Data tier problem - New Indices not allocating in data_hot

Elastic Stack Elasticsearch
1

Hi,
I'm (trying) to implement a hot/warm architecture using the concept of data tiers.
I have several clusters with a hot/warm/cold architecture working perfectly but the implementation was done based on node.attr.
Now I have this setup for indices with 1 shard, 0 replicas.
Elastic Stack version 7.14

  • 3 nodes cluster
    siem01 node with roles data_hot, master, data
    siem02 node with roles data_warm, master, data
    siem03 node with role master

image

  • I've modified my winlogbeat-7.14 index pattern in order to the new index to be created in the data_hot node (siem01). In my understanding to achieve that, I have to put

image
image626×516 46.6 KB

Is my understanding correct?
Having modified my index pattern, I perform the following test

image

and I see that new indices are generated also in siem02 node

image

What is wrong?
Thank you very much in advance
Regards
Ana

1 Like
2

The documentation says that if you set a node role to one of the specialized data roles, like data_hot or data_warm, the node cannot have the generic data role.

A node can belong to multiple tiers, but a node that has one of the specialized data roles cannot have the generic data role.

Your nodes seems to have a specializaed role and the generic data role, for example:
siem01 node with roles data_hot, master, data.

I didn't find in the documentation any information about what would happen if you set a specialized data role as data_hot and also the generic data role, but I would assume that the generic data role would override the specialized data_hot role.

This would explain why you have data in both of your nodes with the allocation type set to only data_hot.

Can you remove the generic data role from your nodes and test it?

1 Like
3

Hi Leandro,
Thank you for your response. That was my next thing to try, to remove the data role.
I wasn't aware of the note about specialized data nodes.
I'll let you know once I remove the data role
Thank you!

4

Yes. The problem was caused by having the general and specialized data role in the node.
The generic data role have precedence over the specialized data node and that was causing this behaviour.
Thank you very much
Regads
Ana

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.