I am planning to deploy a cluster with 2 nodes. Following is the proposed architecture, I would like a community review.
- Purpose: Non-enterprise. Final year project that will be collecting data from internet sensors (honeypots) for next 6 months.
- Primary risk consideration: Downtime. Any downtime would break the chain of collection.
- Proposed architecture: 2 Node cluster.
A a student I have limited compute resources. I have a single workstation that will server both nodes (I understand the downside of having single underlying hardware, however; given the situation I have to accept the risk.) I have a NAS which backups the VMs every 12 hours to minimise data recovery point objective.
Here are my questions:
Logstash pipeline is having IP of primary node. What are the steps to be taken when I have to take the primary node offline? How do I manage auto-switching of IPs?
Whenever I have to take a node offline, what are the precautions I have to take? (I may need to take the VM offline for security patching or tuning underlying OS for my project.)
Is giving non-master node lesser hardware OK? My primary need is ingestion and assimilation not multiple queries per seconds or minute. I will be lone user of the system and I will be querying large amount of data twice or thrice a week at maximum.