# 2 nodes instead of one
**URL:** https://discuss.elastic.co/t/2-nodes-instead-of-one/17441
**Category:** Elasticsearch
**Created:** [May 9, 2014, 10:48pm UTC](https://discuss.elastic.co/t/2-nodes-instead-of-one/17441 "2014-05-09T22:48:45Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Patrick\_Proniewski](https://discuss.elastic.co/u/Patrick_Proniewski)
#### Post date: [May 9, 2014, 10:48pm UTC](https://discuss.elastic.co/t/2-nodes-instead-of-one/17441/1 "2014-05-09T22:48:45Z")
Hello,
I've noticed that my quite simple ES install (+ Logstash) has 2 nodes running, but I configured only one. Is this a normal behavior?
And its health is "yellow", as a consequence I guess of this second uninvited node.
# egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort -u
cluster.name: elasticsearch
network.bind\_host: 127.0.0.1
network.host: 127.0.0.1
path.conf: /usr/local/etc/elasticsearch
path.data: /zdata/elasticsearch
path.logs: /var/log/elasticsearch
path.plugins: /usr/local/lib/elasticsearch/plugins
path.work: /var/tmp/elasticsearch
# curl [http://localhost:9200/\_nodes/process?pretty](http://localhost:9200/_nodes/process?pretty)
{
"cluster\_name" : "elasticsearch",
"nodes" : {
"hPT0PtRjTCqbZCCn60dnwg" : {
"name" : "Living Diamond",
"transport\_address" : "inet[/127.0.0.1:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.1.0",
"build" : "2181e11",
"http\_address" : "inet[/127.0.0.1:9200]",
"process" : {
"refresh\_interval" : 1000,
"id" : 64168,
"max\_file\_descriptors" : 11095,
"mlockall" : false
}
},
"jnsj-WAIQGGQLJODnda90Q" : {
"name" : "logstash-host.domain.tld-76994-4112",
"transport\_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
"host" : "host.domain.tld",
"ip" : "PUB.LIC.IP.ADDR",
"version" : "1.0.1",
"build" : "5c03844",
"attributes" : {
"client" : "true",
"data" : "false"
},
"process" : {
"refresh\_interval" : 1000,
"id" : 76994,
"max\_file\_descriptors" : 11095,
"mlockall" : false
}
}
}
}
# curl [http://localhost:9200/\_cluster/health?pretty](http://localhost:9200/_cluster/health?pretty)
{
"cluster\_name" : "elasticsearch",
"status" : "yellow",
"timed\_out" : false,
"number\_of\_nodes" : 2,
"number\_of\_data\_nodes" : 1,
"active\_primary\_shards" : 281,
"active\_shards" : 281,
"relocating\_shards" : 0,
"initializing\_shards" : 0,
"unassigned\_shards" : 281
}
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Ivan](https://discuss.elastic.co/u/Ivan)
#### Post date: [May 9, 2014, 11:00pm UTC](https://discuss.elastic.co/t/2-nodes-instead-of-one/17441/2 "2014-05-09T23:00:55Z")
It appears there is another Elasticsearch node on your network. Since you
masked the value I cannot tell, but are transport\_address and host the same
for both nodes?
If there is indeed another node on the network, you can either change the
cluster name or disable multicast and use unicast. If you will only have 1
node, you do not even need to use unicast.
Cheers,
Ivan
On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski \<[elasticsearch@patpro.net](mailto:elasticsearch@patpro.net)
> wrote:
> Hello,
>
> I've noticed that my quite simple ES install (+ Logstash) has 2 nodes
> running, but I configured only one. Is this a normal behavior?
> And its health is "yellow", as a consequence I guess of this second
> uninvited node.
>
> # egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort -u
>
> cluster.name: elasticsearch
> network.bind\_host: 127.0.0.1
> network.host: 127.0.0.1
> path.conf: /usr/local/etc/elasticsearch
> path.data: /zdata/elasticsearch
> path.logs: /var/log/elasticsearch
> path.plugins: /usr/local/lib/elasticsearch/plugins
> path.work: /var/tmp/elasticsearch
>
> # curl [http://localhost:9200/\_nodes/process?pretty](http://localhost:9200/_nodes/process?pretty)
>
> {
> "cluster\_name" : "elasticsearch",
> "nodes" : {
> "hPT0PtRjTCqbZCCn60dnwg" : {
> "name" : "Living Diamond",
> "transport\_address" : "inet[/127.0.0.1:9300]",
> "host" : "host.domain.tld",
> "ip" : "PUB.LIC.IP.ADDR",
> "version" : "1.1.0",
> "build" : "2181e11",
> "http\_address" : "inet[/127.0.0.1:9200]",
> "process" : {
> "refresh\_interval" : 1000,
> "id" : 64168,
> "max\_file\_descriptors" : 11095,
> "mlockall" : false
> }
> },
> "jnsj-WAIQGGQLJODnda90Q" : {
> "name" : "logstash-host.domain.tld-76994-4112",
> "transport\_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
> "host" : "host.domain.tld",
> "ip" : "PUB.LIC.IP.ADDR",
> "version" : "1.0.1",
> "build" : "5c03844",
> "attributes" : {
> "client" : "true",
> "data" : "false"
> },
> "process" : {
> "refresh\_interval" : 1000,
> "id" : 76994,
> "max\_file\_descriptors" : 11095,
> "mlockall" : false
> }
> }
> }
> }
>
> # curl [http://localhost:9200/\_cluster/health?pretty](http://localhost:9200/_cluster/health?pretty)
>
> {
> "cluster\_name" : "elasticsearch",
> "status" : "yellow",
> "timed\_out" : false,
> "number\_of\_nodes" : 2,
> "number\_of\_data\_nodes" : 1,
> "active\_primary\_shards" : 281,
> "active\_shards" : 281,
> "relocating\_shards" : 0,
> "initializing\_shards" : 0,
> "unassigned\_shards" : 281
> }
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net)
> .
