Types of nodes that need the Watcher plugin enabled

Elastic Stack Elasticsearch
1

Hello,

I'm planning in start to use Watcher, but I have a question about where do I need to install it.

Currently I have four nodes, where three of them have all the roles (master, data, ml etc) and one is used only as a coordinating node, running in the same machine as our kibana instance.

Do I need to install the watcher in all the nodes? Can I install in only one of them or can I install watcher only on the coordinating node?

Thanks.

2

All nodes need to have X-Pack installed on them.

3

Sorry, I was talking about enable Watcher, not install X-pack, reading now it looks confusing.

All the nodes already have X-Pack installed, but do I need to enable the Watcher configuration on all of them or can I enable in only one of the nodes or even only the coordinating node?

For example, the machine learning feature needs to be enabled in all the master eligible nodes, but If I hade some data nodes only, I wouldn't need to enable ML on them, the Watcher features behaves in the same way?

4

Yes, you can enable it on only some of the nodes if you want.

5

You should enable it on all of your nodes. Here's why

  • All your data nodes can potentially execute watches in the background as soon as they hold a .watches shard. We have been executing watches distributed since elasticsearch 6.0 and if you dont do any shard allocation filtering where those shards can be, they can potentially anywhere.
  • Ok, but this means you are good to go with the coordinating node, right? Almost, when you are using the execute watch API, then the node, which receives the request will do the execution. This in turn means, that in the above example the coordinating is used by kibana, and as soon as you are using the console to execute a watch, this is gonna be the one node doing the execution.

To sum it up: In this particular setup, you should enable watcher on all nodes.

--Alex

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.