2 nodes instead of one

Elastic Stack Elasticsearch
1

Hello,

I've noticed that my quite simple ES install (+ Logstash) has 2 nodes running, but I configured only one. Is this a normal behavior?
And its health is "yellow", as a consequence I guess of this second uninvited node.

egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort -u

cluster.name: elasticsearch
network.bind_host: 127.0.0.1
network.host: 127.0.0.1
path.conf: /usr/local/etc/elasticsearch
path.data: /zdata/elasticsearch
path.logs: /var/log/elasticsearch
path.plugins: /usr/local/lib/elasticsearch/plugins
path.work: /var/tmp/elasticsearch

curl http://localhost:9200/_nodes/process?pretty

{
"cluster_name" : "elasticsearch",
"nodes" : {
"hPT0PtRjTCqbZCCn60dnwg" : {
"name" : "Living Diamond",
"transport_address" : "inet[/127.0.0.1:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.1.0",
"build" : "2181e11",
"http_address" : "inet[/127.0.0.1:9200]",
"process" : {
"refresh_interval" : 1000,
"id" : 64168,
"max_file_descriptors" : 11095,
"mlockall" : false
}
},
"jnsj-WAIQGGQLJODnda90Q" : {
"name" : "logstash-host.domain.tld-76994-4112",
"transport_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.0.1",
"build" : "5c03844",
"attributes" : {
"client" : "true",
"data" : "false"
},
"process" : {
"refresh_interval" : 1000,
"id" : 76994,
"max_file_descriptors" : 11095,
"mlockall" : false
}
}
}
}

curl http://localhost:9200/_cluster/health?pretty

{
"cluster_name" : "elasticsearch",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 2,
"number_of_data_nodes" : 1,
"active_primary_shards" : 281,
"active_shards" : 281,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 281
}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net.
For more options, visit https://groups.google.com/d/optout.

2

It appears there is another Elasticsearch node on your network. Since you
masked the value I cannot tell, but are transport_address and host the same
for both nodes?

If there is indeed another node on the network, you can either change the
cluster name or disable multicast and use unicast. If you will only have 1
node, you do not even need to use unicast.

Cheers,

Ivan

On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski <elasticsearch@patpro.net

wrote:

Hello,

I've noticed that my quite simple ES install (+ Logstash) has 2 nodes
running, but I configured only one. Is this a normal behavior?
And its health is "yellow", as a consequence I guess of this second
uninvited node.

egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort -u

cluster.name: elasticsearch
network.bind_host: 127.0.0.1
network.host: 127.0.0.1
path.conf: /usr/local/etc/elasticsearch
path.data: /zdata/elasticsearch
path.logs: /var/log/elasticsearch
path.plugins: /usr/local/lib/elasticsearch/plugins
path.work: /var/tmp/elasticsearch

curl http://localhost:9200/_nodes/process?pretty

{
"cluster_name" : "elasticsearch",
"nodes" : {
"hPT0PtRjTCqbZCCn60dnwg" : {
"name" : "Living Diamond",
"transport_address" : "inet[/127.0.0.1:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.1.0",
"build" : "2181e11",
"http_address" : "inet[/127.0.0.1:9200]",
"process" : {
"refresh_interval" : 1000,
"id" : 64168,
"max_file_descriptors" : 11095,
"mlockall" : false
}
},
"jnsj-WAIQGGQLJODnda90Q" : {
"name" : "logstash-host.domain.tld-76994-4112",
"transport_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.0.1",
"build" : "5c03844",
"attributes" : {
"client" : "true",
"data" : "false"
},
"process" : {
"refresh_interval" : 1000,
"id" : 76994,
"max_file_descriptors" : 11095,
"mlockall" : false
}
}
}
}

curl http://localhost:9200/_cluster/health?pretty

{
"cluster_name" : "elasticsearch",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 2,
"number_of_data_nodes" : 1,
"active_primary_shards" : 281,
"active_shards" : 281,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 281
}

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

3

I have only one server. host.domain.tld and PUB.LIC.IP.ADDR always represent the same values.
It looks like the client node is started by Logstash, I don't think its useful, but I can't find a way to disable it.

