# Curl call for PUT and GET query on multi-node es cluster

**URL:** <https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942>\
**Category:** Elasticsearch\
**Created:** [September 22, 2021, 9:01pm UTC](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942 "2021-09-22T21:01:54Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![prat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prat/32/79978_2.png) [@prat](https://discuss.elastic.co/u/prat)\
**Post date:** [September 22, 2021, 9:01pm UTC](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942/1 "2021-09-22T21:01:54Z")

</div>

Hi Team,

I would like to know on a multi-node Elasticsearch cluster (3 nodes), to which node we can send PUT curl call (say for creating ILM policy) or to fetch some results (by running query)?

In a single node cluster, it is clear that we need to send all create and GET requests to single node but what in the case of multiple node cluster?

Below is the example of single node cluster using ansible tool for creating ILM policy but what we should do in case of multi node cluster?

```auto
- name: creating ILM policy 
  uri:
    method: PUT
    url: "http://{{ elasticsearch1_private_ip }}:{{ elasticsearch_port }}/_ilm/policy/testpolicy"
    body: "{{ lookup('file', '{{ file }}/policy.json') }}"
    body_format: json
    user: "{{ elasticsearch_username }}"
    password: "{{ elasticsearch_password }}"
    status_code: 200

```

GET request -

For fetching the results of query, i read somewhere in Elasticsearch documentation (not able to find now) that we should not send request directly to any es node and instead should sent to a load balancer kind of thing that will forward the request to one of the es node at backend.

Create request -

Can we send PUT curl call to one of the es node and will it create the ILM policy in the whole cluster? i.e will one node take care of making other two aware of this change and will this get spread to the cluster wise?

Thanks,

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 22, 2021, 10:00pm UTC](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942/2 "2021-09-22T22:00:58Z")

</div>

You can use any node at all for this. And because all the nodes are clustered, then changes apply to all nodes in said cluster.

---

<div class="post-metadata">

**Author:** ![prat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prat/32/79978_2.png) [@prat](https://discuss.elastic.co/u/prat)\
**Post date:** [September 22, 2021, 10:14pm UTC](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942/3 "2021-09-22T22:14:39Z")

</div>

Hi @warkolm,

Thanks for prompt response.

What you said is correct for creating something in Elasticsearch.

Is above said for `GET request` is true?

Thanks,

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 22, 2021, 10:30pm UTC](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942/4 "2021-09-22T22:30:58Z")

</div>

Yes.

---

<div class="post-metadata">

**Author:** ![cool999](https://avatars.discourse-cdn.com/v4/letter/c/d26b3c/32.png) [@cool999](https://discuss.elastic.co/u/cool999)\
**Post date:** [September 22, 2021, 10:52pm UTC](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942/5 "2021-09-22T22:52:43Z")

</div>

@warkolm

Thank you.

---

<div class="post-metadata">

**Author:** ![prat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prat/32/79978_2.png) [@prat](https://discuss.elastic.co/u/prat)\
**Post date:** [September 23, 2021, 9:08pm UTC](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942/6 "2021-09-23T21:08:45Z")

</div>

Hi @warkolm,

Adding to above, i have deployed es on multi-node cluster and this is how it configured `logstash.yml` file.

```auto
input {
  beats {
    port => 5044
  }
}
filter {
if [log_type] == "access_server" and [app_id] == "pa"
  {
    grok { match => { "message" => "%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:%{MINUTE}(?::?%{SECOND})\| %{USERNAME:exchangeId}\| %{DATA:trackingId}\| %{NUMBER:RoundTrip:int}%{SPACE}ms\| %{NUMBER:ProxyRoundTrip:int}%{SPACE}ms\| %{NUMBER:UserInfoRoundTrip:int}%{SPACE}ms\| %{DATA:Resource}\| %{DATA:subject}\| %{DATA:authmech}\| %{DATA:scopes}\| %{IPV4:Client}\| %{WORD:method}\| %{DATA:Request_URI}\| %{INT:response_code}\| %{DATA:failedRuleType}\| %{DATA:failedRuleName}\| %{DATA:APP_Name}\| %{DATA:Resource_Name}\| %{DATA:Path_Prefix}" } }
    mutate {
             replace => {
               "[type]" => "access_server"
             }
           }
  }
output {
  if [log_type] == "access_server" {
  elasticsearch {
    hosts => ['http://10.10.10.242:9200', 'http://10.10.10.243:9200', 'http://10.10.10.244:9200']
        user => elastic
    password => "${es_pwd}"
     index => "access"
     template_name => "access"
     template_overwrite => "false"
      }
 }
 elasticsearch {
    hosts => ['http://10.10.10.242:9200', 'http://10.10.10.243:9200', 'http://10.10.10.244:9200']
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM}"
    user => elastic
    password => "${es_pwd}"
  }
}

```

I have tested similar above config file on single es server (i.e only single server was mentioned in hosts =\> and data was getting indexed), but on current multi-node cluster after deploying es data is not getting indexed.

Is mentioning all three e.s hosts is wrong and only need to mentioned? as you said above?

---

<div class="post-metadata">

**Author:** ![prat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prat/32/79978_2.png) [@prat](https://discuss.elastic.co/u/prat)\
**Post date:** [September 26, 2021, 11:22am UTC](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942/7 "2021-09-26T11:22:33Z")

</div>

HI @warkolm,

Can you update on last Q. Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 27, 2021, 12:01am UTC](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942/8 "2021-09-27T00:01:40Z")

</div>

Please start a new topic for that question.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2021, 12:02am UTC](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942/9 "2021-10-25T00:02:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.