How to divide new index shard in all nodes

[DJ_Zhu]

Thanks for your read first.

I use Elasticsearch to store app logs which contains about 100 TB data in a single cluster. The data is store in a new index per 4 hours and old index will be deleted after 7 days. Since the data is quit huge, so it is very slow and no necessary to move data between nodes.

However it seems no way to add new node to the cluster without moving exist shards. Let's say we have a cluster contains three node(N1,N2,N3). All the three nodes has already store 7(day)*6(shard)=42 shards each.

If I add a new node(N4) into the cluster with "cluster.routing.allocation.enable": "new_primaries" setting and increase the shard number of new index from 3 to 4. Then it will cause all the shards of new index to be allocated to N4 which make it very high load in N4.

If I add a new node(N4) into the cluster with "cluster.routing.allocation.enable": "all" setting, then all exist shards will be reallocated over all node. It is very slow and make the cluster high load (both cpu and io).

Here is my question: is there any way to add a new node without any shard reallocation and all 4 shards of new index to be divided into 4 nodes in my cluster?

[sholzhauer]

Theoretically yes.

You could use additional attributes like a category on your nodes.
So you would add the category node4 to your new node. Update your exising indices with the exclude.category: node4 setting and then add the new node.