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Patrick\_Proniewski](https://discuss.elastic.co/u/Patrick_Proniewski)
#### Post date: [May 9, 2014, 11:18pm UTC](https://discuss.elastic.co/t/2-nodes-instead-of-one/17441/3 "2014-05-09T23:18:11Z")
I have only one server. host.domain.tld and PUB.LIC.IP.ADDR always represent the same values.
It looks like the client node is started by Logstash, I don't think its useful, but I can't find a way to disable it.
On 10 mai 2014, at 01:00, Ivan Brusic wrote:
> It appears there is another Elasticsearch node on your network. Since you masked the value I cannot tell, but are transport\_address and host the same for both nodes?
>
> If there is indeed another node on the network, you can either change the cluster name or disable multicast and use unicast. If you will only have 1 node, you do not even need to use unicast.
>
> Cheers,
>
> Ivan
>
> On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net) wrote:
> Hello,
>
> I've noticed that my quite simple ES install (+ Logstash) has 2 nodes running, but I configured only one. Is this a normal behavior?
> And its health is "yellow", as a consequence I guess of this second uninvited node.
>
> # egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort -u
>
> cluster.name: elasticsearch
> network.bind\_host: 127.0.0.1
> network.host: 127.0.0.1
> path.conf: /usr/local/etc/elasticsearch
> path.data: /zdata/elasticsearch
> path.logs: /var/log/elasticsearch
> path.plugins: /usr/local/lib/elasticsearch/plugins
> path.work: /var/tmp/elasticsearch
>
> # curl [http://localhost:9200/\_nodes/process?pretty](http://localhost:9200/_nodes/process?pretty)
>
> {
> "cluster\_name" : "elasticsearch",
> "nodes" : {
> "hPT0PtRjTCqbZCCn60dnwg" : {
> "name" : "Living Diamond",
> "transport\_address" : "inet[/127.0.0.1:9300]",
> "host" : "host.domain.tld",
> "ip" : "PUB.LIC.IP.ADDR",
> "version" : "1.1.0",
> "build" : "2181e11",
> "http\_address" : "inet[/127.0.0.1:9200]",
> "process" : {
> "refresh\_interval" : 1000,
> "id" : 64168,
> "max\_file\_descriptors" : 11095,
> "mlockall" : false
> }
> },
> "jnsj-WAIQGGQLJODnda90Q" : {
> "name" : "logstash-host.domain.tld-76994-4112",
> "transport\_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
> "host" : "host.domain.tld",
> "ip" : "PUB.LIC.IP.ADDR",
> "version" : "1.0.1",
> "build" : "5c03844",
> "attributes" : {
> "client" : "true",
> "data" : "false"
> },
> "process" : {
> "refresh\_interval" : 1000,
> "id" : 76994,
> "max\_file\_descriptors" : 11095,
> "mlockall" : false
> }
> }
> }
> }
>
> # curl [http://localhost:9200/\_cluster/health?pretty](http://localhost:9200/_cluster/health?pretty)
>
> {
> "cluster\_name" : "elasticsearch",
> "status" : "yellow",
> "timed\_out" : false,
> "number\_of\_nodes" : 2,
> "number\_of\_data\_nodes" : 1,
> "active\_primary\_shards" : 281,
> "active\_shards" : 281,
> "relocating\_shards" : 0,
> "initializing\_shards" : 0,
> "unassigned\_shards" : 281
> }
>
> --
> You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net).
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
>
> --
> You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com).
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Ivan](https://discuss.elastic.co/u/Ivan)
#### Post date: [May 9, 2014, 11:32pm UTC](https://discuss.elastic.co/t/2-nodes-instead-of-one/17441/4 "2014-05-09T23:32:00Z")
I am not a logstash expert, but did you perhaps enable an embedded version
in the output section of your logstash config?
--
Ivan
On Fri, May 9, 2014 at 4:18 PM, Patrick Proniewski \<[elasticsearch@patpro.net](mailto:elasticsearch@patpro.net)
> wrote:
> I have only one server. host.domain.tld and PUB.LIC.IP.ADDR always
> represent the same values.
> It looks like the client node is started by Logstash, I don't think its
> useful, but I can't find a way to disable it.
