issue with shards allocation in Elasticsearch

[palichx]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

60

RAM

120

Storage for /

500BG

Storage for /nsm

7TB

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

In a new installation with 4 nodes (1 separate manager, 2 forward, 1 search), Elasticsearch shards are allocated to the manager.

looks like incorrect Elasticsearch cluster configuration?

If the manager's address is excluded from routing allocation, the shards are stored where they are needed (on the search node).

PUT _cluster/settings
{
  "persistent" : {
    "cluster.routing.allocation.exclude._ip" : "172.20.xx.135"
  }
}

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

That is becuase the manager has the data role. In distributed grids, it is necessary as the grid is installed, but once installation is completed, you can "cluster.routing.allocation.exclude._ip" to move shards off and once they are off, remove the data role form the manager in SOC Administration > Configuration > elasticsearch > so_roles > so-manager > config > node > roles