Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security for Elasticsearch is now free

elastic.co

Post reply on HN
Print view View original

51–60 of 64 posts

Re: Security for Elasticsearch is now free

#51

Post by noname120 »

yehosef wrote: post #11
mrkstu wrote: post #2

Free, not open source version. Obviously a reaction to Amazon's fork- not wanting to give them any code to pull into their version. It will be interesting to see if this is enough to retain the majority of the userbase or if we'll still see a majority migrate to the 'Open Distro' fork.

The features of the open distro are not enough to compare to the Elastic offerings. I think most are smart enough to see through Amazon's "generosity" and know that they (Amazon) are not a bastion of OSS.

Could you expand on the features that Open Distro misses and that Elastic offers?

Re: Security for Elasticsearch is now free

#52

Post by majkinetor »

syrrim wrote: post #28
KenanSulayman wrote: post #4

Interesting. Three hours ago someone in our Ops team shared a link to "Open Distro for Elasticsearch" [1] and it's also featured on the AWS console login page. Is this a very rushed reaction to it? Or is this related? I would really love to have a clarification of what's happening in that space. [1] https://opendistro.github.io/for-elasticsearch/

opendistro has this: https://github.com/opendistro-for-elasticsearch/security which has feature parity with the free version elastic just released afaict.

No it doesn't - for example LDAP/AD are paid feature in ES

Re: Security for Elasticsearch is now free

#53

Post by majkinetor »

vorpalhex wrote: post #37
jrockway wrote: post #16

Earlier quoted context omitted.

I use ELK for Kubernetes and network device logs, and I'm very much with you -- full text search is great, but it sure can be slow, even when running on $1000/month of AWS hardware. The conclusion that I've reached is that the whole lucene model for logs is kind of outdated. Why am I tuning Java GC params to run "grep foo /logs". I think computers today can do fine with sharded flat files, a minimal index ("which nod…

ELK stack user here - we actually found logstash to be our bottleneck. Changing it out for fluentd fixed our woes.

Logstash sucks from both operational and developing perspective. I replaced it everywhere I could by sending structured logs directly from the app or by using newer integrated beats features.

Re: Security for Elasticsearch is now free

#54

Post by yehosef »

noname120 wrote: post #51
yehosef wrote: post #11

Earlier quoted context omitted.

The features of the open distro are not enough to compare to the Elastic offerings. I think most are smart enough to see through Amazon's "generosity" and know that they (Amazon) are not a bastion of OSS.

Could you expand on the features that Open Distro misses and that Elastic offers?

You can see the OSS and Free offerings at https://www.elastic.co/subscriptions. Real question is what are the Open Distro is offering:

* Alerting - you can use ElasticAlert

* Security - Search Guard

* SQL - https://github.com/NLPchina/elasticsearch-sql

There very little reason (IMO) for users to a choose "Open Distro" except that it comes as an AWS image.

Re: Security for Elasticsearch is now free

#55

Post by lol768 »

zaphirplane wrote: post #34
lol768 wrote: post #22

Earlier quoted context omitted.

>Why don’t you want to pay for a feature that you need? It's irresponsible to charge for features such as transport security, in my opinion. Want to charge for enterprise auditing, federation, reporting and granular access control? Fine, go right ahead. But withholding basic security features like transport security and basic access control that should be core leaves a bad taste in my mouth. How many unsecured Elasti…

That is manifestly unfair, the situation is someone doesn’t want to pay for a security feature so they go ahead and expose themselves, all the time they are trying to make money by using a free product. Really unfair to point fingers at ES. And I really don’t get why People feel they should be making money off someone’s work but don’t have to pay them. What significant os or free is your company offering Really and g…

> That is manifestly unfair, the situation is someone doesn’t want to pay for a security feature so they go ahead and expose themselves, all the time they are trying to make money by using a free product.

>Really unfair to point fingers at ES. And I really don’t get why People feel they should be making money off someone’s work but don’t have to pay them. What significant os or free is your company offering

Very much disagree with all of this - not an unfair position to take at all. My open source browser supports TLS. The open source web frameworks I work with include built-in web servers that support TLS. It's inexcusable not to support basic things like this in 2019. I don't care if your software is OSS or not.

