How to assign Master Role to search nodes

[hoenke]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

12

RAM

64

Storage for /

200GB

Storage for /nsm

2TB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

New 2.4.30 SO distributed installation with multiple search nodes. I would like to assign 2 search nodes the master role to keep the cluster functioning in the event the master node goes offline.

I was able to assign the master role to all nodes by copying /opt/so/saltstack/default/salt/elasticsearch/defaults.yaml into local and adding - master in the so-searchnode section.

Is it possible to selectively assign which search nodes are given the master role?

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[cm-ops]

You can set node roles in SOC - Configuration > administration > elasticsearch > so_roles > so-searchnode > config > node > roles if you want it to all searchnodes modify the Current Grid Value, or select the dropdown and modify a node by name.

You will need to toggle the Advanced settings in Options at the top to navigate to this setting.