Client node vs tribe node

Hi, I have a doubt regarding the client nodes and the tribe nodes.
My application consists of several clusters and each has a load balancer that uses the client node ( client image ) .
I would understand if it is correct or is it better to use a tribe node (tribe image) .
In addition , it is possible and convenient to use the tribe nodes in load balancer instead of the client nodes ?
I take this opportunity to ask a second question , what are the features that you have to have on the server ( CPU , HD , ram ... ) for the various types of nodes (master - data - client - tribe ) ?

Client Image

Tribe Image

In general, if you have a need to search (read) for information across more than one clusters, equivalent to perform a federated search, you should use a tribe node unless you want to manage the search results from multiple indices by yourself.

With the client node, you can index (write) or search (read) for information from one cluster. It takes the load of the master node(s) so the master node(s) can manage the cluster better.

For indexing, you'll definitely at least need the client nodes so the client node diagram is okay if you want to load balance it that way.

For searching,

  • If you need to support federated search from a single application, you need to use the tribe node(s) so the tribe node diagram is okay only to support searches, not indexing. I think indexing data through the tribe node could be confusing unless the index is pre-created in its own cluster, similar to the way kibana works when it is first connecting to the tribe node with the default index, .kibana, has not been pre-created.

  • If you don't need to support federated search, then it's your choice

    • use the client node(s) now then add tribe node later when needed

    • use the tribe node now then add more cluster(s) later when needed, and don't forget you still need the client node(s) for indexing or create a new index upfront if you want to index (write) through the tribe node(s) I think you can configure the tribe node to support "write" but personally, I have not tested it since I index data directly to the cluster that the data is intended to go to. It's more efficient in my case.

1 Like

Ty for response!

I think that, in my case i need one cluster for frontend, one cluster for log/logstash, one cluster for others application, but i need up them all in the same time, as when a user do a login on my site i need to save some data into cluster for Frontend and some data into cluster log; so i need the tribe node in this case becouse i have only one model that control my ES. But i don't understand how i can use the client node into a tribe node, when i need to set in the tribe node only my master node (if i set other node don't work). In addiction, i have set some client node in my ES but when i use this command /_cat/nodes?v i see this:

host ip node.role master name
x x d x data_01
x x d x log_data_01
x x - x client_02
x x d x data_03
x x c x tribe_one
x x d x data_04
x x - x log_master_01
x x - x client_01
x x - x master_01
x x - x master_02
x x d x data_02
x x c x tribe_one/t1
x x c x tribe_one/t2

so my others client node are not setted as client but on the tribe node is a client for ES.
I don't know why it do this....

Why do you need different clusters for these different parts of the application?

becouse i need to separate all system log and all frontend action, so i need a different cluster for a different parts of the application.

so i can stop the cluster log without stop my application.

becouse i need to separate all system log and all frontend action, so i need a different cluster for a different parts of the application.

so i can stop the cluster log without stop my application.

I don't understand. Can't you just use different indexes?

Because i don't want save my log with all my data...i want let them separatly.

I use logstash for save my log...than i need to save other information at the same time...so i can have an overload in my cluster/server/hd.

Or i'm in a wrong way?