In my deployment I have a cluster with two machines with an Elasticsearch installation. I have created one node on every machine so, at the end I have one cluster with two nodes and 10 shards (5 primary and 1 replicas).
I have some doubts related to synchronization after failover. Let me explain:
If one of my elasticsearch machine (e.g Machine1) goes down, I will not have any problem on data recollecting because there is another machine indexing logs (in this case, Machine2). But when Machine1 is up again, there some logs that are contained into Machine2 that are not contained into Machine1.
Is there a way to synchronize data between nodes? I need to store the same information on each node.
Another question regarding nodes,
Can I deploy three nodes in two machines? do you recommend it?
My last question is related to logstash output.
I have configured logstash to send logs to Machine1 (only), and Machine1 replicates data to Machine2...do you suggest to configure logstash to send logs to both machines?
Thanks for all and have a good day!