Configuring ES Clustering and Hot/Warm nodes in SO 2.4

[nomadicnerd42]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

32 GB

Storage for /

300 GB

Storage for /nsm

2 TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello, everyone!

First off, I want to say that I have been using SO for several years, and have found the project extremely helpful.

I have a grid of systems all running 2.4.20 (1 Manager, 2 Search, 1 Forward) in a test environment.

My question surrounds how to setup/configure ES Clustering and Hot/Warm nodes in 2.4.

1. Does 2.4 use cross-cluster search by default (for grids with more than 1 search node)? Or, does 2.4 use ES Clustering already?
2. How does might one go about setting up/configuring Hot/Warm nodes in 2.4? (So that the search node with the most fast storage can be used as the "Hot" node, and the other node (which still has SSD, but is slower than the first node) can be used as the "Warm" node)? It's my understanding that in 2.3, Hot/Warm nodes could be enabled by editing the salt pillar files, but (at least in my install of 2.4) /opt/so/saltstack/local/pillar/global.sls does not exist.

Thank you all in advance!

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[cm-ops]

In 2.4 you will use Elastic cluster as a default. To set up hot/warm, you would need the warm node to have the role data_warm.

In 2.4.30, you can set that in SOC via the GUI, prior versions you would need to set it in the minion pillar file for that search node. For example, under elasticsearch add the below and restart ES:

  config:
    node:
      roles: ['data_warm', 'ingest']