# Optimizing Elasticsearch Cluster Setup: Merging Logs Across Two Node

**URL:** https://discuss.elastic.co/t/optimizing-elasticsearch-cluster-setup-merging-logs-across-two-node/344371
**Category:** Logstash
**Created:** [October 4, 2023, 9:57am UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-cluster-setup-merging-logs-across-two-node/344371 "2023-10-04T09:57:08Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Priyaansh\_Dwivedi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priyaansh_dwivedi/32/121317_2.png) [@Priyaansh\_Dwivedi](https://discuss.elastic.co/u/Priyaansh_Dwivedi)
#### Post date: [October 4, 2023, 9:57am UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-cluster-setup-merging-logs-across-two-node/344371/1 "2023-10-04T09:57:08Z")

</div>

"I have always valued the support of this community, and I find myself in need of assistance once again. Here's the situation: I currently have Elasticsearch installed on VM1, but I'm facing disk space issues, and the cluster status is yellow. To resolve this, I've created another VM, VM2, on the same host with the intention of setting up an Elasticsearch cluster across both VMs with two nodes.

I'm collecting three different logs, let's call them A.log, B.log, and C.log. Each of these logs has its own logstash.conf file for extracting important features and creating their respective indices in Elasticsearch. Additionally, I have a separate logstash configuration file, merge.log, which combines and maps data from all three indices (A, B, and C) based on a common attribute. I used to run this merge.conf file via crontab at a scheduled time to create an index pattern that includes attributes from all three logs.

Now, with a two-node cluster in place, I'm encountering difficulties running the merge.conf file effectively. Moreover, Kibana is also giving error  
`Validation Failed: 1: [ccs_minimize_roundtrips] is not supported on async search queries;`  
I have two specific questions:

```
Is this the correct approach for my setup?
Do I need to run the merge.conf file on both nodes or will it work with just one?"

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 1, 2023, 9:57am UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-cluster-setup-merging-logs-across-two-node/344371/2 "2023-11-01T09:57:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.