Create a new node

Elastic Stack Elasticsearch
1

Hello

I currently have my elasticsearch service that has only one node, and I would like to do a second one (on the same server), but I really can’t figure out how to do it.

The goal would be to add a "hot" node and a "cold" node

I was told to add this:

image
image

The thing is, as much as I’ve looked, I don’t really know where to add it. Do you have to put these two lines in the/etc/elastisearch/elasticsearch.yml file and the nodes will be created after a restart of the service?

Thank you in advance

2

If you want to run two nodes on the same host then you will need to use docker or something else to make sure they run with their own config files.

3

Hi @warkolm , thank for the awnser

I can't use docker, my server is on a nutanix vm. So it's not possible to have two nodes on the same server?

4

Without docker you will need to install another elasticsearch instance using the .tar.gz file.

You can follow this part of the documentation.

You will need to use different directories for everything, configuration, logs and data.

Besides that, running a hot node and a warm node in the same server does not make much sense, since the resources will be shared between the nodes, there will be no difference between the nodes.

What do you want to do with the hot and warm nodes?

5

@leandrojmp, the goal would be to store 1 year of logs on graylog. The problem is that it would go on more than 10T of storage which is not conceivable

I don’t know yet exactly how I’m going to solve this problem, but setting up this architecture will be a good start for me to better manage the data

Thank you

6

@leandrojmp fter reflexion, the goal would be to apply "best_compression" to the cold node, but so how to duplicate the file /etc/elasticsearch/elasticsearch.yml for example?

7

You need to install another instance using the .tar.gz file, according to the documentation.

The /etc/elasticsearch/ directory and files are used by the packaged installation, .rpm or .deb, you won't use this directory, you need to install the .tar.gz in another directory, for example, /opt/elasticsearch.

Then you will need to edit elasticsearch.yml in this installation and configure your new node, just remember that the data dir and log dir should be different, you will also need to create a systemd service if you want to run this new instance as a service.

But as I said, running two nodes in the same server, depending on your hardware configuration, could degrade the performance of your cluster. I still don't see the reason to run a hot and cold node on the same server, they share the same resources, even if you set your cold node to use best_compression, it would use more CPU of the same server, which would impact your hot node as well, it doesn't justify the work to keep two instances on the same machine. If you need to store 1 year of logs that amount to 10 TB, one server won't help you. If you do not need to search those logs, just store them, you can use snapshots on s3, which could be cheapear than using spinning up another VM.

8

Thanks for your advice @leandrojmp, I’ll try to do that

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.