My opinion:
Single node adv:
- simple for configuration and maintenance
- easy to monitor
- less storage, no replica
- cheap
- internal authentication
- excellent for indices 1-50 GB, or a storage in total to 1 TB, good for test environments, big small data
Disadvantages:
- no replica
- no fail tolerance
- no ILM
- no data roles
- ingestion node shouldn't be avoided, it's better to use Logstash on a separated host
- avoid complex queries/dashboards