Setup: Elasticsearch 6.3.0 with 19 nodes:
12 data nodes
4 client nodes
3 master nodes
We have around:
Cluster size: ~820GB (~175GB of them are .monitoring indices)
1,030,000,000 documents in the cluster (900,000,000 are in .monitoring documents)
7,100 indices (7 of them are .monitoring indices)
24,300 shards (14 of them are .monitoring shards)
xpack.monitoring.enabled os set to true (default).
xpack.monitoring.collection.enabled is set to true (historically, I used Kibana to monitor but I'm not using it anymore).
I am not using those indices and I want to set them both to false.
Both settings are static and raise the following questions:
- Every node contains elasticsearch.yml file. Which one is in charge of the cluster global settings? - will change the master node settings is enough?
- Is it safe to do it "one node at a time"? this is a production cluster and I can't afford downtime.
- Which one of those flags is responsible for this high document rate?