i was wondering if it’s possible to have the data retention on separate volumes.
let’s say the first 30 days that should be available swiftly should be stored on fast SSD disks and the remaining 60 days can be stored on a NAS volume (simply because it’s cheaper).
i’m not sure if this is possible at all?
i’m in the midst of setting up a brand-new graylog environment (3.0) and have the requirement that the old data from the previous graylog instance (elasticsearch 2.x) would be available as well. it elasticsearch 6.x downward compatible with elasticsearch 2.x ?
I apologize in advance if this is not the right place to ask this…
This is looking cool, however I’m wondering if it makes sense (and actually can be done) running both a warm and a hot node on the same server.
Does anyone have any experience in running them combined?
This way, I’d have 3 servers instead of 6 servers (both running elasticsearch warm and hot nodes).
depending on the available RAM and CPU that might be possible - but you need to know what you do, how you configure both instances of Elasticsearch on the same systems. That is a non-trivial task. Also for tuning an debugging I would recommend to have that separated to different servers.
