
CentOS:
sudo systemctl stop demisto
Ubuntu:
sudo service demisto stop
From the host, migrate the remaining months from the active database to Elasticsearch. Run the
sudo ./elasticMigrator
command with either
demisto
or
sudo
permissions. Use the
-partitions-back
flag to specify the remaining partitions.
For example,
sudo ./elasticMigrator -partitions-back 3
migrates the last three partitions, which would include the current month and the previous two months, as well as the main partition.
By default, the migration migrates the entire contents of the database and the tenants on the host.
To migrate only the host, use the
skip-accounts
flag.
To migrate all accounts, use the
skip-main
flag.
To migrate specific accounts, use the
accounts
and
skip-main
flags.
Validate the migration (all steps).
For any additional hosts that you want to migrate, repeat the steps above.