# Recommended approach to detach a data node

**URL:** <https://discuss.elastic.co/t/recommended-approach-to-detach-a-data-node/236035>\
**Category:** Elastic Stack\
**Created:** [June 6, 2020, 12:05pm UTC](https://discuss.elastic.co/t/recommended-approach-to-detach-a-data-node/236035 "2020-06-06T12:05:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![parthmaniar](https://avatars.discourse-cdn.com/v4/letter/p/71e660/32.png) [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\
**Post date:** [June 6, 2020, 12:05pm UTC](https://discuss.elastic.co/t/recommended-approach-to-detach-a-data-node/236035/1 "2020-06-06T12:05:43Z")

</div>

My ELK deployment is in a distributed format.

1. An always on VM on a NAS that is ingesting data via elasticsearch.
2. A Raspberry Pi running logstash with 5 pipelines.
3. 9 log sources sending data to the 5 pipelines.
4. A laptop which has Kibana and Elasticsearch. On this laptop I have secondary node of elastic which I need for me college as I cannot always VPN into to show my teacher my research. More details are here and the diagram is as below (except that now logstash is on RPi)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/4/944157d9eeb56e24600862df6f9152ebd58b0ad1.png)

I wanted to know the recommended approach to detach and remove the mobile datanode (on my laptop.) As of now I put following commands before detaching, do I need to do something else?

Secondly, what configuration is needed to make the laptop as primary node for compute whenever I am using Kibana?

```
Shutdown process

```

```auto
    https://IP OF PRIMARY ELASTICSEARCH NODE:9200/_cluster/settings
    {
      "transient" : {
        "cluster.routing.allocation.exclude._ip" : "IP of LAPTOP NODE"
      }
    }

```

and

```auto
    PUT: https://P OF PRIMARY ELASTICSEARCH NODE:9200/_cluster/settings
  {
  "persistent": {
    "cluster.routing.allocation.enable": "none"
  }

```

I still get following error right after I detach the mobile data node when querying for health of the cluster:

```auto
{
    "error": {
        "root_cause": [
            {
                "type": "master_not_discovered_exception",
                "reason": null
            }
        ],
        "type": "master_not_discovered_exception",
        "reason": null
    },
    "status": 503
}

```

Also, this is the final failure of the cluster before I have to restore the VM. I lose important logs as part of my final year studies due to this process. I cannot afford to restore the VM and lose logs.

```auto
{
    "error": {
        "root_cause": [
            {
                "type": "security_exception",
                "reason": "failed to authenticate user [elastic]",
                "header": {
                    "WWW-Authenticate": [
                        "Bearer realm=\"security\"",
                        "ApiKey",
                        "Basic realm=\"security\" charset=\"UTF-8\""
                    ]
                }
            }
        ],
        "type": "security_exception",
        "reason": "failed to authenticate user [elastic]",
        "header": {
            "WWW-Authenticate": [
                "Bearer realm=\"security\"",
                "ApiKey",
                "Basic realm=\"security\" charset=\"UTF-8\""
            ]
        }
    },
    "status": 401
}

```

Do I need to any other steps to make sure my indices do not fail when I restart the mobile elastic node?

Thank you.

---

<div class="post-metadata">

**Author:** ![magnalite](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnalite/32/69827_2.png) [@magnalite](https://discuss.elastic.co/u/magnalite)\
**Post date:** [June 6, 2020, 4:18pm UTC](https://discuss.elastic.co/t/recommended-approach-to-detach-a-data-node/236035/2 "2020-06-06T16:18:46Z")

</div>

If I understand correctly, this sounds like a good scenario to use a remote cluster / cross-cluster replication. [https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-remote-clusters.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-remote-clusters.html)

---

<div class="post-metadata">

**Author:** ![parthmaniar](https://avatars.discourse-cdn.com/v4/letter/p/71e660/32.png) [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\
**Post date:** [June 10, 2020, 11:45am UTC](https://discuss.elastic.co/t/recommended-approach-to-detach-a-data-node/236035/3 "2020-06-10T11:45:41Z")

</div>

I will test this and get back to you, thank you very much for your suggestion.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 8:01am UTC](https://discuss.elastic.co/t/recommended-approach-to-detach-a-data-node/236035/4 "2022-11-04T08:01:25Z")

</div>

Closed on November 4, 2022, 8:01am UTC