>
> On 10 mai 2014, at 01:00, Ivan Brusic wrote:
>
> > It appears there is another Elasticsearch node on your network. Since
> > you masked the value I cannot tell, but are transport\_address and host the
> > same for both nodes?
> >
> > If there is indeed another node on the network, you can either change
> > the cluster name or disable multicast and use unicast. If you will only
> > have 1 node, you do not even need to use unicast.
> >
> > Cheers,
> >
> > Ivan
> >
> > On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski \<
> > [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net)\> wrote:
> > Hello,
> >
> > I've noticed that my quite simple ES install (+ Logstash) has 2 nodes
> > running, but I configured only one. Is this a normal behavior?
> > And its health is "yellow", as a consequence I guess of this second
> > uninvited node.
> >
> > # egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort -u
> >
> > cluster.name: elasticsearch
> > network.bind\_host: 127.0.0.1
> > network.host: 127.0.0.1
> > path.conf: /usr/local/etc/elasticsearch
> > path.data: /zdata/elasticsearch
> > path.logs: /var/log/elasticsearch
> > path.plugins: /usr/local/lib/elasticsearch/plugins
> > path.work: /var/tmp/elasticsearch
> >
> > # curl [http://localhost:9200/\_nodes/process?pretty](http://localhost:9200/_nodes/process?pretty)
> >
> > {
> > "cluster\_name" : "elasticsearch",
> > "nodes" : {
> > "hPT0PtRjTCqbZCCn60dnwg" : {
> > "name" : "Living Diamond",
> > "transport\_address" : "inet[/127.0.0.1:9300]",
> > "host" : "host.domain.tld",
> > "ip" : "PUB.LIC.IP.ADDR",
> > "version" : "1.1.0",
> > "build" : "2181e11",
> > "http\_address" : "inet[/127.0.0.1:9200]",
> > "process" : {
> > "refresh\_interval" : 1000,
> > "id" : 64168,
> > "max\_file\_descriptors" : 11095,
> > "mlockall" : false
> > }
> > },
> > "jnsj-WAIQGGQLJODnda90Q" : {
> > "name" : "logstash-host.domain.tld-76994-4112",
> > "transport\_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
> > "host" : "host.domain.tld",
> > "ip" : "PUB.LIC.IP.ADDR",
> > "version" : "1.0.1",
> > "build" : "5c03844",
> > "attributes" : {
> > "client" : "true",
> > "data" : "false"
> > },
> > "process" : {
> > "refresh\_interval" : 1000,
> > "id" : 76994,
> > "max\_file\_descriptors" : 11095,
> > "mlockall" : false
> > }
> > }
> > }
> > }
> >
> > # curl [http://localhost:9200/\_cluster/health?pretty](http://localhost:9200/_cluster/health?pretty)
> >
> > {
> > "cluster\_name" : "elasticsearch",
> > "status" : "yellow",
> > "timed\_out" : false,
> > "number\_of\_nodes" : 2,
> > "number\_of\_data\_nodes" : 1,
> > "active\_primary\_shards" : 281,
> > "active\_shards" : 281,
> > "relocating\_shards" : 0,
> > "initializing\_shards" : 0,
> > "unassigned\_shards" : 281
> > }
> >
> > --
> > You received this message because you are subscribed to the Google
> > Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> > an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net)
> > .
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> >
> > --
> > You received this message because you are subscribed to the Google
> > Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> > an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com)
> > .
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net)
> .
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-\_Ms3gT2ug0WRc2C3TP\_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-_Ms3gT2ug0WRc2C3TP_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Patrick\_Proniewski](https://discuss.elastic.co/u/Patrick_Proniewski)
#### Post date: [May 10, 2014, 12:02am UTC](https://discuss.elastic.co/t/2-nodes-instead-of-one/17441/5 "2014-05-10T00:02:03Z")
No, it's even explicitly disabled since tonight. No difference. But may be it's a logstash bug (1.4.0)
On 10 mai 2014, at 01:32, Ivan Brusic wrote:
> I am not a logstash expert, but did you perhaps enable an embedded version in the output section of your logstash config?
>
> --
> Ivan
>
> On Fri, May 9, 2014 at 4:18 PM, Patrick Proniewski [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net) wrote:
> I have only one server. host.domain.tld and PUB.LIC.IP.ADDR always represent the same values.
> It looks like the client node is started by Logstash, I don't think its useful, but I can't find a way to disable it.
>
> On 10 mai 2014, at 01:00, Ivan Brusic wrote:
>
> > It appears there is another Elasticsearch node on your network. Since you masked the value I cannot tell, but are transport\_address and host the same for both nodes?
> >
> > If there is indeed another node on the network, you can either change the cluster name or disable multicast and use unicast. If you will only have 1 node, you do not even need to use unicast.
> >
> > Cheers,
> >
> > Ivan
> >
> > On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net) wrote:
> > Hello,
> >
> > I've noticed that my quite simple ES install (+ Logstash) has 2 nodes running, but I configured only one. Is this a normal behavior?
> > And its health is "yellow", as a consequence I guess of this second uninvited node.
