We have 2 data nodes but we want to use first node-2 until the storage is full then send the data to node-3. Is there anyway to address the way we want to send data to elasticsearch? Thank you.
No. That's not how elasticsearch works.
Why do you want to do this?
We just want to use all the disk space in our node-2 first before we use the node-3. But if it's not possible we will just use the 2 nodes.
The question is not what you want to do but why you want to do that? What is the use case or the technical reason?
What problem do you want to solve?
If we use it without any modifications, the data is distributed to both nodes. Once node-3 is down, some of the data will be missing from our monitoring. What we want is to use only 1 node first before we consume the other node.
I'm afraid I don't understand. What's the problem with node3?
There's nothing wrong with node-3. We are just thinking is when node-3 goes down all the data from node-3 will be missing hence our kibana monitoring will have missing data also.
Why would that happen? By default, every shard is replicated in the cluster. So if node 3 dies, another node will have the data anyway.
We didn't enable our replicate shards since our resources is only limited.
So you want a "safe" cluster but without any safe option like replication?
I'm afraid this is not going to work.
Coming back to your initial question, you can force allocate the shards based on tags that you'd put on your nodes. See https://www.elastic.co/guide/en/elasticsearch/reference/current/shard-allocation-filtering.html
All that will be manual of course.
We will apply our replicate shards once we have the proper resources. Thank you for your help 
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.