# Ajustes del sistema operativo necesarios antes de la instalación
sudo sysctl -w vm.max_map_count=262144
echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf

# Deshabilitar swap (recomendado para OpenSearch)
sudo swapoff -a
# Para que sea permanente, comentar la línea de swap en /etc/fstab

# Importar la clave GPG
curl -o- https://artifacts.opensearch.org/publickeys/opensearch.pgp | sudo gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring

# Añadir el repositorio
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/opensearch-2.x.list

sudo apt update

# Instalar una versión específica
sudo OPENSEARCH_INITIAL_ADMIN_PASSWORD=Admin_Contraseña123! apt install opensearch=2.13.0

# Añadir repositorio
sudo tee /etc/yum.repos.d/opensearch-2.x.repo > /dev/null <<EOF
[opensearch-2.x]
name=OpenSearch 2.x repository
baseurl=https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/yum
enabled=1
autorefresh=1
type=rpm-md
gpgcheck=1
gpgkey=https://artifacts.opensearch.org/publickeys/opensearch.pgp
EOF

sudo OPENSEARCH_INITIAL_ADMIN_PASSWORD=Admin_Contraseña123! dnf install -y opensearch-2.13.0

docker run -d \
  --name opensearch \
  -p 9200:9200 \
  -p 9600:9600 \
  -e "discovery.type=single-node" \
  -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=Admin_Contraseña123!" \
  -v opensearch-data:/usr/share/opensearch/data \
  opensearchproject/opensearch:2.13.0

# Habilitar e iniciar el servicio (para instalación con paquetes)
sudo systemctl enable opensearch --now

# Verificar que está funcionando
curl -k -u admin:Admin_Contraseña123! https://localhost:9200

# /etc/opensearch/opensearch.yml

# Nombre del clúster
cluster.name: mi-cluster-opensearch

# Nombre de este nodo
node.name: nodo-1

# Directorio de datos e índices
path.data: /var/lib/opensearch
path.logs: /var/log/opensearch

# Dirección de escucha
network.host: 0.0.0.0
http.port: 9200

# Descubrimiento del clúster (para nodo único)
discovery.type: single-node

# Configuración de memoria (ajustar según RAM disponible)
# También editar /etc/opensearch/jvm.options:
# -Xms4g
# -Xmx4g

# Configurar JVM heap (usar 50% de la RAM disponible, máximo 32 GB)
sudo tee /etc/opensearch/jvm.options.d/heap.options > /dev/null <<EOF
-Xms4g
-Xmx4g
EOF

sudo systemctl restart opensearch

# Generar certificados TLS propios (para producción usar certificados de una CA reconocida)
cd /etc/opensearch

# Generar CA raíz
openssl genrsa -out root-ca-key.pem 2048
openssl req -new -x509 -sha256 -key root-ca-key.pem -out root-ca.pem -days 3650 \
  -subj "/C=ES/ST=Madrid/O=MiEmpresa/CN=root-ca"

# Generar certificado del nodo
openssl genrsa -out node-key.pem 2048
openssl req -new -key node-key.pem -out node.csr \
  -subj "/C=ES/ST=Madrid/O=MiEmpresa/CN=nodo-1"
openssl x509 -req -sha256 -in node.csr -CA root-ca.pem -CAkey root-ca-key.pem \
  -CAcreateserial -out node.pem -days 3650

# Generar certificado de administrador
openssl genrsa -out admin-key.pem 2048
openssl req -new -key admin-key.pem -out admin.csr \
  -subj "/C=ES/ST=Madrid/O=MiEmpresa/CN=admin"
openssl x509 -req -sha256 -in admin.csr -CA root-ca.pem -CAkey root-ca-key.pem \
  -CAcreateserial -out admin.pem -days 3650

# Ajustar permisos
sudo chmod 600 *.pem *.key
sudo chown opensearch:opensearch *.pem *.key

# Configuración TLS para el plugin de seguridad
plugins.security.ssl.transport.pemcert_filepath: /etc/opensearch/node.pem
plugins.security.ssl.transport.pemkey_filepath: /etc/opensearch/node-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/opensearch/root-ca.pem
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: /etc/opensearch/node.pem
plugins.security.ssl.http.pemkey_filepath: /etc/opensearch/node-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /etc/opensearch/root-ca.pem
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn:
  - "CN=admin,O=MiEmpresa,ST=Madrid,C=ES"
plugins.security.nodes_dn:
  - "CN=nodo-1,O=MiEmpresa,ST=Madrid,C=ES"

# Aplicar la configuración de seguridad inicial
sudo -u opensearch /usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh \
  -cd /etc/opensearch/opensearch-security/ \
  -icl \
  -nhnv \
  -cacert /etc/opensearch/root-ca.pem \
  -cert /etc/opensearch/admin.pem \
  -key /etc/opensearch/admin-key.pem

# Instalar OpenSearch Dashboards
sudo apt install opensearch-dashboards=2.13.0  # Ubuntu/Debian
sudo dnf install opensearch-dashboards-2.13.0  # CentOS/Rocky

server.host: "0.0.0.0"
server.port: 5601

# Conexión al backend de OpenSearch
opensearch.hosts: ["https://localhost:9200"]
opensearch.username: "kibanaserver"
opensearch.password: "kibanaserver_password"