I'm unsure why "my company" is relevant here. But for what it's worth, the client I currently work with is a) an exempt educational charity, b) open sources all of their internal web applications that interact with the ELK stack.

>They do something for free you demand more for free otherwise you are at risk.

Do you honestly think Elastic would've accepted a PR that added transport security into the open source codebase? Even if it was developed entirely by someone else in good faith?

The only reason they've done anything now is because their hand was forced by Amazon. Honestly? Good. This is about as bad as when StartCom were charging for certificate revocations.

>does the same approach work with your lawyer, mechanic plumber electricity gas company

It's like a lawyer offering to represent me pro bono, and then it turning out that they're not even qualified to practice law and have jeopardised my case as a result.

Legally, sure? There's no warranty given with the software. But it's still a morally wrong thing to do.

Re: Security for Elasticsearch is now free

#56

Post by lol768 »

javagram wrote: post #25
lol768 wrote: post #24

Earlier quoted context omitted.

Were these features licensed in such a way that you could freely use them, though? Or was it 'open' as in "you can see the code" but it's not FOSS?

x-pack is not FOSS which is why amazon can’t use it.

As I thought - thanks for confirming.

Re: Security for Elasticsearch is now free

#57

Post by pmart123 »

Dylan16807 wrote: post #42
zaphirplane wrote: post #34

Earlier quoted context omitted.

That is manifestly unfair, the situation is someone doesn’t want to pay for a security feature so they go ahead and expose themselves, all the time they are trying to make money by using a free product. Really unfair to point fingers at ES. And I really don’t get why People feel they should be making money off someone’s work but don’t have to pay them. What significant os or free is your company offering Really and g…

A service like this is more like someone giving you a ride. And if they don't have brake pads, and negligently get into a horrible wreck, one where they walk away unharmed while you are injured? You probably have a case there.

When airbags first came out, only expensive cars had them. I wouldn't be surprised if side airbags are still only found in nicer cars.

This seems entirely different though. It's more like hitchhiking. When you pay for an Uber or Lyft, there's a level of safety expectations in the car. When you pay for a black car, there's a higher level of expectations. When you don't pay anything, you are using it at your own peril. Now, this could be a bad business model or poor mousetrap for adoption. I'm not arguing with that.

Re: Security for Elasticsearch is now free

#58

Post by pmart123 »

mrkstu wrote: post #2

Free, not open source version. Obviously a reaction to Amazon's fork- not wanting to give them any code to pull into their version. It will be interesting to see if this is enough to retain the majority of the userbase or if we'll still see a majority migrate to the 'Open Distro' fork.

Do you have a good understanding of the legal differences? My understanding is there now an open source license that anyone can fork, including companies basically committing IP theft, and then a basic license that is free unless you are selling Elastic as a service? The idea is that Elastic would put all improvements into Elastic Basic, and Amazon can't use this source code in its forked version?

IMO, it doesn't seem like a near-term risk, but could Elastic ever change its basic license so it costs money for everyone?

Re: Security for Elasticsearch is now free

#59

Post by praseodym »

tedk-42 wrote: post #31

Running Elasticsearch on K8s storing 16TB of compressed logs across 6 data nodes and ~4600 shards. We're a really happy ES customer. We've on ESv6 at the moment and it's been running amazingly for us. We've halved our storage and running costs by moving from 5 to 6. We've always been a licensed customer and they are in front of AWS with their features (we run our k8s stack on AWS though :) )

Some free advice: reduce the number of shards! Each shard comes with some state management overhead.

The soft limit is currently at 1000 shards per node, but you should be aiming at 25-50GB of data per shard.

Re: Security for Elasticsearch is now free

#60

Post by parliament32 »

tedk-42 wrote: post #31

Running Elasticsearch on K8s storing 16TB of compressed logs across 6 data nodes and ~4600 shards. We're a really happy ES customer. We've on ESv6 at the moment and it's been running amazingly for us. We've halved our storage and running costs by moving from 5 to 6. We've always been a licensed customer and they are in front of AWS with their features (we run our k8s stack on AWS though :) )

That's an insane number of shards, you should be closer to 500 for that amount of data and only 6 nodes.
Post reply on HN