Strange issue with 2 seperate ELK servers

So I have 1 ELK server setup and working just fine IP is 172.16.40.28. We
wanted to build a second one to log different servers and for several
reasons keep the data seperate. So I built the new server and setup ELK
again, all seems fine. The IP of the new server is 172.16.40.29. When I go
to the new server IP kibana page I see all the data from the first ELK
server. I have verified that my PC (through netstat) is connecting to .29
and that on .29 through netstat shows me connecting. I tried clearing
cookies and cache - any thoughts or help? when new data comes in I see it
on both servers Kibana pages - so it's almost like Kibana is pointing to
another ES server but I verified it is not in the config.js

Maybe I don't need to build another server but I am new to ELK and scaling
it out in a cluster is over my head at this point

--
Thanks,
Kevin

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/10e468db-e862-4646-b52f-ac7f9b6a7c35%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

By default ES uses a discovery method that allows any node with the same
cluster name to join an existing node with the same cluster name, thereby
forming one cluster.
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/modules-discovery-zen.html
and you want to look at unicast discovery if you want to know more.

The quick solution here is to stop the new ELK server, change the
cluster.name (
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/setup-configuration.html#cluster-name)
and then restart the node.

You may find you need to delete some data though, if you're new then
install plugins like ElasticHQ and kopf, they will give you some good
visual insight into Elasticsearch and lets you manage it via the GUI.

Regards,
Mark Walkom

Infrastructure Engineer
Campaign Monitor
email: markw@campaignmonitor.com
web: www.campaignmonitor.com

On 16 September 2014 23:51, Kevin M mcgkev29@gmail.com wrote:

So I have 1 ELK server setup and working just fine IP is 172.16.40.28. We
wanted to build a second one to log different servers and for several
reasons keep the data seperate. So I built the new server and setup ELK
again, all seems fine. The IP of the new server is 172.16.40.29. When I go
to the new server IP kibana page I see all the data from the first ELK
server. I have verified that my PC (through netstat) is connecting to .29
and that on .29 through netstat shows me connecting. I tried clearing
cookies and cache - any thoughts or help? when new data comes in I see it
on both servers Kibana pages - so it's almost like Kibana is pointing to
another ES server but I verified it is not in the config.js

Maybe I don't need to build another server but I am new to ELK and scaling
it out in a cluster is over my head at this point

--
Thanks,
Kevin

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/10e468db-e862-4646-b52f-ac7f9b6a7c35%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/10e468db-e862-4646-b52f-ac7f9b6a7c35%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAEM624ac-y2j7pAbMiidnFvwnqma_jS94dzLk_DihCjsPPmYoQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Thanks you for the detailed information - changed the cluster name worked
well. The plugins were also easy to install - thanks again!

On Tuesday, September 16, 2014 4:00:20 PM UTC-4, Mark Walkom wrote:

By default ES uses a discovery method that allows any node with the same
cluster name to join an existing node with the same cluster name, thereby
forming one cluster.
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/modules-discovery-zen.html
and you want to look at unicast discovery if you want to know more.

The quick solution here is to stop the new ELK server, change the
cluster.name (
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/setup-configuration.html#cluster-name)
and then restart the node.

You may find you need to delete some data though, if you're new then
install plugins like ElasticHQ and kopf, they will give you some good
visual insight into Elasticsearch and lets you manage it via the GUI.

Regards,
Mark Walkom

Infrastructure Engineer
Campaign Monitor
email: ma...@campaignmonitor.com <javascript:>
web: www.campaignmonitor.com

On 16 September 2014 23:51, Kevin M <mcgk...@gmail.com <javascript:>>
wrote:

So I have 1 ELK server setup and working just fine IP is 172.16.40.28. We
wanted to build a second one to log different servers and for several
reasons keep the data seperate. So I built the new server and setup ELK
again, all seems fine. The IP of the new server is 172.16.40.29. When I go
to the new server IP kibana page I see all the data from the first ELK
server. I have verified that my PC (through netstat) is connecting to .29
and that on .29 through netstat shows me connecting. I tried clearing
cookies and cache - any thoughts or help? when new data comes in I see it
on both servers Kibana pages - so it's almost like Kibana is pointing to
another ES server but I verified it is not in the config.js

Maybe I don't need to build another server but I am new to ELK and
scaling it out in a cluster is over my head at this point

--
Thanks,
Kevin

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/10e468db-e862-4646-b52f-ac7f9b6a7c35%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/10e468db-e862-4646-b52f-ac7f9b6a7c35%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/75279414-1276-4aae-a01e-c6f1067550a4%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.