Help Please ...Hi Teams, we have a 4 nodes cluster, 3 dimr and one lrt role nodes , we have set the output of fleet server to the one with lrt role, is it recommended to set the output to all data nodes or is there no problem going with one node (lrt one in my case)?
I would say that it is best to send the requests to your data nodes since you do not have any dedication ingest nodes.
In your case the node with the lrt roles is redirecting the requests to your dimr nodes so they can process the events.
Also, which such a small cluster not sure that a dedicated machine learning/transform node is required.
When I talked with people who set it up, their reason was for selecting node with lrt role was load balancing ....does that make sense ?
It does not make much sense, you can configure multiple hosts in the Fleet server output and the Agents will load balance between them natively.
Also, the Elastic Agent integrations uses Ingest pipelines to parse the data, those ingest pipelines will run on nodes that have the ingest role, which in your case are also your data and master nodes.
I see no reason for this lrt node to exist in your cluster, you could just add the transform (t) and machine learning (l) roles to your main nodes and remove it entirely.
Also, do you have a paid license? If not, then there is not much use for the machine learning role as most of the machine learning features are paid.
Ok I got your point, one more thing , should we have a dedicated ingest node or is it fine to give the ingest role to the nodes with master and data roles...
I don't think you should have any dedicated type of node unless necessary.
Dedicated ingest nodes are recommended when you have heavy ingest loads.
Got it, thanks for the response 