Correct config for hot/warm/cold storage through manager?

[nebra-status]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

200

Storage for /nsm

125

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I'm wondering what the correct config settings are, for setting up a hot/warm/cold storage
The system deployed is a distributed system, where there will be hot search nodes and warm/cold search nodes.

In the config I set the standard values from SO.
hot search node
data
data_hot
ingest
transform

warm/cold search node:
data
data_warm
data_cold
ingest
transform

Is it correct to assume I can remove both ingest and transform from the warm/cold search node?

I'm also confused about the different phases setup.
According to the description in SO, the option min_age in both warm and cold is doing the same:
"Minimum age of index. ex. 30d - This determines when the index should be moved to the cold tier. While still searchable, this tier is typically optimized for lower storage costs rather than search speed."

Whatever value I enter for min_age in the warm phase, is rejected.
For the min_age in the cold phase, I can enter any day value I want.

Can I assume that by setting the max_age e.g 3d in the hot phase, the index will be moved automatically to the warm node, without setting the min_age in the warm phase?

Thanks in advance

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

We've got some improvements for this in the upcoming 2.4.70 release. Stay tuned!