# IP Optimized Instance for master node?

**URL:** <https://discuss.elastic.co/t/ip-optimized-instance-for-master-node/27859>\
**Category:** Elasticsearch\
**Created:** [August 21, 2015, 8:24pm UTC](https://discuss.elastic.co/t/ip-optimized-instance-for-master-node/27859 "2015-08-21T20:24:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pulkitg](https://avatars.discourse-cdn.com/v4/letter/p/94ad74/32.png) [@pulkitg](https://discuss.elastic.co/u/pulkitg)\
**Post date:** [August 21, 2015, 8:24pm UTC](https://discuss.elastic.co/t/ip-optimized-instance-for-master-node/27859/1 "2015-08-21T20:24:27Z")

</div>

Our cluster setup is going to have ~8-10 data nodes (r3,x2 memory optimized EC2 instances), each having ~2000 shards (per data node) and ~50,000 filtered aliases. What is the recommended configuration for master nodes?

Since we are going to have large # of of shards per data nodes and having lot of filtered aliases, does it makes sense to use IO optimized master nodes in EC2?

In addition, are there any issues with using this much filtered aliases in a cluster?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 22, 2015, 8:31am UTC](https://discuss.elastic.co/t/ip-optimized-instance-for-master-node/27859/2 "2015-08-22T08:31:11Z")

</div>

> [@pulkitg](#):
>
> Since we are going to have large # of of shards per data nodes

My first question is why so many shards? Chances are you will run into problems with this before any potential master sizing ones.

---

<div class="post-metadata">

**Author:** ![pulkitg](https://avatars.discourse-cdn.com/v4/letter/p/94ad74/32.png) [@pulkitg](https://discuss.elastic.co/u/pulkitg)\
**Post date:** [August 22, 2015, 5:29pm UTC](https://discuss.elastic.co/t/ip-optimized-instance-for-master-node/27859/3 "2015-08-22T17:29:08Z")

</div>

Our use-cases are such that we can't combine data from different sources in an indexed if the data source is generating significant amount of data. If we combine them, we bear the risk of making individual shards very large.

For sources which are generating very less amount of data, we are combining them into one index and using filtered alias concept.

Based on above, we are expecting to have ~2000 shards and ~50000 filtered aliases.

What's the recommendation of master node configuration in such cases? OR what potential load master node is going to bear with this?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 22, 2015, 11:51pm UTC](https://discuss.elastic.co/t/ip-optimized-instance-for-master-node/27859/4 "2015-08-22T23:51:46Z")

</div>

> [@pulkitg](#):
>
> we bear the risk of making individual shards very large.

How big?

---

<div class="post-metadata">

**Author:** ![pulkitg](https://avatars.discourse-cdn.com/v4/letter/p/94ad74/32.png) [@pulkitg](https://discuss.elastic.co/u/pulkitg)\
**Post date:** [August 24, 2015, 5:23pm UTC](https://discuss.elastic.co/t/ip-optimized-instance-for-master-node/27859/5 "2015-08-24T17:23:53Z")

</div>

~100GB and still growing. However, if we combine more sources into a single index/shards, we will need to have more filtered aliases. That's the reason why we are thinking about a combination of #shards and #filtered aliases.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:54pm UTC](https://discuss.elastic.co/t/ip-optimized-instance-for-master-node/27859/6 "2017-07-05T23:54:08Z")

</div>

Closed on July 5, 2017, 11:54pm UTC


