I currently use a 3 node ES-cluster for store my Web servers' logs.
3 Master/Data node with same config.
I added a tag to the third node that got more disk than the two other.
Filebeat indexes are created each day, with 1 shards and 1 replicas. (so stored on two nodes).
Currently, I use curator to close indexes (more than 1 week).
My goal :
- Use the two node (without tag) to store "living" indexes (open)
- Use the third node (tagged as "big") to store all closed indexes.
I can't figure out how to do that using curator for example.
I tried to use "allocation" to move my shard to the taggued node, it work but my closed index continu to take storage of the node where it was allocated ( I see it in looking on /var/lib/elasticsearch files)...
Any idea how to completly move my closed index to the taggued node without keeping storage on the other ?
Thanks a lot !!