How to Change 5 systems cluster into 2 GL and 3 elasticsearch nodes

Hello,

I have a runnig environment with 5 nodes cluster. Each of them has installed mongo, graylog and elasticsearch .

Now I would like to reconfigre this into 2 nodes with graylog only (node 1 and node 2) and 3 nodes with elasticsearch only (nodes 3, 4 and 5).

  1. To change the elasticsearch I probably need to do this:
    elasticsearch nodes are aware of each other by the list of nodes in elasticsearch.yml:
    I will remove nodes1 and 2 form this list, so it remains only:
    discovery.zen.ping.unicast.hosts: node3, node4, node5

  2. in the graylog server.conf I currently also have all five nodes listed. Which ones should I list to reach new configuration ?

elasticsearch_discovery_zen_ping_unicast_hosts = node1, node2

  1. Any other changes ?

You have to make sure that the indices (or rather index shards) on the two Elasticsearch nodes you want to decommission are migrated to the remaining Elasticsearch nodes.

Thanks Jochen.

I assume I should specify only elasticsearch nodes in the *unicast_hosts lists in both server.conf on GL nodes and in
elasticsearch.yml on elastic nodes. Do I need to tell easticsearch cluster that graylog nodes node1 and node2 are also partialy connected ?

  1. server.conf file on graylog nodes:
elasticsearch_discovery_zen_ping_unicast_hosts =  node3:9300, node4:9300, node5:9300

# till now this linked to local yml file. In new config, is it ok to be empty ?
elasticsearch_config_file = <empty>
  1. elasticsearch.yml on elastic nodes
discovery.zen.ping.unicast.hosts: ["node3:9300", "node4:9300",  "node5:9300"]
  1. Mongodb DB conf
    Delete node5 and node4 from mongo conf. Leave node1 and node 2 (graylog nodes) and also node 3 (elastic node, but there have to be 3 mongo nodes for replica)

No.

Yes, that’s fine. This setting is only required in very rare cases.

You can do this, although it’s not strictly necessary. The old configuration will just linger around but will have no effect whatsoever.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.