We would like to know about to store the data from Hot node instead of warm node.
Normally the process was stored the data from hot node and warm node depends on ILM policies by 7days of retention period.
Here we have to move the data on hot node without warm node, as per long the data could be store on hot node without rollover the index and then move to delete phase. Could you please let us know what could be the risk and impact if we changing the ILM policy condition on hot node.
Generally, HWC architecture design solely depends on your use case, you just need to ensure the underlying host machines are large enough for your requirements.
You can definitely change the ILM policies to delete the indexes right after exiting hot phase (disabled warm and cold phases), but in this case your hot nodes should have enough computational power to hold all the data for stipulated time period.
By design, hot nodes generally keep those indices which are either being written on or are heavily used for searching. The warm nodes keep indices which are less likely to used for searching. Cold nodes generally store frozen indices which are not searched on anymore but shouldn't be deleted either (for retention policies essentially).
Apart from resource constraints, there is no other impact. But do understand that your logs won't be available once hot phase has expired OR in other words, your index moves to next phase which is deletion.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.