Warm Nodes - high data from new ingestion

Elastic Stack Elasticsearch
1

Hi Team,

I recently added warm nodes to our deployments in elastic cloud in prep to add ILM Policies (nothing added yet).

Last night, I got low space warnings and noticed almost all of the space on warm nodes was consumed with newly created indexes from our EC2 Logs.

I understand that I could add node.ingest = false in the yaml for dense storage. But trying to understand why this would happen with default configuration and why elasticsearch wouldnt allocate to other instances despite the high utilization on the dense storage nodes.

Could this be that no policies are applied to templates to set which node types to use?

Appreciate insights.

Wayne

2

Just bumping this up.

3

Yes, if nothing specifies new indices should allocate to hot nodes, they will go anywhere. This includes .prefixed internal indices. If the cluster contains indices that aren't tagged with node type, they will migrate to these new warm nodes.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.