Features of a cold node/warm node

Elastic Stack Elasticsearch
1

Hi,

I'm looking for some confirmation regarding warm nodes and cold nodes. I can't find any pointers on if nodes I've defined as cold nodes and warm nodes should also be ingest nodes. I'm guessing they shouldn't to prevent new indexes being assigned to them. That said, they are ingesting in the sense that you are directing indexes to those cold and warm nodes so that makes me think they should be.

This is what I think the warm and cold nodes should be configured with:

node.master: false
node.data: true
node.ingest: false

Can anyone confirm one way or the other?

Thanks.

2

That sounds correct.

3

Thanks for the quick reply Christian. Just to confirm that I'm also correct regarding the seed.hosts option, can you confirm that the warm and cold nodes still need the discovery.seed_hosts: option and an array of all the nodes in the cluster?

Equally, I'm assuming that cluster.initial_master_nodes: ["node-1", "node-2"] isn't required on the warm and cold nodes? Do the warm and cold nodes needs to know the nodes that can act as masters or is it not required?

Thanks again for your help.

4

So I've tried this solution this morning. Indexes are still being ingested by the cold node from winlogbeat. My config looks like this running on docker - (the node.master=false: is commented out as I can't get the cluster to come up at all without this setting being removed):

services:
  elasticsearch_cold:
    image: elasticsearch:7.4.0
    volumes:
      - /temp:/usr/share/elasticsearch/data
    container_name: elasticsearch_cold
    restart: unless-stopped
    environment:
      - cluster.name=Elastic-Stack
      - node.name=Elastic-Node-Cold
      - "cluster.routing.allocation.disk.watermark.low=97%"
      - "cluster.routing.allocation.disk.watermark.high=98%"
      - "cluster.routing.allocation.disk.watermark.flood_stage=99%"
      - "ES_JAVA_OPTS=-Xms2g -Xmx2g"
      - node.attr.data=cold
#      - node.master=false
      - node.data=true
      - node.ingest=false
      - network.publish_host=192.168.100.3
      - http.port=9200
      - transport.port=9300
      - bootstrap.memory_lock=true
      - discovery.seed_hosts=host1.domain.com:9300,host2.domain.com:9300,host3.domain.com:9300
      - cluster.initial_master_nodes=Elastic-Node_Hot
#      - cluster.initial_master_nodes=Elastic_Node_Hot,Elastic-Node-Warm,Elastic-Node-Cold

New indexes are being allowcated directly to this cold node even though ingest is set to false. I don't understand why....