I have a runnig environment with 5 nodes cluster. Each of them has installed mongo, graylog and elasticsearch .
Now I would like to reconfigre this into 2 nodes with graylog only (node 1 and node 2) and 3 nodes with elasticsearch only (nodes 3, 4 and 5).
To change the elasticsearch I probably need to do this:
elasticsearch nodes are aware of each other by the list of nodes in elasticsearch.yml:
I will remove nodes1 and 2 form this list, so it remains only:
discovery.zen.ping.unicast.hosts: node3, node4, node5
in the graylog server.conf I currently also have all five nodes listed. Which ones should I list to reach new configuration ?
You have to make sure that the indices (or rather index shards) on the two Elasticsearch nodes you want to decommission are migrated to the remaining Elasticsearch nodes.
I assume I should specify only elasticsearch nodes in the *unicast_hosts lists in both server.conf on GL nodes and in
elasticsearch.yml on elastic nodes. Do I need to tell easticsearch cluster that graylog nodes node1 and node2 are also partialy connected ?
server.conf file on graylog nodes:
elasticsearch_discovery_zen_ping_unicast_hosts = node3:9300, node4:9300, node5:9300
# till now this linked to local yml file. In new config, is it ok to be empty ?
elasticsearch_config_file = <empty>
Mongodb DB conf
Delete node5 and node4 from mongo conf. Leave node1 and node 2 (graylog nodes) and also node 3 (elastic node, but there have to be 3 mongo nodes for replica)