> >
> > # egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort -u
> >
> > cluster.name: elasticsearch
> > network.bind\_host: 127.0.0.1
> > network.host: 127.0.0.1
> > path.conf: /usr/local/etc/elasticsearch
> > path.data: /zdata/elasticsearch
> > path.logs: /var/log/elasticsearch
> > path.plugins: /usr/local/lib/elasticsearch/plugins
> > path.work: /var/tmp/elasticsearch
> >
> > # curl [http://localhost:9200/\_nodes/process?pretty](http://localhost:9200/_nodes/process?pretty)
> >
> > {
> > "cluster\_name" : "elasticsearch",
> > "nodes" : {
> > "hPT0PtRjTCqbZCCn60dnwg" : {
> > "name" : "Living Diamond",
> > "transport\_address" : "inet[/127.0.0.1:9300]",
> > "host" : "host.domain.tld",
> > "ip" : "PUB.LIC.IP.ADDR",
> > "version" : "1.1.0",
> > "build" : "2181e11",
> > "http\_address" : "inet[/127.0.0.1:9200]",
> > "process" : {
> > "refresh\_interval" : 1000,
> > "id" : 64168,
> > "max\_file\_descriptors" : 11095,
> > "mlockall" : false
> > }
> > },
> > "jnsj-WAIQGGQLJODnda90Q" : {
> > "name" : "logstash-host.domain.tld-76994-4112",
> > "transport\_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
> > "host" : "host.domain.tld",
> > "ip" : "PUB.LIC.IP.ADDR",
> > "version" : "1.0.1",
> > "build" : "5c03844",
> > "attributes" : {
> > "client" : "true",
> > "data" : "false"
> > },
> > "process" : {
> > "refresh\_interval" : 1000,
> > "id" : 76994,
> > "max\_file\_descriptors" : 11095,
> > "mlockall" : false
> > }
> > }
> > }
> > }
> >
> > # curl [http://localhost:9200/\_cluster/health?pretty](http://localhost:9200/_cluster/health?pretty)
> >
> > {
> > "cluster\_name" : "elasticsearch",
> > "status" : "yellow",
> > "timed\_out" : false,
> > "number\_of\_nodes" : 2,
> > "number\_of\_data\_nodes" : 1,
> > "active\_primary\_shards" : 281,
> > "active\_shards" : 281,
> > "relocating\_shards" : 0,
> > "initializing\_shards" : 0,
> > "unassigned\_shards" : 281
> > }
> >
> > --
> > You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net).
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> >
> > --
> > You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com).
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
>
> --
> You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net).
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
>
> --
> You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-\_Ms3gT2ug0WRc2C3TP\_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-_Ms3gT2ug0WRc2C3TP_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com).
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/98C7B4CA-9E82-4CAE-B33D-FDA1E6F5FA60%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/98C7B4CA-9E82-4CAE-B33D-FDA1E6F5FA60%40patpro.net).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 10, 2014, 1:10am UTC](https://discuss.elastic.co/t/2-nodes-instead-of-one/17441/6 "2014-05-10T01:10:46Z")
What's your LS config, are you using http output?
Also, install Marvel or ElasticHQ to give yourself a visual insight into
your cluster.
Regards,
Mark Walkom
Infrastructure Engineer
Campaign Monitor
email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)
web: [www.campaignmonitor.com](http://www.campaignmonitor.com)
On 10 May 2014 10:02, Patrick Proniewski [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net) wrote:
> No, it's even explicitly disabled since tonight. No difference. But may be
> it's a logstash bug (1.4.0)
>
> On 10 mai 2014, at 01:32, Ivan Brusic wrote:
>
> > I am not a logstash expert, but did you perhaps enable an embedded
> > version in the output section of your logstash config?
> >
> > --
> > Ivan
> >
> > On Fri, May 9, 2014 at 4:18 PM, Patrick Proniewski \<
> > [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net)\> wrote:
> > I have only one server. host.domain.tld and PUB.LIC.IP.ADDR always
> > represent the same values.
> > It looks like the client node is started by Logstash, I don't think its
> > useful, but I can't find a way to disable it.
> >
> > On 10 mai 2014, at 01:00, Ivan Brusic wrote:
> >
> > > It appears there is another Elasticsearch node on your network. Since
> > > you masked the value I cannot tell, but are transport\_address and host the
> > > same for both nodes?
> > >
> > > If there is indeed another node on the network, you can either change
> > > the cluster name or disable multicast and use unicast. If you will only
> > > have 1 node, you do not even need to use unicast.
> > >
> > > Cheers,
> > >
> > > Ivan
> > >
> > > On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski \<
> > > [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net)\> wrote:
> > > Hello,
> > >
> > > I've noticed that my quite simple ES install (+ Logstash) has 2 nodes
> > > running, but I configured only one. Is this a normal behavior?
> > > And its health is "yellow", as a consequence I guess of this second
> > > uninvited node.
