How to make a hot-warm cluster correctly?

Question

elasticsearch

Hello. The situation is as follows, there are two elastisearch nodes in the cluster (one on a fast but small ssd, the other on a large but slow hdd). I want to make a hot-warm architecture, i.e. we store logs on ssd for the last N days, and after these N days we transfer them to the HDD node, freeing up space on the SSD. I successfully implemented this through shard allocation filtering and curator, but I ran into a problem that some shards for new indexes (those not older than N days) began to be located on the HDD node, and because of this, performance deteriorated greatly. The question is how to correctly configure the cluster so that indexes no older than N days are located ONLY on the ssd node (or on several ssd nodes in the future), and after the expiration of N days they are transferred to the HDD node? And is it worth making hdd a master node or just data?

Answer 1

The magic of bash + jq, you can use cron/AWX/your favorite task manager.

ES_URL='http://elasticsearch_address:port' #URL эластика
ATTR_NAME="storage_type" #аттрибут ноды, устанавливается в elasticsearch.yml
ATTR_WARM="hdd" #значение аттрибута, соответствующий "тёплой" ноде
N=3 #количество календарных дней до передвижения индекса

END_DATE=$(date --date="$N days ago" -I)
for INDEX in $(curl -s "$ES_URL"'/_cat/indices?h=index,creation.date.string&format=json' |
  jq -rc '.[] | select(."creation.date.string" < "3*") | .index')
do
  curl -s -XPUT "${ES_URL}/${INDEX}/_settings" -d "{\"index.routing.allocation.require.${ATTR_NAME}\":\"{ATTR_WARM}\"}"
  if [ $& -eq]
  then
    echo "$INDEX has been set up"
  else
    echo "Error while setting up $INDEX"
    ERRORS=
  fi
done
if 
then
  exit 1
fi