On 10 mai 2014, at 01:00, Ivan Brusic wrote:

It appears there is another Elasticsearch node on your network. Since you masked the value I cannot tell, but are transport_address and host the same for both nodes?

If there is indeed another node on the network, you can either change the cluster name or disable multicast and use unicast. If you will only have 1 node, you do not even need to use unicast.

Cheers,

Ivan

On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski elasticsearch@patpro.net wrote:
Hello,

I've noticed that my quite simple ES install (+ Logstash) has 2 nodes running, but I configured only one. Is this a normal behavior?
And its health is "yellow", as a consequence I guess of this second uninvited node.

egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort -u

cluster.name: elasticsearch
network.bind_host: 127.0.0.1
network.host: 127.0.0.1
path.conf: /usr/local/etc/elasticsearch
path.data: /zdata/elasticsearch
path.logs: /var/log/elasticsearch
path.plugins: /usr/local/lib/elasticsearch/plugins
path.work: /var/tmp/elasticsearch

curl http://localhost:9200/_nodes/process?pretty

{
"cluster_name" : "elasticsearch",
"nodes" : {
"hPT0PtRjTCqbZCCn60dnwg" : {
"name" : "Living Diamond",
"transport_address" : "inet[/127.0.0.1:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.1.0",
"build" : "2181e11",
"http_address" : "inet[/127.0.0.1:9200]",
"process" : {
"refresh_interval" : 1000,
"id" : 64168,
"max_file_descriptors" : 11095,
"mlockall" : false
}
},
"jnsj-WAIQGGQLJODnda90Q" : {
"name" : "logstash-host.domain.tld-76994-4112",
"transport_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.0.1",
"build" : "5c03844",
"attributes" : {
"client" : "true",
"data" : "false"
},
"process" : {
"refresh_interval" : 1000,
"id" : 76994,
"max_file_descriptors" : 11095,
"mlockall" : false
}
}
}
}

curl http://localhost:9200/_cluster/health?pretty

{
"cluster_name" : "elasticsearch",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 2,
"number_of_data_nodes" : 1,
"active_primary_shards" : 281,
"active_shards" : 281,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 281
}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net.
For more options, visit https://groups.google.com/d/optout.

4

I am not a logstash expert, but did you perhaps enable an embedded version
in the output section of your logstash config?

--
Ivan

On Fri, May 9, 2014 at 4:18 PM, Patrick Proniewski <elasticsearch@patpro.net

wrote:

I have only one server. host.domain.tld and PUB.LIC.IP.ADDR always
represent the same values.
It looks like the client node is started by Logstash, I don't think its
useful, but I can't find a way to disable it.

On 10 mai 2014, at 01:00, Ivan Brusic wrote:

It appears there is another Elasticsearch node on your network. Since
you masked the value I cannot tell, but are transport_address and host the
same for both nodes?

If there is indeed another node on the network, you can either change
the cluster name or disable multicast and use unicast. If you will only
have 1 node, you do not even need to use unicast.

Cheers,

Ivan

On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski <
elasticsearch@patpro.net> wrote:
Hello,

I've noticed that my quite simple ES install (+ Logstash) has 2 nodes
running, but I configured only one. Is this a normal behavior?
And its health is "yellow", as a consequence I guess of this second
uninvited node.

egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort -u

cluster.name: elasticsearch
network.bind_host: 127.0.0.1
network.host: 127.0.0.1
path.conf: /usr/local/etc/elasticsearch
path.data: /zdata/elasticsearch
path.logs: /var/log/elasticsearch
path.plugins: /usr/local/lib/elasticsearch/plugins
path.work: /var/tmp/elasticsearch

curl http://localhost:9200/_nodes/process?pretty

{
"cluster_name" : "elasticsearch",
"nodes" : {
"hPT0PtRjTCqbZCCn60dnwg" : {
"name" : "Living Diamond",
"transport_address" : "inet[/127.0.0.1:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.1.0",
"build" : "2181e11",
"http_address" : "inet[/127.0.0.1:9200]",
"process" : {
"refresh_interval" : 1000,
"id" : 64168,
"max_file_descriptors" : 11095,
"mlockall" : false
}
},
"jnsj-WAIQGGQLJODnda90Q" : {
"name" : "logstash-host.domain.tld-76994-4112",
"transport_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.0.1",
"build" : "5c03844",
"attributes" : {
"client" : "true",
"data" : "false"
},
"process" : {
"refresh_interval" : 1000,
"id" : 76994,
"max_file_descriptors" : 11095,
"mlockall" : false
}
}
}
}

curl http://localhost:9200/_cluster/health?pretty

{
"cluster_name" : "elasticsearch",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 2,
"number_of_data_nodes" : 1,
"active_primary_shards" : 281,
"active_shards" : 281,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 281
}

