# Sane design thougts? **URL:** \ **Category:** Elasticsearch\ **Tags:** ilm-index-lifecycle-management\ **Created:** [January 19, 2021, 7:42am UTC](https://discuss.elastic.co/t/sane-design-thougts/261502 "2021-01-19T07:42:51Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Andreas\_Falk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andreas_falk/32/82595_2.png) [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Post date:** [January 19, 2021, 7:42am UTC](https://discuss.elastic.co/t/sane-design-thougts/261502/1 "2021-01-19T07:42:51Z")
Hi, This is a x-post from Slack, but I think that it is perhaps easier to have a discussion here. 🙂 We are setting up a new logcluster that should handle .. logs.. 🙂 from our infrastructure mostly. The usual suspects filebeat, winlogbeat, auditbeat etc. Our design after some testing in docker landed on this. But after a brief discussion in Slack I was recommended not to use "Master" role on the Ingest nodes (internal client facing). Is this design sane, for a 14 days of hot storage and then a few months of Cold storage for "archive"? Thoughts, pro/cons? ![scrot_20210119-084524](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1aec940b0210bf785ad7489baabd53054418488e.png) ---
**Author:** ![Andreas\_Falk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andreas_falk/32/82595_2.png) [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Post date:** [January 19, 2021, 11:50am UTC](https://discuss.elastic.co/t/sane-design-thougts/261502/2 "2021-01-19T11:50:28Z")
After some discussions in Slack this is the latest bid 🙂 ![2](https://us1.discourse-cdn.com/elastic/original/3X/9/3/930982c3e025ac1e405ed57a8523a6df4f3bace1.png) Removed one ingest node And moved out the Master nodes to dedicated servers. -- Regards Falk ---
**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Post date:** [January 19, 2021, 1:53pm UTC](https://discuss.elastic.co/t/sane-design-thougts/261502/3 "2021-01-19T13:53:20Z")
Looking at this, a question I would have is for your ingest does that include, Elasticsearch ingest role nodes? If it does, one thing you'll need to considered is I don't believe Elasticsearch allows for layer 3 clustering, so the subnet for all servers, must be the same (I bring this up as I'm assuming mgmt-pub and mgmt-sec are different subnets). Elasticsearch Ingest nodes are becoming increasingly important with filebeat modules. ---
**Author:** ![Andreas\_Falk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andreas_falk/32/82595_2.png) [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Post date:** [January 20, 2021, 7:21am UTC](https://discuss.elastic.co/t/sane-design-thougts/261502/4 "2021-01-20T07:21:28Z")
Hi, > [@BenB196](#): > > Looking at this, a question I would have is for your ingest does that include, Elasticsearch ingest role nodes? Yes, atleast that is what we had in mind. > [@BenB196](#): > > one thing you'll need to considered is I don't believe Elasticsearch allows for layer 3 clustering, so the subnet for all servers, must be the same Oh, I haven't seen that before. I thought that the cluster "talked" unicast with the other cluster nodes? Do you have a link to the docs with this info, so I can read up about it? -- Regards Falk ---
**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Post date:** [January 20, 2021, 12:41pm UTC](https://discuss.elastic.co/t/sane-design-thougts/261502/5 "2021-01-20T12:41:56Z")
After looking a bit deeper, it appears that you're correct, in that if you're using unicast discovery, then you can span multiple subnets. What I was thinking of was multi-region which is not recommended, but also not your use case. So it doesn't apply. One last thing then, I think you'll need port 9300/tcp open between mgmt-pub and mgmt-sec so that the Elasticsearch ingest role nodes can properly talk to the rest of the ES nodes. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 17, 2021, 12:42pm UTC](https://discuss.elastic.co/t/sane-design-thougts/261502/6 "2021-02-17T12:42:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.