> > >
> > > # egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort
>
> -u
>
> > > cluster.name: elasticsearch
> > > network.bind\_host: 127.0.0.1
> > > network.host: 127.0.0.1
> > > path.conf: /usr/local/etc/elasticsearch
> > > path.data: /zdata/elasticsearch
> > > path.logs: /var/log/elasticsearch
> > > path.plugins: /usr/local/lib/elasticsearch/plugins
> > > path.work: /var/tmp/elasticsearch
> > >
> > > # curl [http://localhost:9200/\_nodes/process?pretty](http://localhost:9200/_nodes/process?pretty)
> > >
> > > {
> > > "cluster\_name" : "elasticsearch",
> > > "nodes" : {
> > > "hPT0PtRjTCqbZCCn60dnwg" : {
> > > "name" : "Living Diamond",
> > > "transport\_address" : "inet[/127.0.0.1:9300]",
> > > "host" : "host.domain.tld",
> > > "ip" : "PUB.LIC.IP.ADDR",
> > > "version" : "1.1.0",
> > > "build" : "2181e11",
> > > "http\_address" : "inet[/127.0.0.1:9200]",
> > > "process" : {
> > > "refresh\_interval" : 1000,
> > > "id" : 64168,
> > > "max\_file\_descriptors" : 11095,
> > > "mlockall" : false
> > > }
> > > },
> > > "jnsj-WAIQGGQLJODnda90Q" : {
> > > "name" : "logstash-host.domain.tld-76994-4112",
> > > "transport\_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
> > > "host" : "host.domain.tld",
> > > "ip" : "PUB.LIC.IP.ADDR",
> > > "version" : "1.0.1",
> > > "build" : "5c03844",
> > > "attributes" : {
> > > "client" : "true",
> > > "data" : "false"
> > > },
> > > "process" : {
> > > "refresh\_interval" : 1000,
> > > "id" : 76994,
> > > "max\_file\_descriptors" : 11095,
> > > "mlockall" : false
> > > }
> > > }
> > > }
> > > }
> > >
> > > # curl [http://localhost:9200/\_cluster/health?pretty](http://localhost:9200/_cluster/health?pretty)
> > >
> > > {
> > > "cluster\_name" : "elasticsearch",
> > > "status" : "yellow",
> > > "timed\_out" : false,
> > > "number\_of\_nodes" : 2,
> > > "number\_of\_data\_nodes" : 1,
> > > "active\_primary\_shards" : 281,
> > > "active\_shards" : 281,
> > > "relocating\_shards" : 0,
> > > "initializing\_shards" : 0,
> > > "unassigned\_shards" : 281
> > > }
> > >
> > > --
> > > You received this message because you are subscribed to the Google
> > > Groups "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from it, send
> > > an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > > To view this discussion on the web visit
> > > [https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net)
> > > .
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> > >
> > > --
> > > You received this message because you are subscribed to the Google
> > > Groups "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from it, send
> > > an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > > To view this discussion on the web visit
> > > [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com)
> > > .
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> >
> > --
> > You received this message because you are subscribed to the Google
> > Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> > an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net)
> > .
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> >
> > --
> > You received this message because you are subscribed to the Google
> > Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> > an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-\_Ms3gT2ug0WRc2C3TP\_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-_Ms3gT2ug0WRc2C3TP_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com)
> > .
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/98C7B4CA-9E82-4CAE-B33D-FDA1E6F5FA60%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/98C7B4CA-9E82-4CAE-B33D-FDA1E6F5FA60%40patpro.net)
> .
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEM624boDAv\_4wf5XgnjtRNFGgDhGJ7qgthsdX9SYFEDR%2BSTHA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEM624boDAv_4wf5XgnjtRNFGgDhGJ7qgthsdX9SYFEDR%2BSTHA%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Patrick\_Proniewski](https://discuss.elastic.co/u/Patrick_Proniewski)
#### Post date: [May 10, 2014, 8:18am UTC](https://discuss.elastic.co/t/2-nodes-instead-of-one/17441/7 "2014-05-10T08:18:09Z")
The output section of my LS config:
output {
elasticsearch {
#embedded =\> true
embedded =\> false
#embedded\_http\_port =\> 9200
cluster =\> elasticsearch
host =\> "127.0.0.1"
# port =\> 9200
}
}
I've tried both ElasticHQ and Marvel recently, and they all advertise 2 nodes. I'm pretty sure now that the second one is started by logstash, under the hood.
On 10 mai 2014, at 03:10, Mark Walkom wrote:
> What's your LS config, are you using http output?
>
> Also, install Marvel or ElasticHQ to give yourself a visual insight into your cluster.
>
> Regards,
> Mark Walkom
>
> Infrastructure Engineer
> Campaign Monitor
> email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)
> web: [www.campaignmonitor.com](http://www.campaignmonitor.com)
>
> On 10 May 2014 10:02, Patrick Proniewski [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net) wrote:
> No, it's even explicitly disabled since tonight. No difference. But may be it's a logstash bug (1.4.0)
>
> On 10 mai 2014, at 01:32, Ivan Brusic wrote:
>
> > I am not a logstash expert, but did you perhaps enable an embedded version in the output section of your logstash config?
