How can I stop cluster from filling my cold nodes with hot data?

title really says it all.

I just added two cold nodes to my cluster -- these have slow disks and I don't want active indexes on them but I find that ES is treating them the same as the other nodes.

both nodes have node.attr.node_type: cold in their configuration

Are your hot nodes labeled as hot? Do your index templates apply the correct settings to force newly created indices to the hot nodes? Are you using ILM to manage index transitions and movement?

nodes are labeled as hot, warm or cold

some index use ILM others don't (yet).

I was waiting to get the cold nodes provisioned before bringing all the indexes into ILM (there are hundreds of daily indexes that need to be consolidated (by reindexing into an index that is under ILM) and moved to cold (frozen) storage.

I am trying to migrate an existing system that is several years on and set up before xpack was "free"

Oops I have just discovered that all searching is timing out on ES so I have stopped the cold nodes.

So should I make sure that all indexes are under ILM before enabling the cold nodes?

BTW can I roll directly from hot to cold by not enabling warm?