I've been using the elastic stack for last one year to capture research data (mainly using honeypots hosted on cloud service providers.)
I'm using a three-node cluster to capture the data.
2 nodes are data nodes
1 node is a voting node (no data is stored on this node.)
All the nodes are virtual machines with separate disks (at the physical layer) for OS and the data directory. I'm running out of disk space, and I need to move the data to a separate disk. What is the most efficient and error-free way to make this transfer? Here is what I've decided:
- Stop elasticsearch on the node that is currently not voted as the master node.
- Wait for a few minutes to ensure all disk activity from elasticsearch service has finished.
- Mount the new virtual disk & change the data directory in the elasticsearch.yml folder.
- use the "mv" command to move the current data.
- Start elasticsearch service.
Repeat the process on the next node.
Is this method, OK? Are there more steps recommended, such as removing the node from allocation routing?
Thank you very much and a very happy & safe new year to you.