> >
> > --
> > Ivan
> >
> > On Fri, May 9, 2014 at 4:18 PM, Patrick Proniewski [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net) wrote:
> > I have only one server. host.domain.tld and PUB.LIC.IP.ADDR always represent the same values.
> > It looks like the client node is started by Logstash, I don't think its useful, but I can't find a way to disable it.
> >
> > On 10 mai 2014, at 01:00, Ivan Brusic wrote:
> >
> > > It appears there is another Elasticsearch node on your network. Since you masked the value I cannot tell, but are transport\_address and host the same for both nodes?
> > >
> > > If there is indeed another node on the network, you can either change the cluster name or disable multicast and use unicast. If you will only have 1 node, you do not even need to use unicast.
> > >
> > > Cheers,
> > >
> > > Ivan
> > >
> > > On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net) wrote:
> > > Hello,
> > >
> > > I've noticed that my quite simple ES install (+ Logstash) has 2 nodes running, but I configured only one. Is this a normal behavior?
> > > And its health is "yellow", as a consequence I guess of this second uninvited node.
> > >
> > > # egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml | sort -u
> > >
> > > cluster.name: elasticsearch
> > > network.bind\_host: 127.0.0.1
> > > network.host: 127.0.0.1
> > > path.conf: /usr/local/etc/elasticsearch
> > > path.data: /zdata/elasticsearch
> > > path.logs: /var/log/elasticsearch
> > > path.plugins: /usr/local/lib/elasticsearch/plugins
> > > path.work: /var/tmp/elasticsearch
> > >
> > > # curl [http://localhost:9200/\_nodes/process?pretty](http://localhost:9200/_nodes/process?pretty)
> > >
> > > {
> > > "cluster\_name" : "elasticsearch",
> > > "nodes" : {
> > > "hPT0PtRjTCqbZCCn60dnwg" : {
> > > "name" : "Living Diamond",
> > > "transport\_address" : "inet[/127.0.0.1:9300]",
> > > "host" : "host.domain.tld",
> > > "ip" : "PUB.LIC.IP.ADDR",
> > > "version" : "1.1.0",
> > > "build" : "2181e11",
> > > "http\_address" : "inet[/127.0.0.1:9200]",
> > > "process" : {
> > > "refresh\_interval" : 1000,
> > > "id" : 64168,
> > > "max\_file\_descriptors" : 11095,
> > > "mlockall" : false
> > > }
> > > },
> > > "jnsj-WAIQGGQLJODnda90Q" : {
> > > "name" : "logstash-host.domain.tld-76994-4112",
> > > "transport\_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
> > > "host" : "host.domain.tld",
> > > "ip" : "PUB.LIC.IP.ADDR",
> > > "version" : "1.0.1",
> > > "build" : "5c03844",
> > > "attributes" : {
> > > "client" : "true",
> > > "data" : "false"
> > > },
> > > "process" : {
> > > "refresh\_interval" : 1000,
> > > "id" : 76994,
> > > "max\_file\_descriptors" : 11095,
> > > "mlockall" : false
> > > }
> > > }
> > > }
> > > }
> > >
> > > # curl [http://localhost:9200/\_cluster/health?pretty](http://localhost:9200/_cluster/health?pretty)
> > >
> > > {
> > > "cluster\_name" : "elasticsearch",
> > > "status" : "yellow",
> > > "timed\_out" : false,
> > > "number\_of\_nodes" : 2,
> > > "number\_of\_data\_nodes" : 1,
> > > "active\_primary\_shards" : 281,
> > > "active\_shards" : 281,
> > > "relocating\_shards" : 0,
> > > "initializing\_shards" : 0,
> > > "unassigned\_shards" : 281
> > > }
> > >
> > > --
> > > You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net).
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> > >
> > > --
> > > You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com).
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> >
> > --
> > You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net).
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> >
> > --
> > You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-\_Ms3gT2ug0WRc2C3TP\_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-_Ms3gT2ug0WRc2C3TP_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com).
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
>
> --
> You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/98C7B4CA-9E82-4CAE-B33D-FDA1E6F5FA60%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/98C7B4CA-9E82-4CAE-B33D-FDA1E6F5FA60%40patpro.net).
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
>
> --
> You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEM624boDAv\_4wf5XgnjtRNFGgDhGJ7qgthsdX9SYFEDR%2BSTHA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEM624boDAv_4wf5XgnjtRNFGgDhGJ7qgthsdX9SYFEDR%2BSTHA%40mail.gmail.com).
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/6E4C4E6A-49A5-41CE-A3DC-7188FCC216EE%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/6E4C4E6A-49A5-41CE-A3DC-7188FCC216EE%40patpro.net).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 10, 2014, 8:45am UTC](https://discuss.elastic.co/t/2-nodes-instead-of-one/17441/8 "2014-05-10T08:45:08Z")
Ok the second "node" is just a client that LS spins up to interface to the
cluster, as you mention.
