Specific node can not requsts from logstash

Elastic Stack Elasticsearch
1

elasticsearch config is like this:

[NODE-1]
cluster.name: cluster-name
node.name: node-1
node.master: true
node.data: true
network.host: NODEIP
discovery.zen.ping.unicast.hosts: [NODE1IP, NODE2IP, NODE3IP, NODE4IP]

[NODE-2]
cluster.name: cluster-name
node.name: node-2
node.master: true
node.data: true
network.host: NODEIP
discovery.zen.ping.unicast.hosts: [NODE1IP, NODE2IP, NODE3IP, NODE4IP]

[NODE-3]
cluster.name: cluster-name
node.name: node-3
node.master: true
node.data: true
network.host: NODEIP
discovery.zen.ping.unicast.hosts: [NODE1IP, NODE2IP, NODE3IP, NODE4IP]
[NODE-4]
cluster.name: cluster-name
node.name: node-4
node.master: false
node.data: false
network.host: NODEIP
discovery.zen.ping.unicast.hosts: [NODE1IP, NODE2IP, NODE3IP, NODE4IP]

and logstash output config is like this

elasticsearch {
hosts => [NODE1IP:9200, NODE2IP:9200, NODE3IP:9200, NODE4IP:9200]
index => "apache-access-%{+YYYY-MM-dd}"
document_type => "log"
}

and I can find discovered all nodes in elastic logs.

But NODE4 is any requested from logstash
( I confirm by threadpool API ( /_cat/thread_pool))

ip bulk.active bulk.queue bulk.rejected
NODE1 8 9 24416
NODE2 8 80 13819
NODE3 0 0 16838
NODE4 0 0 0

I don't know why help plz

2

You don't appear to have discovery.zen.ping.unicast.hosts for the last node?

3

Sorry It's just my typing miss.
I set discovery.zen.ping.unicast.hosts: [NODE1IP, NODE2IP, NODE3IP, NODE4IP]
on node4, too.

4

Can you curl ES from the LS node?

5

As NODE4 is a client node, it will distribute the work to the other nodes, where I assume it will be queued up.

6

Yes, I alreay have checked it. Thank you

7

Client node doesn't any indexing operation?

I can't understand which node(master, data, client) can accept indexing from LS? (I can't find any guide. I already read this https://www.elastic.co/guide/en/elasticsearch/reference/2.3/modules-node.html )

If I want to index directly to ES from LS,
Which node I set elasticsearch's hosts info on LS?

8

All nodes can accept indexing requests, but as client nodes do not hold any data, they will act as a load balancer and distribute the work it receives. The actual work is therefore done by the nodes holding data.