Voting-only master-eligible node and its resources requirement

[bbfunde]

Dear All,

Graylog: v4.0.1
ES: v7.10.1

I am building up a distributed deployment with 3 ES nodes where 1 is voting-only master-eligible node (Node | Elasticsearch Guide [8.11] | Elastic)

(1)
I saw the instruction for a non-data master-eligible node in Graylog document is like this:
A dedicated master node has the following configuration in elasticsearch.yml:

node.data: false
node.master: true
(https://docs.graylog.org/en/latest/pages/configuration/elasticsearch.html)

should I include the following as well?

node.roles: [ master, voting_only ]

(2)
Because it is just a non-data node, can I assign resources as low as 1 CPU and 4GB RAM only? What is the recommended resources for the voting-only master-eligible node?

Thank you all in advance.

[zoulja]

@bbfunde

node.data: false
node.master: true

This is deprected syntax, for ES7 you need to follow your last example

[bbfunde]

Thanks for you kind response, again, zoulja.

Yes, I tried what you said and it works perfectly.

Can you share your experience on assigning resources to a non-data ES node? I am now using a 1 core, 4GB ram VM for that and so far so good. But I would be grateful if you could share your knowledge on the matter as well.

Thanks!

[zoulja]

Nope, I don’t have such experience.
All my ES nodes have the same hardware configuration and same roles (and maybe it’s not really efficient, but I can’t see how dedicated master can help to improve performance in my case)

[bbfunde]

We are starting up the SIEM service recently, the department has limited resources, and we understand ES has a wonderful scalability. That’s why we need to minimize the cost currently. I think I would monitor the setup and learn as it goes.

Thanks again, great help.