I setting up a new 5 host 7.x cluster to deal with audit and logging and such. Data should come to roughly 10T.
How terrible an idea would it be to make every host an eligible master node (and data and ingest)? I can always bring up 3 VMs to be master nodes but I'm wondering if this is really necc.
On the other hand - for 5 nodes could I get away with a single master node (on a VM)? What are the risks?