How to split data into spaces

Elastic Stack Kibana
9

Did you check the documentation and changed your configuration?

First you will need to add a custom attribute to every data node and restart the node, as explained in the documentation.

For example, you will need to add something like this:

node.attr.customer_name: customerName

Then you will need something like this in the elasticsearch.yml of every master-eligible node:

cluster.routing.allocation.awareness.attributes: customer_name

Then you will need to create a template to add the routing settings in every index for every customer, to create a template you need to check this documentation.

A simple template would be like this:

{
  "index_patterns" : [ "customername-*"],
  "priority": 1,
  "version": 1,
  "template": {
    "settings" : {
      "index" : {
        "routing" : {
          "allocation" : {
            "require" : {
              "customer_name" : "customerName"
            }
          }
        }
      }
    }
  }
}

This will add the setting index.routing.allocation.require.customer_name with the value customerName in every indice that matches the index pattern customername-*, so you would need to configure your filebeat and packet beat to write to customername-filebeat-* and then it will be written in this data node.