Installed and configured ElasticSearch (Multi Node) Cluster on CentOS

Elastic Stack Elasticsearch
22

Is that possible to see both data in single search of kibana dashboard.

Again: Yes, that's how ES and Kibana work out of the box. If the cluster is in good shape this will just work. Which node stores which logs does not matter.

Make sure your index pattern in Kibana covers the indexes in both nodes. For example, if your index name pattern is "logstash-*" you'll be fine if all of your indexes match that pattern but if renamed your indexes at some point so that e.g. the old indexes are called logs-2015.11.04 or whatever things won't work until you adjust your index template to cover all indexes.

But I still don't understand your problem, or indeed if you even have a problem.

23

Is there a possibility to stop replication between two nodes in same cluster without removing them from cluster.?

24

The answer depends on why you're asking that question. What problem are you trying to solve, and what, exactly, do you mean with "replication"? I don't think that's a well-defined term in Elasticsearch.

25

I mean to say "stop replication" that has been commented below line in Node2 in elasticsearch.yml file,

cluster.name: ELKTEST
node.name: "node2"
network.host: 192.168.44.130

#transport.tcp.port: 9300
#discovery.zen.ping.unicast.hosts: ["192.168.44.130", "192.168.44.129:9300"]

If i do this above changes both the Node1 and Node2 communication has been stopped.

Now i see the cluster health shows yellow it has only one Node1

{
"cluster_name" : "ELKTEST",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 41,
"active_shards" : 41,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 41
}

So this my scenario of my current setup with both nodes.

Node1 has New logs (Replica/Communication Stopped between Nodes and imported New logs in Node1)
Node2 has Old logs

Is that possible to see both data in single search of kibana dashboard using the above configuration.

26

Sorry, this discussion is just going in circles. As I've said, the behavior you want is the default behavior that one gets with Elasticsearch and Kibana, so you've either managed to screw things up (but nothing points in that direction) or you're somehow not understanding what your actual situation is and therefore thinking you have a problem when there is none. Over and out.