# Reboot Hot nodes machine on elasticsearch cluster

**URL:** <https://discuss.elastic.co/t/reboot-hot-nodes-machine-on-elasticsearch-cluster/241481>\
**Category:** Elasticsearch\
**Created:** [July 16, 2020, 2:22pm UTC](https://discuss.elastic.co/t/reboot-hot-nodes-machine-on-elasticsearch-cluster/241481 "2020-07-16T14:22:59Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![maadhav](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maadhav/32/46127_2.png) [@maadhav](https://discuss.elastic.co/u/maadhav)\
**Post date:** [July 16, 2020, 2:23pm UTC](https://discuss.elastic.co/t/reboot-hot-nodes-machine-on-elasticsearch-cluster/241481/1 "2020-07-16T14:23:00Z")

</div>

Hello Team

We have docker based ELK setup with 17 nodes among which 4 nodes are hot nodes. Docker containers for all 4 hot nodes are on the same machine. The machine also contains one hyper node and one kibana docker container.

Due to some issues, we need to reboot the machine. So what are the things to take care to reboot the machine. As all 4 hot nodes are on the same machine, no hot nodes will be available during reboot. Will there be any effect of this on shard allocation ?

Please suggest the correct approach. Any help is appreciated.

Regards

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 21, 2020, 12:31am UTC](https://discuss.elastic.co/t/reboot-hot-nodes-machine-on-elasticsearch-cluster/241481/2 "2020-07-21T00:31:15Z")

</div>

That will likely cause issues, as you will be restarting all your nodes that are doing the ingestion of data, and then having to recover all of the indices and shards that they host.

If you have to restart all 4 of them, then the best option will be to disable allocation and any ingestion, then restart, wait for things to return to green, then restart ingestion.

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [July 21, 2020, 1:30am UTC](https://discuss.elastic.co/t/reboot-hot-nodes-machine-on-elasticsearch-cluster/241481/3 "2020-07-21T01:30:35Z")

</div>

In addition to the prior reply, if your senders buffer data, like filebeat or logstash with persistent queues, if your buffers are large enough to hold the data during the reboot (and cluster recovery), you shouldn't miss events.

Things like syslog without a queuing buffer will probably miss events.

---

<div class="post-metadata">

**Author:** ![maadhav](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maadhav/32/46127_2.png) [@maadhav](https://discuss.elastic.co/u/maadhav)\
**Post date:** [July 21, 2020, 2:54pm UTC](https://discuss.elastic.co/t/reboot-hot-nodes-machine-on-elasticsearch-cluster/241481/4 "2020-07-21T14:54:33Z")

</div>

Thanks @warkolm and @rugenl for suggestions. Fortunately we need not to restart the machine.

Just a thought, to avoid such scenario, would it be a good idea to keep different hot nodes on different machines within a cluster ?

Regards

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 21, 2020, 11:24pm UTC](https://discuss.elastic.co/t/reboot-hot-nodes-machine-on-elasticsearch-cluster/241481/5 "2020-07-21T23:24:04Z")

</div>

Definitely.

---

<div class="post-metadata">

**Author:** ![maadhav](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maadhav/32/46127_2.png) [@maadhav](https://discuss.elastic.co/u/maadhav)\
**Post date:** [July 22, 2020, 5:13am UTC](https://discuss.elastic.co/t/reboot-hot-nodes-machine-on-elasticsearch-cluster/241481/6 "2020-07-22T05:13:27Z")

</div>

Thanks @warkolm.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 19, 2020, 5:13am UTC](https://discuss.elastic.co/t/reboot-hot-nodes-machine-on-elasticsearch-cluster/241481/7 "2020-08-19T05:13:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.