Transport client?

[pierB]

Hi,

ES newbie here so please bear with my noob question.

I set a graylog stack, using ES / mongo /graylog server suite, I am using ES2.4 as this is the latest version supported by graylog-server.

After setting up my ES node (I only have one node on the the very same server that holds graylog and mongo), I can see the following :

{
"cluster_name" : "log_server_graylog",
"nodes" : {
"flyaLaEiSa-W2EZ3b3K41w" : {
"timestamp" : 1487063374759,
"name" : "log",
"transport_address" : "127.0.0.1:9300",
"host" : "127.0.0.1",
"ip" : [ "127.0.0.1:9300", "NONE" ],
"process" : {
"timestamp" : 1487063374759,
"open_file_descriptors" : 577,
"max_file_descriptors" : 65536,
"cpu" : {
"percent" : 0,
"total_in_millis" : 977580
},
"mem" : {
"total_virtual_in_bytes" : 48561156096
}
}
},
"1Ee5IXtRTLC6nyCgloOaug" : {
"timestamp" : 1487063374760,
"name" : "graylog-27274b66-3bbd-4975-99ee-1ee3d692c522",
"transport_address" : "127.0.0.1:9350",
"host" : "127.0.0.1",
"ip" : [ "127.0.0.1:9350", "NONE" ],
"attributes" : {
"client" : "true",
"data" : "false",
"master" : "false"
},
"process" : {
"timestamp" : 1487063374760,
"open_file_descriptors" : 519,
"max_file_descriptors" : 64000,
"cpu" : {
"percent" : 0,
"total_in_millis" : 1001200
},
"mem" : {
"total_virtual_in_bytes" : 15875788800
}
}
}
}
}

I was kind of surprised to see that there are 2 nodes as I am did not set anything like that, someone on the ES irc told me that it may be because of using a transport client which appears as a second node. But I did not setup anything like that.

Do you confirm that my second node actually is a transport client ?

Is it some kind of problem ?

If yes how can I set up my ES server in order to see only one node ?

Again, I am a ES newbie, I did some research about transport client but I could not understand where this second comes from...

Here my very simple config file :

cluster.name: log_server_graylog
node.name: ${HOSTNAME}
path.data: /elq/elasticsearch/data
path.logs: /elq/elasticsearch/log
bootstrap.memory_lock: true
network.host: 127.0.0.1
action.destructive_requires_name: true

Thanks for your enlighment

[warkolm (Mark Walkom)]

What does _cat/nodes show?

[Christian_Dahlqvist]

Based on the configuration, it looks like Graylog sets up one master/data node and an additional client node. Clients using the transport protocol do not join the cluster as nodes.

[pierB]

Hi Christian_Dahlqvist,

Thanks for your answer although I dot not understand it fully (this is an understatement!) :

" Clients using the transport protocol do not join the cluster as nodes"

Is this a problem or not ?

I understand this is caused by the graylog client, so I guess this is a normal behaviour, but from the ES point of view is this problematic ?

Thanks again for your time

[Christian_Dahlqvist]

You appear to have two nodes, so what you are seeing is normal. I don't think a client node is really needed for a cluster this size, but even though the client node may not be required, it should not be problematic.

[pierB]

OK, good to hear that

So I am keeping the config as is.

When you're saying : " I don't think a client node is really needed for a cluster this size" do you mean the data set size ? Because it is going to increase a lot more in the future (I am now sending only syslog to ES, but soon the very verbose Home app is giong to be sent over there...)

Does a client node is more accurate for large data set ?

Thanks again...

[Christian_Dahlqvist]

I do not know Graylog, so do not know why they apparently are using a client node. For small clusters dedicated client nodes are generally not required.

[pierB]

OK, thanks I'll ask @graylog for more info regarding this question.

You've been very helpful and quick to response, thank you for that.

Pier