Currently we have two graylog nodes in an HA cluster. One in the US and one in the EU. We have a case where we would like to create an index on the EU node only(so the data at rest stays in the EU) while have the data itself be searchable from either node or future nodes. While leaving the rest of the indexes to replicate as they normally would.
When I asked enterprise sales if this was a feature of the enterprise product, they said they support this configuration. I haven’t been able to find information on how to do this but it would seem some level of ES reconfiguration would need to happen to make this work. My concern is if I mess around too much with ES I could potentially cause a bigger issue. Has anyone done a similar config and could point me in a good direction?
TIA