Need to more about store the logs on Hot node instead of warm node

[anushyaadam (Anushya)]

Hello Team,

We would like to know about to store the data from Hot node instead of warm node.
Normally the process was stored the data from hot node and warm node depends on ILM policies by 7days of retention period.

Here we have to move the data on hot node without warm node, as per long the data could be store on hot node without rollover the index and then move to delete phase. Could you please let us know what could be the risk and impact if we changing the ILM policy condition on hot node.

Regards
Anushya

[Ayush_Mathur]

Generally, HWC architecture design solely depends on your use case, you just need to ensure the underlying host machines are large enough for your requirements.

You can definitely change the ILM policies to delete the indexes right after exiting hot phase (disabled warm and cold phases), but in this case your hot nodes should have enough computational power to hold all the data for stipulated time period.

By design, hot nodes generally keep those indices which are either being written on or are heavily used for searching. The warm nodes keep indices which are less likely to used for searching. Cold nodes generally store frozen indices which are not searched on anymore but shouldn't be deleted either (for retention policies essentially).

[anushyaadam (Anushya)]

Hi Ayush,

Thanks for the response.

We are getting your points and other than that, is there any impact due to happen this, after we stored the data only on Hot node for 7 Days.

We need to showcase to the client, if any documents is there would be preferable to shown to them, please

Regards,
Anushya

[Ayush_Mathur]

Apart from resource constraints, there is no other impact. But do understand that your logs won't be available once hot phase has expired OR in other words, your index moves to next phase which is deletion.