There's more on that here -
> **[Elasticsearch output plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html)**
Regards,
Mark Walkom
Infrastructure Engineer
Campaign Monitor
email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)
web: [www.campaignmonitor.com](http://www.campaignmonitor.com)
On 10 May 2014 18:18, Patrick Proniewski [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net) wrote:
> The output section of my LS config:
>
> output {
> elasticsearch {
> #embedded =\> true
> embedded =\> false
> #embedded\_http\_port =\> 9200
> cluster =\> elasticsearch
> host =\> "127.0.0.1"
> # port =\> 9200
> }
> }
>
> I've tried both ElasticHQ and Marvel recently, and they all advertise 2
> nodes. I'm pretty sure now that the second one is started by logstash,
> under the hood.
>
> On 10 mai 2014, at 03:10, Mark Walkom wrote:
>
> > What's your LS config, are you using http output?
> >
> > Also, install Marvel or ElasticHQ to give yourself a visual insight into
> > your cluster.
> >
> > Regards,
> > Mark Walkom
> >
> > Infrastructure Engineer
> > Campaign Monitor
> > email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)
> > web: [www.campaignmonitor.com](http://www.campaignmonitor.com)
> >
> > On 10 May 2014 10:02, Patrick Proniewski [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net)
> > wrote:
> > No, it's even explicitly disabled since tonight. No difference. But may
> > be it's a logstash bug (1.4.0)
> >
> > On 10 mai 2014, at 01:32, Ivan Brusic wrote:
> >
> > > I am not a logstash expert, but did you perhaps enable an embedded
> > > version in the output section of your logstash config?
> > >
> > > --
> > > Ivan
> > >
> > > On Fri, May 9, 2014 at 4:18 PM, Patrick Proniewski \<
> > > [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net)\> wrote:
> > > I have only one server. host.domain.tld and PUB.LIC.IP.ADDR always
> > > represent the same values.
> > > It looks like the client node is started by Logstash, I don't think
> > > its useful, but I can't find a way to disable it.
> > >
> > > On 10 mai 2014, at 01:00, Ivan Brusic wrote:
> > >
> > > > It appears there is another Elasticsearch node on your network.
> > > > Since you masked the value I cannot tell, but are transport\_address and
> > > > host the same for both nodes?
> > > >
> > > > If there is indeed another node on the network, you can either
> > > > change the cluster name or disable multicast and use unicast. If you will
> > > > only have 1 node, you do not even need to use unicast.
> > > >
> > > > Cheers,
> > > >
> > > > Ivan
> > > >
> > > > On Fri, May 9, 2014 at 3:48 PM, Patrick Proniewski \<
> > > > [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net)\> wrote:
> > > > Hello,
> > > >
> > > > I've noticed that my quite simple ES install (+ Logstash) has 2
> > > > nodes running, but I configured only one. Is this a normal behavior?
> > > > And its health is "yellow", as a consequence I guess of this second
> > > > uninvited node.
> > > >
> > > > # egrep -v "^#" /usr/local/etc/elasticsearch/elasticsearch.yml |
>
> sort -u
>
> > > > cluster.name: elasticsearch
> > > > network.bind\_host: 127.0.0.1
> > > > network.host: 127.0.0.1
> > > > path.conf: /usr/local/etc/elasticsearch
> > > > path.data: /zdata/elasticsearch
> > > > path.logs: /var/log/elasticsearch
> > > > path.plugins: /usr/local/lib/elasticsearch/plugins
> > > > path.work: /var/tmp/elasticsearch
> > > >
> > > > # curl [http://localhost:9200/\_nodes/process?pretty](http://localhost:9200/_nodes/process?pretty)
> > > >
> > > > {
> > > > "cluster\_name" : "elasticsearch",
> > > > "nodes" : {
> > > > "hPT0PtRjTCqbZCCn60dnwg" : {
> > > > "name" : "Living Diamond",
> > > > "transport\_address" : "inet[/127.0.0.1:9300]",
> > > > "host" : "host.domain.tld",
> > > > "ip" : "PUB.LIC.IP.ADDR",
> > > > "version" : "1.1.0",
> > > > "build" : "2181e11",
> > > > "http\_address" : "inet[/127.0.0.1:9200]",
> > > > "process" : {
> > > > "refresh\_interval" : 1000,
> > > > "id" : 64168,
> > > > "max\_file\_descriptors" : 11095,
> > > > "mlockall" : false
> > > > }
> > > > },
> > > > "jnsj-WAIQGGQLJODnda90Q" : {
> > > > "name" : "logstash-host.domain.tld-76994-4112",
> > > > "transport\_address" : "inet[/PUB.LIC.IP.ADDR:9300]",
> > > > "host" : "host.domain.tld",
> > > > "ip" : "PUB.LIC.IP.ADDR",
> > > > "version" : "1.0.1",
> > > > "build" : "5c03844",
> > > > "attributes" : {
> > > > "client" : "true",
> > > > "data" : "false"
> > > > },
> > > > "process" : {
> > > > "refresh\_interval" : 1000,
> > > > "id" : 76994,
> > > > "max\_file\_descriptors" : 11095,
> > > > "mlockall" : false
> > > > }
> > > > }
> > > > }
> > > > }
> > > >
> > > > # curl [http://localhost:9200/\_cluster/health?pretty](http://localhost:9200/_cluster/health?pretty)
> > > >
> > > > {
> > > > "cluster\_name" : "elasticsearch",
> > > > "status" : "yellow",
> > > > "timed\_out" : false,
> > > > "number\_of\_nodes" : 2,
> > > > "number\_of\_data\_nodes" : 1,
> > > > "active\_primary\_shards" : 281,
> > > > "active\_shards" : 281,
> > > > "relocating\_shards" : 0,
> > > > "initializing\_shards" : 0,
> > > > "unassigned\_shards" : 281
> > > > }
> > > >
> > > > --
> > > > You received this message because you are subscribed to the Google
> > > > Groups "elasticsearch" group.