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-_Ms3gT2ug0WRc2C3TP_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

5

No, it's even explicitly disabled since tonight. No difference. But may be it's a logstash bug (1.4.0)

On 10 mai 2014, at 01:32, Ivan Brusic wrote:

I am not a logstash expert, but did you perhaps enable an embedded version in the output section of your logstash config?

--
Ivan

On Fri, May 9, 2014 at 4:18 PM, Patrick Proniewski elasticsearch@patpro.net wrote:
I have only one server. host.domain.tld and PUB.LIC.IP.ADDR always represent the same values.
It looks like the client node is started by Logstash, I don't think its useful, but I can't find a way to disable it.

On 10 mai 2014, at 01:00, Ivan Brusic wrote:

It appears there is another Elasticsearch node on your network. Since you masked the value I cannot tell, but are transport_address and host the same for both nodes?

If there is indeed another node on the network, you can either change the cluster name or disable multicast and use unicast. If you will only have 1 node, you do not even need to use unicast.

Cheers,

Ivan

On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski elasticsearch@patpro.net wrote:
Hello,

I've noticed that my quite simple ES install (+ Logstash) has 2 nodes running, but I configured only one. Is this a normal behavior?
And its health is "yellow", as a consequence I guess of this second uninvited node.

egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort -u

cluster.name: elasticsearch
network.bind_host: 127.0.0.1
network.host: 127.0.0.1
path.conf: /usr/local/etc/elasticsearch
path.data: /zdata/elasticsearch
path.logs: /var/log/elasticsearch
path.plugins: /usr/local/lib/elasticsearch/plugins
path.work: /var/tmp/elasticsearch

curl http://localhost:9200/_nodes/process?pretty

{
"cluster_name" : "elasticsearch",
"nodes" : {
"hPT0PtRjTCqbZCCn60dnwg" : {
"name" : "Living Diamond",
"transport_address" : "inet[/127.0.0.1:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.1.0",
"build" : "2181e11",
"http_address" : "inet[/127.0.0.1:9200]",
"process" : {
"refresh_interval" : 1000,
"id" : 64168,
"max_file_descriptors" : 11095,
"mlockall" : false
}
},
"jnsj-WAIQGGQLJODnda90Q" : {
"name" : "logstash-host.domain.tld-76994-4112",
"transport_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.0.1",
"build" : "5c03844",
"attributes" : {
"client" : "true",
"data" : "false"
},
"process" : {
"refresh_interval" : 1000,
"id" : 76994,
"max_file_descriptors" : 11095,
"mlockall" : false
}
}
}
}

curl http://localhost:9200/_cluster/health?pretty

{
"cluster_name" : "elasticsearch",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 2,
"number_of_data_nodes" : 1,
"active_primary_shards" : 281,
"active_shards" : 281,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 281
}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-_Ms3gT2ug0WRc2C3TP_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/98C7B4CA-9E82-4CAE-B33D-FDA1E6F5FA60%40patpro.net.
For more options, visit https://groups.google.com/d/optout.

6

What's your LS config, are you using http output?

Also, install Marvel or ElasticHQ to give yourself a visual insight into
your cluster.

Regards,
Mark Walkom

Infrastructure Engineer
Campaign Monitor
email: markw@campaignmonitor.com
web: www.campaignmonitor.com

On 10 May 2014 10:02, Patrick Proniewski elasticsearch@patpro.net wrote:

No, it's even explicitly disabled since tonight. No difference. But may be
it's a logstash bug (1.4.0)

On 10 mai 2014, at 01:32, Ivan Brusic wrote:

I am not a logstash expert, but did you perhaps enable an embedded
version in the output section of your logstash config?

