How to set different elastic node type permanently?

[ConfusedFelix]

Version

2.4.10

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

10

RAM

16Gb

Storage for /

300Gb

Storage for /nsm

700Gb

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello! I have a 2.4 Instance I'm testing in a development environment before we can push it live and replace our 2.3 instance. We use the elastic instance in our 2.3 to hold data for a third party service and it works flawlessly. When I tried to repeat our instance with 2.4 I developed lots of errors and failure to initialize the new indices. What I discovered is my service is looking for a data or data_content node role that doesn't exist in 2.4, but rather these roles have been replaced by data_hot.

I tried changing the elasticsearch.yml file, but it gets overridden with the next salt update. Can someone tell me:

1. Would changing or adding the data or data_content node role affect other part of 2.4?
2. Where is the source file that is generating the elasticsearch.yml that I can edit to add/replace these roles?

Thanks in advance! Big fan of 2.4 and all the changes, this one thing has me hung up.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[ConfusedFelix]

As I peel back this onion (hah!), I found /opt/so/saltstack/default/salt/elasticsearch/config.map.jinja decides what node role each node will be. I changed this from data_hot to data and it fixed my immediate issue but I'm not sure if this will break something else yet.

[TOoSmOotH]

You would need your 3rd party tool to look at data_hot as this is where all of our index templates put data.