We've got a ELK cluster running ES 5.0 for logs indexing, collecting them from Kafka using Logstash. Each node has 1TB in SSDs and 2TB in HDDs. At the moment, we're only using SSD volumes with Elasticsearch.
However, we only need a certain amount of data being stored on SSDs as hot data, then we would like to move it to HDDs. So classically, retiring cold data to a slower storage.
I found tips on how to make it, however I wanted to find out if there are good practices of achieving it, or if there is something recommended?
Any help appreciated!