--
Ivan

On Fri, May 9, 2014 at 4:18 PM, Patrick Proniewski <
elasticsearch@patpro.net> wrote:
I have only one server. host.domain.tld and PUB.LIC.IP.ADDR always
represent the same values.
It looks like the client node is started by Logstash, I don't think its
useful, but I can't find a way to disable it.

On 10 mai 2014, at 01:00, Ivan Brusic wrote:

It appears there is another Elasticsearch node on your network. Since
you masked the value I cannot tell, but are transport_address and host the
same for both nodes?

If there is indeed another node on the network, you can either change
the cluster name or disable multicast and use unicast. If you will only
have 1 node, you do not even need to use unicast.

Cheers,

Ivan

On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski <
elasticsearch@patpro.net> wrote:
Hello,

I've noticed that my quite simple ES install (+ Logstash) has 2 nodes
running, but I configured only one. Is this a normal behavior?
And its health is "yellow", as a consequence I guess of this second
uninvited node.

egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort

-u

cluster.name: elasticsearch
network.bind_host: 127.0.0.1
network.host: 127.0.0.1
path.conf: /usr/local/etc/elasticsearch
path.data: /zdata/elasticsearch
path.logs: /var/log/elasticsearch
path.plugins: /usr/local/lib/elasticsearch/plugins
path.work: /var/tmp/elasticsearch

curl http://localhost:9200/_nodes/process?pretty

{
"cluster_name" : "elasticsearch",
"nodes" : {
"hPT0PtRjTCqbZCCn60dnwg" : {
"name" : "Living Diamond",
"transport_address" : "inet[/127.0.0.1:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.1.0",
"build" : "2181e11",
"http_address" : "inet[/127.0.0.1:9200]",
"process" : {
"refresh_interval" : 1000,
"id" : 64168,
"max_file_descriptors" : 11095,
"mlockall" : false
}
},
"jnsj-WAIQGGQLJODnda90Q" : {
"name" : "logstash-host.domain.tld-76994-4112",
"transport_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.0.1",
"build" : "5c03844",
"attributes" : {
"client" : "true",
"data" : "false"
},
"process" : {
"refresh_interval" : 1000,
"id" : 76994,
"max_file_descriptors" : 11095,
"mlockall" : false
}
}
}
}

curl http://localhost:9200/_cluster/health?pretty

{
"cluster_name" : "elasticsearch",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 2,
"number_of_data_nodes" : 1,
"active_primary_shards" : 281,
"active_shards" : 281,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 281
}

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-_Ms3gT2ug0WRc2C3TP_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/98C7B4CA-9E82-4CAE-B33D-FDA1E6F5FA60%40patpro.net
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAEM624boDAv_4wf5XgnjtRNFGgDhGJ7qgthsdX9SYFEDR%2BSTHA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

7

The output section of my LS config:

output {
elasticsearch {
#embedded => true
embedded => false
#embedded_http_port => 9200
cluster => elasticsearch
host => "127.0.0.1"
# port => 9200
}
}

I've tried both ElasticHQ and Marvel recently, and they all advertise 2 nodes. I'm pretty sure now that the second one is started by logstash, under the hood.

On 10 mai 2014, at 03:10, Mark Walkom wrote:

What's your LS config, are you using http output?

Also, install Marvel or ElasticHQ to give yourself a visual insight into your cluster.

Regards,
Mark Walkom

Infrastructure Engineer
Campaign Monitor
email: markw@campaignmonitor.com
web: www.campaignmonitor.com

On 10 May 2014 10:02, Patrick Proniewski elasticsearch@patpro.net wrote:
No, it's even explicitly disabled since tonight. No difference. But may be it's a logstash bug (1.4.0)

On 10 mai 2014, at 01:32, Ivan Brusic wrote:

I am not a logstash expert, but did you perhaps enable an embedded version in the output section of your logstash config?

--
Ivan

On Fri, May 9, 2014 at 4:18 PM, Patrick Proniewski elasticsearch@patpro.net wrote:
I have only one server. host.domain.tld and PUB.LIC.IP.ADDR always represent the same values.
It looks like the client node is started by Logstash, I don't think its useful, but I can't find a way to disable it.

