Hi @arunkuriakose , it's always a best practice to have all the ES customizations in a custom app, in this way it's easier to migrate it. In your case, the best approach I hint is to move all of them in a custom app, otherwise, you could copy all the folders of the ES installation on the Deployer, but I'm not so sure that't the correct approach, I'd prefer to use the custom app. Anyway, the migration process should be: back-up the ES Search Head, configure the Deployer, move all custom configurations (Correlation Searches, Reports, Dashboards, field extractions, custom eventtypes, etc...) in a custom app called e.g. SA-SOC where SA means Supporting Add-On, install ES on the Deployer, copy the SA-SOC app in the Deployer, configure the Search Heads in the Cluster, deploy apps, test your evnvironment. this is a long job, so it would be the best, if you don't use the ES Search Head in the Cluster but a new machine and you use the stand-alone ES SH it in the meantime you migrate your environment, then at the end you can disable it. Ciao. Giuseppe ... View more