Elasticsearch 7.1 index shards getting assigned on warm nodes

Elastic Stack Elasticsearch
1

Using Elastic 7.1 stack. Trying to use hot-warm architecture. I have started all my nodes with node.attr.data set to hot or warm, depending on the node. However, I have observed that the current/active index shards are getting allocated to warm nodes as well. This I have observed for both system indexes as well as for custom indexes created via logstash 7.1

I have two questions here:

  1. The system indexes: I was expecting the shards for them will be allocated on hot nodes as I have added node.attr.data: hot in elasticsearch.yml file for the nodes with faster storage. Not sure how I can force that to happen
  2. Custom indexes: I have create ILM policy and used that in logstash elasticsearch output section. Like shown below:
    if "unix_syslog" in [tags] {
    elasticsearch {
    hosts => ["http://host1:port","http://host2:port","http://host3:port"]
    ilm_policy => test_ilm
    ilm_pattern => "{now/d}-000001"
    ilm_rollover_alias => "unix_syslog"
    }
    }

Using above setting, logstash created the index that had one primary shard on hot node and one replica on warm node. I was expecting both primary and replica will be on hot nodes. Is my expectation wrong? If yes, then how do I force active index to have both primary and replica shards on hot nodes ?

test_ilm policy:
{
"policy": {
"phases": {
"hot": {
"min_age": "0ms",
"actions": {
"rollover": {
"max_age": "1d",
"max_size": "50gb"
},
"set_priority": {
"priority": 90
}
}
},
"warm": {
"min_age": "0ms",
"actions": {
"allocate": {
"number_of_replicas": 0,
"include": {},
"exclude": {},
"require": {
"data": "warm"
}
},
"set_priority": {
"priority": 30
}
}
},
"delete": {
"min_age": "2d",
"actions": {
"delete": {}
}
}
}
}
}

2

Have you created an index template that forces the allocation of new indices to hot nodes? If so what does it look like?

3

I thought I don't need a index template as at index creation time I am specifying the ILM policy and other related details. Since ILM associates current data with hot state, it will assign that to hot nodes implicitly. Is this understanding wrong?
If it is mandatory to create a template, then I believe I can do something like below, but I felt it shouldn't be needed.

Template:
{
"index_patterns": ["unix*" ],
"settings": {
"index.routing.allocation.require.data": "hot",
"index.lifecycle.name": "test_ilm",
"number_of_shards": 1,
"number_of_replicas" : 1
}
}

and in logstash config elasticsearch output:
if "unix_syslog" in [tags] {
elasticsearch {
hosts => ["http://host1:port","http://host2:port","http://host3:port"]
ilm_rollover_alias => "unix_syslog"
template => "template.json"
}
}

4

I am not sure if it has changed in 7.x, but for earlier releases you had to use an index template if you were implementing a hot/warm or hot/warm/cold architecture.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.