# Configuración TLS
opensearch.ssl.verificationMode: certificate
opensearch.ssl.certificateAuthorities: ["/etc/opensearch/root-ca.pem"]

# Clave de cifrado para sesiones
opensearch_security.cookie.secure: true
opensearch_security.cookie.password: "clave_aleatoria_32_caracteres_aqui"

sudo systemctl enable opensearch-dashboards --now

# Crear un índice con mapping personalizado
curl -k -u admin:Admin_Contraseña123! -X PUT https://localhost:9200/mi-indice \
  -H "Content-Type: application/json" \
  -d '{
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 1
    },
    "mappings": {
      "properties": {
        "titulo":    {"type": "text", "analyzer": "spanish"},
        "fecha":     {"type": "date"},
        "categoria": {"type": "keyword"},
        "precio":    {"type": "float"},
        "activo":    {"type": "boolean"}
      }
    }
  }'

# Indexar un documento
curl -k -u admin:Admin_Contraseña123! -X POST https://localhost:9200/mi-indice/_doc \
  -H "Content-Type: application/json" \
  -d '{"titulo": "Producto de prueba", "fecha": "2024-01-15", "categoria": "electronica", "precio": 299.99, "activo": true}'

# Buscar documentos
curl -k -u admin:Admin_Contraseña123! -X GET https://localhost:9200/mi-indice/_search \
  -H "Content-Type: application/json" \
  -d '{
    "query": {
      "multi_match": {
        "query": "producto prueba",
        "fields": ["titulo^2", "descripcion"]
      }
    },
    "sort": [{"fecha": "desc"}],
    "size": 10
  }'

# Listar índices
curl -k -u admin:Admin_Contraseña123! https://localhost:9200/_cat/indices?v

# Ver estado del clúster
curl -k -u admin:Admin_Contraseña123! https://localhost:9200/_cluster/health?pretty

# Política ISM para gestión del ciclo de vida de índices de logs
curl -k -u admin:Admin_Contraseña123! -X PUT https://localhost:9200/_plugins/_ism/policies/logs-lifecycle \
  -H "Content-Type: application/json" \
  -d '{
    "policy": {
      "description": "Política de ciclo de vida para índices de logs",
      "default_state": "caliente",
      "states": [
        {
          "name": "caliente",
          "actions": [],
          "transitions": [{"state_name": "frio", "conditions": {"min_index_age": "7d"}}]
        },
        {
          "name": "frio",
          "actions": [{"read_only": {}}],
          "transitions": [{"state_name": "eliminar", "conditions": {"min_index_age": "30d"}}]
        },
        {
          "name": "eliminar",
          "actions": [{"delete": {}}],
          "transitions": []
        }
      ]
    }
  }'

# opensearch.yml para el nodo master
cluster.name: mi-cluster-produccion
node.name: master-1
node.roles: [cluster_manager]

network.host: 10.0.0.1
discovery.seed_hosts: ["10.0.0.1:9300", "10.0.0.2:9300", "10.0.0.3:9300"]
cluster.initial_cluster_manager_nodes: ["master-1"]

# opensearch.yml para nodos de datos
node.roles: [data, ingest]
network.host: 10.0.0.2  # IP del nodo data-1
discovery.seed_hosts: ["10.0.0.1:9300", "10.0.0.2:9300", "10.0.0.3:9300"]
cluster.initial_cluster_manager_nodes: ["master-1"]

# Verificar compatibilidad de la API (OpenSearch 2.x ≈ Elasticsearch 7.10)
# La mayoría de clientes de ES 7.x funcionan directamente

# Usar reindex API para migrar datos entre clústeres
curl -k -u admin:Admin_Contraseña123! -X POST https://opensearch:9200/_reindex \
  -H "Content-Type: application/json" \
  -d '{
    "source": {
      "remote": {
        "host": "http://elasticsearch-origen:9200"
      },
      "index": "mi-indice-es"
    },
    "dest": {
      "index": "mi-indice-opensearch"
    }
  }'

# Verificar logs
sudo journalctl -u opensearch -n 100 --no-pager
sudo tail -n 100 /var/log/opensearch/mi-cluster-opensearch.log

# Problemas comunes: vm.max_map_count bajo
cat /proc/sys/vm/max_map_count  # Debe ser >= 262144
sudo sysctl -w vm.max_map_count=262144

# Ver qué índices están en rojo
curl -k -u admin:Admin_Contraseña123! https://localhost:9200/_cat/indices?v&health=red

# Ver shards no asignados
curl -k -u admin:Admin_Contraseña123! https://localhost:9200/_cat/shards?v&h=index,shard,prirep,state,unassigned.reason

# Reducir heap si el sistema se queda sin memoria
# Heap no debe superar el 50% de la RAM total
sudo nano /etc/opensearch/jvm.options
# Cambiar -Xms4g -Xmx4g por valores menores