currently I have a cluster configured in this way:
My Filebeat clients send messages directly to DATA nodes. is it correct or not?
Is it correct to think that MASTER nodes should be excluded from PUT operations?
2 COORDINATING ONLY ROLE
To unburden DATA nodes from a high usage and saturation of resources, should be ok to use the Coordinating only role? In my mind, FB clients should aim directly to them, which will reverse messages to DATA node. is it correct?
If they can handle the traffic you can certainly do that.
Can you explain me better the concept "if they can handle the traffic"? Do you mean something like "if they have enough resources to do that"?
Another option is to index directly to the data nodes and query through the coordinating-only nodes.
if the query is made using API (i.e. curl GET or something similar), do you mean to perform the PUT operations aiming to DATA nodes and the GET operations aiming to COORD nodes? if yes, my application should distinguish the two operations, right? I mean, something like:
if I'm doing a PUT I have to use the hosts --> hosts_DATA if I'm doing a GET I have to use the hosts --> hosts_COORDINATING
just another doubt: COR will join the cluster with all the definition roles into elasticsearch.yml setted to "false".
When my FB clients will contact the COR, how it will know which DATA nodes should be contacted?