# Elasticsearch Node Segregation

**URL:** <https://discuss.elastic.co/t/elasticsearch-node-segregation/255537>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [November 16, 2020, 1:09pm UTC](https://discuss.elastic.co/t/elasticsearch-node-segregation/255537 "2020-11-16T13:09:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ajesh](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@ajesh](https://discuss.elastic.co/u/ajesh)\
**Post date:** [November 16, 2020, 1:09pm UTC](https://discuss.elastic.co/t/elasticsearch-node-segregation/255537/1 "2020-11-16T13:09:39Z")

</div>

Hi Team,

I am planning to have one more node to my Elasticsearch cluster, but only for a specific use case. I need that node to be used only for ingesting logs from our Cisco ASA using filebeat. How can i restrict this node. Can i use index level shard allocation filtering with a custom node attribute so that only indexes related to Cisco ASA is created in this specific node.

Please help.

Thanks  
Ajesh

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 16, 2020, 1:23pm UTC](https://discuss.elastic.co/t/elasticsearch-node-segregation/255537/2 "2020-11-16T13:23:02Z")

</div>

Yes you can use shard allocation filtering for this.

---

<div class="post-metadata">

**Author:** ![ajesh](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@ajesh](https://discuss.elastic.co/u/ajesh)\
**Post date:** [November 16, 2020, 2:15pm UTC](https://discuss.elastic.co/t/elasticsearch-node-segregation/255537/3 "2020-11-16T14:15:40Z")

</div>

Thank you David. One more query , As soon as i add this node to cluster, will the other indices (winlogbeat-_, auditbeat-_ etc) will be moved to this new node as a part of cluster node re balancing. Currently i can see all the indices are equally distributed across all the nodes.

i do have an explicit config below for other indices to keep the data in hot nodes only

```
"routing": {
  "allocation": {
    "require": {
      "data": "hot"
    }
  }
},
```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 16, 2020, 2:54pm UTC](https://discuss.elastic.co/t/elasticsearch-node-segregation/255537/4 "2020-11-16T14:54:57Z")

</div>

This won't affect other indices until you change the allocation settings for those indices as well and exclude the hot nodes.

---

<div class="post-metadata">

**Author:** ![ajesh](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@ajesh](https://discuss.elastic.co/u/ajesh)\
**Post date:** [November 16, 2020, 5:41pm UTC](https://discuss.elastic.co/t/elasticsearch-node-segregation/255537/5 "2020-11-16T17:41:39Z")

</div>

Thanks David

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2020, 5:41pm UTC](https://discuss.elastic.co/t/elasticsearch-node-segregation/255537/6 "2020-12-14T17:41:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.