Running Nagios Log Server with 1 instance

[bennyboy]

Hi,

I need to understand the impact of running only 1 instance.

For the moment the cluster has the yellow status.

curl -XGET 'http://localhost:9200/_cluster/health?pretty=true'
{
"cluster_name" : "346c080f-96a6-4bf3-aab7-337cd0e3b771",
"status" : "yellow",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 1216,
"active_shards" : 1216,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 1216,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0
}

We plan to buy another instance next year. Do you have some advice for me?
As an example if we store 200G of data in 1 year and we want to add a new instance. What happening in that case.

Thank you!

[rkennedy]

The machine is in a yellow state due to in being a single node. By default, NLS creates two copies of your indices, which are divided into shards. NLS aims to have two copies of each shard at all times.

Once you add the second member in, the cluster state would become green, because two copies of the data will now exist, and elasticsearch is happy. In your case, when you add the second machine in, the data will be replicated over to the new machine.

[bennyboy]

Do you have advice or best pratice when we have only 1 instance.

I have 1221 unassigned replica. I have to delete / close or something else ?

logstash-2016.04.21 1 r UNASSIGNED
logstash-2016.04.21 2 r UNASSIGNED
logstash-2016.04.22 2 r UNASSIGNED
logstash-2016.04.22 0 r UNASSIGNED
logstash-2016.04.22 3 r UNASSIGNED
logstash-2016.04.22 1 r UNASSIGNED
logstash-2016.04.22 4 r UNASSIGNED

It's not a problem to have a lot of unassigned replica in 1 year ?

Thank you!

[mcapra]

It's not a problem to have a lot of unassigned replica in 1 year ?

Correct. Our default configuration for the indices tries to allocate 1 replica shard per index. If there are no additional nodes to assign a replica shard to, they just sit there until there is a node that they can be assigned to. Having unassigned shards in general doesn't consume any (meaningful) additional resources.