Elasticsearch Node Segregation

Elastic Stack Elasticsearch
1

Hi Team,

I am planning to have one more node to my Elasticsearch cluster, but only for a specific use case. I need that node to be used only for ingesting logs from our Cisco ASA using filebeat. How can i restrict this node. Can i use index level shard allocation filtering with a custom node attribute so that only indexes related to Cisco ASA is created in this specific node.

Please help.

Thanks
Ajesh

2

Yes you can use shard allocation filtering for this.

3

Thank you David. One more query , As soon as i add this node to cluster, will the other indices (winlogbeat-, auditbeat- etc) will be moved to this new node as a part of cluster node re balancing. Currently i can see all the indices are equally distributed across all the nodes.

i do have an explicit config below for other indices to keep the data in hot nodes only

"routing": {
  "allocation": {
    "require": {
      "data": "hot"
    }
  }
},
4

This won't affect other indices until you change the allocation settings for those indices as well and exclude the hot nodes.

5

Thanks David

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.