On 10 mai 2014, at 01:00, Ivan Brusic wrote:

It appears there is another Elasticsearch node on your network. Since you masked the value I cannot tell, but are transport_address and host the same for both nodes?

If there is indeed another node on the network, you can either change the cluster name or disable multicast and use unicast. If you will only have 1 node, you do not even need to use unicast.

Cheers,

Ivan

On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski elasticsearch@patpro.net wrote:
Hello,

I've noticed that my quite simple ES install (+ Logstash) has 2 nodes running, but I configured only one. Is this a normal behavior?
And its health is "yellow", as a consequence I guess of this second uninvited node.

egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort -u

cluster.name: elasticsearch
network.bind_host: 127.0.0.1
network.host: 127.0.0.1
path.conf: /usr/local/etc/elasticsearch
path.data: /zdata/elasticsearch
path.logs: /var/log/elasticsearch
path.plugins: /usr/local/lib/elasticsearch/plugins
path.work: /var/tmp/elasticsearch

curl http://localhost:9200/_nodes/process?pretty

{
"cluster_name" : "elasticsearch",
"nodes" : {
"hPT0PtRjTCqbZCCn60dnwg" : {
"name" : "Living Diamond",
"transport_address" : "inet[/127.0.0.1:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.1.0",
"build" : "2181e11",
"http_address" : "inet[/127.0.0.1:9200]",
"process" : {
"refresh_interval" : 1000,
"id" : 64168,
"max_file_descriptors" : 11095,
"mlockall" : false
}
},
"jnsj-WAIQGGQLJODnda90Q" : {
"name" : "logstash-host.domain.tld-76994-4112",
"transport_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.0.1",
"build" : "5c03844",
"attributes" : {
"client" : "true",
"data" : "false"
},
"process" : {
"refresh_interval" : 1000,
"id" : 76994,
"max_file_descriptors" : 11095,
"mlockall" : false
}
}
}
}

curl http://localhost:9200/_cluster/health?pretty

{
"cluster_name" : "elasticsearch",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 2,
"number_of_data_nodes" : 1,
"active_primary_shards" : 281,
"active_shards" : 281,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 281
}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-_Ms3gT2ug0WRc2C3TP_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/98C7B4CA-9E82-4CAE-B33D-FDA1E6F5FA60%40patpro.net.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAEM624boDAv_4wf5XgnjtRNFGgDhGJ7qgthsdX9SYFEDR%2BSTHA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/6E4C4E6A-49A5-41CE-A3DC-7188FCC216EE%40patpro.net.
For more options, visit https://groups.google.com/d/optout.

8

Ok the second "node" is just a client that LS spins up to interface to the
cluster, as you mention.

There's more on that here -

Regards,
Mark Walkom

Infrastructure Engineer
Campaign Monitor
email: markw@campaignmonitor.com
web: www.campaignmonitor.com

On 10 May 2014 18:18, Patrick Proniewski elasticsearch@patpro.net wrote:

The output section of my LS config:

output {
elasticsearch {
#embedded => true
embedded => false
#embedded_http_port => 9200
cluster => elasticsearch
host => "127.0.0.1"
# port => 9200
}
}

I've tried both ElasticHQ and Marvel recently, and they all advertise 2
nodes. I'm pretty sure now that the second one is started by logstash,
under the hood.

On 10 mai 2014, at 03:10, Mark Walkom wrote:

What's your LS config, are you using http output?

Also, install Marvel or ElasticHQ to give yourself a visual insight into
your cluster.

Regards,
Mark Walkom

Infrastructure Engineer
Campaign Monitor
email: markw@campaignmonitor.com
web: www.campaignmonitor.com

On 10 May 2014 10:02, Patrick Proniewski elasticsearch@patpro.net
wrote:
No, it's even explicitly disabled since tonight. No difference. But may
be it's a logstash bug (1.4.0)

On 10 mai 2014, at 01:32, Ivan Brusic wrote:

I am not a logstash expert, but did you perhaps enable an embedded
version in the output section of your logstash config?