> > > > To unsubscribe from this group and stop receiving emails from it,
> > > > send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > > > To view this discussion on the web visit
> > > > [https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/83D1BCA7-42DA-439E-9A07-F27B91C8646A%40patpro.net)
> > > > .
> > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> > > >
> > > > --
> > > > You received this message because you are subscribed to the Google
> > > > Groups "elasticsearch" group.
> > > > To unsubscribe from this group and stop receiving emails from it,
> > > > send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > > > To view this discussion on the web visit
> > > > [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQA1fXYvi%2B%2BLyTzEmr%2B7vi5%3DtiOuNe0oXLs0sryJSYtzxQ%40mail.gmail.com)
> > > > .
> > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> > >
> > > --
> > > You received this message because you are subscribed to the Google
> > > Groups "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from it, send
> > > an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > > To view this discussion on the web visit
> > > [https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/813C03EE-BED8-43BB-8943-A25346302478%40patpro.net)
> > > .
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> > >
> > > --
> > > You received this message because you are subscribed to the Google
> > > Groups "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from it, send
> > > an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > > To view this discussion on the web visit
> > > [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-\_Ms3gT2ug0WRc2C3TP\_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCQeo6-_Ms3gT2ug0WRc2C3TP_y5NzeyCcpHD9TZtoQLg%40mail.gmail.com)
> > > .
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> >
> > --
> > You received this message because you are subscribed to the Google
> > Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> > an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/98C7B4CA-9E82-4CAE-B33D-FDA1E6F5FA60%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/98C7B4CA-9E82-4CAE-B33D-FDA1E6F5FA60%40patpro.net)
> > .
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> >
> > --
> > You received this message because you are subscribed to the Google
> > Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> > an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/CAEM624boDAv\_4wf5XgnjtRNFGgDhGJ7qgthsdX9SYFEDR%2BSTHA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEM624boDAv_4wf5XgnjtRNFGgDhGJ7qgthsdX9SYFEDR%2BSTHA%40mail.gmail.com)
> > .
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/6E4C4E6A-49A5-41CE-A3DC-7188FCC216EE%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/6E4C4E6A-49A5-41CE-A3DC-7188FCC216EE%40patpro.net)
> .
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEM624Z3Ongxqp0f1whDd-4riTdKnY2LozY8RdRhBP8ggfNLPg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEM624Z3Ongxqp0f1whDd-4riTdKnY2LozY8RdRhBP8ggfNLPg%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Patrick\_Proniewski](https://discuss.elastic.co/u/Patrick_Proniewski)
#### Post date: [May 10, 2014, 10:26am UTC](https://discuss.elastic.co/t/2-nodes-instead-of-one/17441/9 "2014-05-10T10:26:22Z")
Ok, so nothing to worry about then. Thanks! (and now I see LS 1.4.1 is out, good news).
On 10 mai 2014, at 10:45, Mark Walkom wrote:
> Ok the second "node" is just a client that LS spins up to interface to the cluster, as you mention.
>
> There's more on that here - [Elasticsearch output plugin | Logstash Reference [8.11] | Elastic](http://logstash.net/docs/1.4.1/outputs/elasticsearch#protocol)
>
> Regards,
> Mark Walkom
>
> Infrastructure Engineer
> Campaign Monitor
> email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)
> web: [www.campaignmonitor.com](http://www.campaignmonitor.com)
>
> On 10 May 2014 18:18, Patrick Proniewski [elasticsearch@patpro.net](mailto:elasticsearch@patpro.net) wrote:
> The output section of my LS config:
>
> output {
> elasticsearch {
> #embedded =\> true
> embedded =\> false
> #embedded\_http\_port =\> 9200
> cluster =\> elasticsearch
> host =\> "127.0.0.1"
> # port =\> 9200
> }
> }
>
> I've tried both ElasticHQ and Marvel recently, and they all advertise 2 nodes. I'm pretty sure now that the second one is started by logstash, under the hood.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/AF8ED71A-46E5-46E7-A46A-0F853E5A138E%40patpro.net](https://groups.google.com/d/msgid/elasticsearch/AF8ED71A-46E5-46E7-A46A-0F853E5A138E%40patpro.net).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:30am UTC](https://discuss.elastic.co/t/2-nodes-instead-of-one/17441/10 "2017-07-06T01:30:20Z")