# Elasticsearch additional node

**URL:** <https://discuss.elastic.co/t/elasticsearch-additional-node/33660>\
**Category:** Elasticsearch\
**Created:** [November 3, 2015, 5:35pm UTC](https://discuss.elastic.co/t/elasticsearch-additional-node/33660 "2015-11-03T17:35:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![paulz](https://avatars.discourse-cdn.com/v4/letter/p/cdc98d/32.png) [@paulz](https://discuss.elastic.co/u/paulz)\
**Post date:** [November 3, 2015, 5:35pm UTC](https://discuss.elastic.co/t/elasticsearch-additional-node/33660/1 "2015-11-03T17:35:57Z")

</div>

In our local network I have some server with Logstash + ES + Kibana to analyse the logs from others servers, let's call it log-server.

Just for information, the others servers send the logs using rsyslog facility to the log-server, so logstash get files from /var/remote-log/ directory and then passing them to ES and then to Kibana.

Recently the servers starts to work wrong... I don't know if it's the problem, but...  
Some minutes after the start we see another node with the same IP :

log-server:9200/\_cluster/state/nodes?pretty

{  
"cluster\_name" : "LOG",  
"nodes" : {  
"ylTo0EIRQoeTRpmeFbuKkQ" : {  
"name" : "\<log-server\_dns\_name\>-1849-14534",  
"transport\_address" : "inet[/:9301]",  
"attributes" : {  
"client" : "true",  
"data" : "false"  
}  
},  
"9a9iB\_OHQYaUotDV-9fcQQ" : {  
"name" : "Roland Barthes",  
"transport\_address" : "inet[/:9300]",  
"attributes" : { }  
}  
}  
}

In the ES config there are only two uncommented lines :

cluster.name: LOG  
node.name: "Roland Barthes"

All others lines are commented.

So I don't understand where the node "\<log-server\_dns\_name\>-1849-14534" comes from?  
And that I should do with ?

Just for information. In the same local network there are another ES server, but the "transport\_address" of my second node is the same as the log-server's one... so I do not think that there is some link with another ES- server.

logstash version : 1.5  
ES version : 1.6  
Kibana : 4.0

Thank you for your help.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 3, 2015, 6:16pm UTC](https://discuss.elastic.co/t/elasticsearch-additional-node/33660/2 "2015-11-03T18:16:03Z")

</div>

The other node is probably Logstash connecting with the node protocol.

---

<div class="post-metadata">

**Author:** ![paulz](https://avatars.discourse-cdn.com/v4/letter/p/cdc98d/32.png) [@paulz](https://discuss.elastic.co/u/paulz)\
**Post date:** [November 4, 2015, 9:15am UTC](https://discuss.elastic.co/t/elasticsearch-additional-node/33660/3 "2015-11-04T09:15:31Z")

</div>

Is it something new?  
Because I'm pretty sure that before there was not this additional node...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:40pm UTC](https://discuss.elastic.co/t/elasticsearch-additional-node/33660/4 "2017-07-05T23:40:42Z")

</div>