I'm researching the impossible questions for planning a cluster.
We need to keep some data for a year or more. If we do a hot/warm, the question is can we keep 10-20G or more on a warm node? Disk is cheap, nodes aren't.
This data would be daily log data, so would be "skipped" in almost all searches. I'm afraid the heap size is the limiting factor. These indices would be forecemerged and set to read-only before migrating to warm nodes.
I think if we close indices, we could use a lot more storage, but then we would have to handle requests to open them for searching. Murphy's law says they would want them all open at once anyway.
Any thoughts?