--
Ivan

On Fri, May 9, 2014 at 4:18 PM, Patrick Proniewski <
elasticsearch@patpro.net> wrote:
I have only one server. host.domain.tld and PUB.LIC.IP.ADDR always
represent the same values.
It looks like the client node is started by Logstash, I don't think
its useful, but I can't find a way to disable it.

On 10 mai 2014, at 01:00, Ivan Brusic wrote:

It appears there is another Elasticsearch node on your network.
Since you masked the value I cannot tell, but are transport_address and
host the same for both nodes?

If there is indeed another node on the network, you can either
change the cluster name or disable multicast and use unicast. If you will
only have 1 node, you do not even need to use unicast.

Cheers,

Ivan

On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski <
elasticsearch@patpro.net> wrote:
Hello,

I've noticed that my quite simple ES install (+ Logstash) has 2
nodes running, but I configured only one. Is this a normal behavior?
And its health is "yellow", as a consequence I guess of this second
uninvited node.

egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml |

sort -u

cluster.name: elasticsearch
network.bind_host: 127.0.0.1
network.host: 127.0.0.1
path.conf: /usr/local/etc/elasticsearch
path.data: /zdata/elasticsearch
path.logs: /var/log/elasticsearch
path.plugins: /usr/local/lib/elasticsearch/plugins
path.work: /var/tmp/elasticsearch

curl http://localhost:9200/_nodes/process?pretty

{
"cluster_name" : "elasticsearch",
"nodes" : {
"hPT0PtRjTCqbZCCn60dnwg" : {
"name" : "Living Diamond",
"transport_address" : "inet[/127.0.0.1:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.1.0",
"build" : "2181e11",
"http_address" : "inet[/127.0.0.1:9200]",
"process" : {
"refresh_interval" : 1000,
"id" : 64168,
"max_file_descriptors" : 11095,
"mlockall" : false
}
},
"jnsj-WAIQGGQLJODnda90Q" : {
"name" : "logstash-host.domain.tld-76994-4112",
"transport_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.0.1",
"build" : "5c03844",
"attributes" : {
"client" : "true",
"data" : "false"
},
"process" : {
"refresh_interval" : 1000,
"id" : 76994,
"max_file_descriptors" : 11095,
"mlockall" : false
}
}
}
}

curl http://localhost:9200/_cluster/health?pretty

{
"cluster_name" : "elasticsearch",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 2,
"number_of_data_nodes" : 1,
"active_primary_shards" : 281,
"active_shards" : 281,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 281
}

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it,
send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it,
send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-_Ms3gT2ug0WRc2C3TP_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/98C7B4CA-9E82-4CAE-B33D-FDA1E6F5FA60%40patpro.net
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAEM624boDAv_4wf5XgnjtRNFGgDhGJ7qgthsdX9SYFEDR%2BSTHA%40mail.gmail.com
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/6E4C4E6A-49A5-41CE-A3DC-7188FCC216EE%40patpro.net
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAEM624Z3Ongxqp0f1whDd-4riTdKnY2LozY8RdRhBP8ggfNLPg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

9

Ok, so nothing to worry about then. Thanks! (and now I see LS 1.4.1 is out, good news).

On 10 mai 2014, at 10:45, Mark Walkom wrote:

Ok the second "node" is just a client that LS spins up to interface to the cluster, as you mention.

There's more on that here - Elasticsearch output plugin | Logstash Reference [8.11] | Elastic

Regards,
Mark Walkom

Infrastructure Engineer
Campaign Monitor
email: markw@campaignmonitor.com
web: www.campaignmonitor.com

On 10 May 2014 18:18, Patrick Proniewski elasticsearch@patpro.net wrote:
The output section of my LS config:

output {
elasticsearch {
#embedded => true
embedded => false
#embedded_http_port => 9200
cluster => elasticsearch
host => "127.0.0.1"
# port => 9200
}
}

I've tried both ElasticHQ and Marvel recently, and they all advertise 2 nodes. I'm pretty sure now that the second one is started by logstash, under the hood.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/AF8ED71A-46E5-46E7-A46A-0F853E5A138E%40patpro.net.
For more options, visit https://groups.google.com/d/optout.