> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-do-i-add-another-siem-index-server-in-enginsight.md).

# How do I add another SIEM Index Server in Enginsight?

The SIEM Index Server is based on [Apache Solr](https://solr.apache.org/) and is the primary database for the SIEM. It indexes logs and makes them easy to search.

You can install multiple SIEM Index Servers that communicate with one SIEM Management Server. This article shows you which adjustments you need to make.

{% stepper %}
{% step %}

### Set up the new SIEM Index Server

Follow the [installation instructions for the SIEM Index Server](https://docs.enginsight.com/docs/manual/english/installation-und-konfiguration/installation-and-configuration/enginsight-siem/siem-index-server) in the Enginsight Manual to set up a new SIEM Index Server.
{% endstep %}

{% step %}

### Adjust the Loggernaut configuration

1. Log in to the **SIEM Management Server** or to the dedicated server on which you installed the Enginsight SIEM component Loggernaut.
2. Open the **Loggernaut configuration file** with the following command:

```json
sudo nano /opt/enginsight/loggernaut/config.json
```

3. Navigate to the `siem` section and add the new SIEM Index Server to the `indecees` parameter as follows:

<pre><code>{
    "api": {...},
    "siem": {
        "indecees": [
            "&#x3C;ExistingSIEMIndexServerIPAddress>:&#x3C;ExistingSIEMIndexServerPort>",
<strong>            "&#x3C;NewSIEMIndexServerIPAddress>:&#x3C;NewSIEMIndexServerPort>",
</strong>        ],
    }
}
</code></pre>

{% hint style="info" %}
Remember to replace `<NewSIEMIndexServerIPAddress>` and `<NewSIEMIndexServerPort>` accordingly.
{% endhint %}

4. **Optional**: If you want the new SIEM Index Server to be used automatically to create new shards for existing collections, you need to enable automatic scaling.\
   \
   To do this, set the `autoscale` parameter as follows:

<pre><code>{
    "api": {...},
    "siem": {
        "indecees": [
            "&#x3C;ExistingSIEMIndexServerIPAddress>:&#x3C;ExistingSIEMIndexServerPort>",
            "&#x3C;NewSIEMIndexServerIPAddress>:&#x3C;NewSIEMIndexServerPort>",
        ],
    },
<strong>    "autoscale": true,
</strong>}
</code></pre>

5. Save the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
6. Restart Loggernaut using the following command to apply the changes:

```
sudo systemctl restart ngs-loggernaut
```

{% endstep %}

{% step %}

### Adjust the nginx configuration

1. Log in to the **SIEM Management Server** if you have not already done so.
2. Open the **nginx configuration** using the following command:

```
sudo nano /etc/nginx/sites-available/default
```

2. Adjust the configuration as follows:

<pre><code>upstream backend {
   server &#x3C;SIEMIndexServer1IPAddress>:8983;
<strong>   server &#x3C;SIEMIndexServer2IPAddress>:&#x3C;SIEMIndexServer2Port>;
</strong></code></pre>

{% hint style="info" %}
Remember to replace `<SIEMIndexServer2IPAddress>` and `<SIEMIndexServer2Port>` accordingly.
{% endhint %}

3. Save the changes in the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
4. Restart nginx using the following command to apply the changes:

```
sudo systemctl restart nginx
```

{% endstep %}

{% step %}

### Check the functionality of the new SIEM Index Server

In the Enginsight platform, navigate to **SIEM** → **Required Services** → **Loggernaut** and check whether the SIEM Index Server works as intended and whether data processing runs as expected. To do this, check the processor indicators:

<div align="left"><figure><img src="/files/AtMsfCDFs04LpugCs9vb" alt=""><figcaption></figcaption></figure></div>
{% endstep %}
{% endstepper %}

***