# How to split data into spaces
**URL:** https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229
**Category:** Kibana
**Created:** [April 18, 2023, 2:42pm UTC](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229 "2023-04-18T14:42:20Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 18, 2023, 2:42pm UTC](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229/1 "2023-04-18T14:42:20Z")
Hello, let's imagine that I have a cluster with 5 nodes and each node is a client, I want these 5 to divide the data from these clients into spaces, I would also like to install packebeat and filebeat on each node and send the data of these beats to the client's index and then load that data into the client's space. I also wanted to load the alerts from the security tab and based on the information in each index I wanted there to be alerts.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 18, 2023, 2:49pm UTC](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229/2 "2023-04-18T14:49:01Z")
I think that the question about alerts is already answered in your [previous post](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/20) with the same name.
This question seems to be what architecture you should use, I suggest that you edit the name of your topic to reflect this and so this question is not seen as a duplicate of your other question.
---
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 18, 2023, 2:50pm UTC](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229/3 "2023-04-18T14:50:06Z")
Yes that's what I want to know. What would be the best architecture.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 18, 2023, 3:03pm UTC](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229/4 "2023-04-18T15:03:06Z")
> [@Joelgoncalves3000](#):
>
> Hello, let's imagine that I have a cluster with 5 nodes and each node is a client
First thing is, to have a resilient cluster you need 3 master nodes, and it is recommended to have dedicated master nodes, so with 5 nodes you would have 3 master nodes and 2 data nodes.
Second, if you want to have a data node per tenant (which you called client here), you will have a lot of work to do, you will need to heavily use the [shard allocation awereness](https://www.elastic.co/guide/en/elasticsearch/reference/8.6/modules-cluster.html#shard-allocation-awareness), basically you will create a custom attribute, for example `tenant`, and each data node will have a different value for this attribute, then you will need to configure this in every index template for every tenant.
Depending on the number of clients this can become a nightmare to manage.
Also, where the node will be located? On your infrastructure on your client (tenant) infrastructure?
> [@Joelgoncalves3000](#):
>
> I would also like to install packebeat and filebeat on each node and send the data of these beats to the client's index and then load that data into the client's space
To do this you would need to follow [this documentation](https://www.elastic.co/guide/en/beats/filebeat/current/change-index-name.html) on how to create a custom name for each index.
> [@Joelgoncalves3000](#):
>
> I also wanted to load the alerts from the security tab and based on the information in each index I wanted there to be alerts.
This was already answered in your previous post.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 18, 2023, 10:31pm UTC](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229/5 "2023-04-18T22:31:52Z")
When you say client, do you mean Elasticsearch one or a business client (ie one of your customers)?
---
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 19, 2023, 8:49am UTC](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229/6 "2023-04-19T08:49:54Z")
I want all customer information to be located on the client infrastructure. Also is there any documentation about how to configure the index template with the attribute ?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 19, 2023, 12:52pm UTC](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229/7 "2023-04-19T12:52:36Z")
> [@Joelgoncalves3000](#):
>
> I want all customer information to be located on the client infrastructure.
This is not recommended, you would have a Elasticsearch cluster with nodes in different physical locations, an issue on a node of your customer could impact your entire cluster and all your other customers.
Also, how would you connect the nodes on different physical infrastructure? Would you create a VPN between your infrastructure and each one of your clients? Would you expose your cluster on the internet? There are so many issues with this infrastructure.
---
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 19, 2023, 2:04pm UTC](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229/8 "2023-04-19T14:04:52Z")
I'm yet to see these issues. My focus now is to filter the data. My focus now is to monitor different nodes and send the information to separate indexes and then analyze these indexes.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 19, 2023, 5:12pm UTC](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229/9 "2023-04-19T17:12:32Z")
> [@Joelgoncalves3000](#):
>
> I'm yet to see these issues. My focus now is to filter the data. My focus now is to monitor different nodes and send the information to separate indexes and then analyze these indexes.
Did you check the documentation and changed your configuration?
First you will need to add a custom attribute to every data node and restart the node, as explained in the [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/8.6/modules-cluster.html#shard-allocation-awareness).
For example, you will need to add something like this:
```auto
node.attr.customer_name: customerName
```
Then you will need something like this in the `elasticsearch.yml` of every _master-eligible_ node:
```auto
cluster.routing.allocation.awareness.attributes: customer_name
```
Then you will need to create a template to add the routing settings in every index for every customer, to create a template you need to check this [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-templates.html).
A simple template would be like this:
```auto
{
"index_patterns" : ["customername-*"],
"priority": 1,
"version": 1,
"template": {
"settings" : {
"index" : {
"routing" : {
"allocation" : {
"require" : {
"customer_name" : "customerName"
}
}
}
}
}
}
}
```
This will add the setting `index.routing.allocation.require.customer_name` with the value `customerName` in every indice that matches the index pattern `customername-*`, so you would need to configure your filebeat and packet beat to write to `customername-filebeat-*` and then it will be written in this data node.
---
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 19, 2023, 5:15pm UTC](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229/10 "2023-04-19T17:15:50Z")
With these settings I would store all beat data in that index right? How would I then receive alerts depending on the index data?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 17, 2023, 5:15pm UTC](https://discuss.elastic.co/t/how-to-split-data-into-spaces/330229/11 "2023-05-17T17:15:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.