Use master/data or cordinating node for search?

Elastic Stack Elasticsearch
1

I have six data node, three master and two coordinating (which is also kibana)

I am setting up proxy in front.

for elk:5601 is easy as it is just kibana.

for elk:9200 should I use coordinating nodes or master node or data node?

balance leastconn
server elkc1 <IP>:9200 check weight 1
server elkc2 <IP>:9200 check weight 1

everyone for writing and search going to use elk:9200 either from python and/or logstash

or should I setup two separate thing?

elk_search:9200 -> different server

elk_write:9200 -> different server

2

Hi @elasticforme

First Do not use the Masters.

We could have a long discussion on why you do or do not need coordinating nodes.

If they are pure coordinating nodes I.e do not have ingest role and you use ingest pipelines then think of the a search / read nodes..
Note kibana dev tool can still POST data etc.

And write to the data nodes...

AND / OR

Even if you have coordinating nodes to support kibana you can also read / write to data nodes.

So the question comes

Why do need coordinator nodes.. it's kinda and old pattern...yup it is in the docs, but they are not as often used these days.. still fine for Kibans isolation but just adds more to manage.

3

Allright master is out of question now.

these two node are just kibana and hence I setup elastic on it as well and bind kibana to itself.

# cat /etc/kibana/kibana.yml |grep -v ^# |sed '/^$/d'
server.port: 5601
server.host: "elkc1"
server.name: "elkc1"
elasticsearch.hosts: ["http://elkc1:9200"]
elasticsearch.username: "kibana_system"
elasticsearch.password: "<password>"


# grep node.role /etc/elasticsearch/elasticsearch.yml

node.roles: []

in your suggestion just add all six datanodes for search/write

like elk:9200 -> all six nodes ?

4

They will add unnecessary burden to the cluster, specially for a small cluster where there is no need for coordinating nodes.

Just point to the data nodes, if you have data tiering like hot and warm nodes, point to the hot nodes.

5

sorry forgot to mention - this is busy cluster not small. ingesting millions of record daily and searching as well.

6

Yeah, but in terms of Elasticsearch this would be considered a small cluster, the coordinating nodes could have more impact than help here as they will add unnecessary latency as all requests need to pass through them.

I would remove them and point directly to the data nodes.

If you do not have data tiering, you can put all six nodes behind the LB to make it easier.