Very happy to supply info but I am not quite sure what you want.
If I were to get all (or at least) most of the indexes under ILM -- which is the aim anyway, would that help.
There are currently a lot of small (< 50MB), old daily indexes that I plan to reindex into ILM and consolidate into chunks of order of 1GB.
I also use moloch -- now called Arkime (full packet capture) which has very large indexes with high write rates and some shards got moved onto the slow disks and killed the cluster. I thought I had these indexes under ILM and am now waiting on the "vendor" if he was talking about ES's ILM or something else that he was doing from the API. I strongly suspect the latter.
Reduced to its essentials my question is this: Can I stop particular indexes that are not under ILM from being allocated onto my warm and cold nodes?
Having just formulated the question and then searched I find shard-allocation-filtering which appears to do exactly what I need. Am I correct in thinking that putting
node.roles: ["data_cold"] in my cold nodes (without
"data_content") will do what I need?
And as I said, I am happy to give details, I just need to know which!