Master Vs Data Node selection

Elastic Stack Elasticsearch
1

I have an oracle 11g instance which roughly has around 5TB of data on it.
I plan to use the ELK stack .. use logstash to pump data onto elasticsearch and then use my java application to connect to the elasticsearch and display search results.
The data onto elasticsearch will be a one-off historical load from oracle to elastic.
This data in elastic will just be used for search purposes.

Query -

  1. Would it be okay to have a single node which acts as a master & data node ?
    I understand the resiliency and single point of fail over comes up with one node but then what is the minimum I should go with.
    3 masters and 1-2 data nodes ?

  2. Would a warm data node suffice for this as the data once in elastic won't change.

Note - The deployment of the elk stack is going to be on-premise.
Any recommendations for the no of CPU & RAM would also help.

2

Welcome to our community! :smiley:

I would just for for 3 nodes that are data and master eligible.

3

According to the Designing for resilience docs:

A two-node cluster with an additional tiebreaker node is the smallest possible cluster that is suitable for production deployments.

4

I need a basic cluster with data being ingested only once.
To ensure that there is no impact due to node failures, I guess going ahead with 3 data & master eligible nodes in 1 cluster should be okay.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.