Question Regarding Elasticsearch Configuration

[89sooner]

I am using Security Onion in a distributed environment. Currently, I have configured 3 forward nodes, 1 manager node, and 3 search nodes.

First question: If I want to purchase and register a paid Elasticsearch license, how many nodes should the license support in total?

Second question: Upon checking, I noticed that Elasticsearch and Kibana are on the manager node, and the search nodes are clustered, with the manager node's Elasticsearch remote clustering the search nodes. Is this correct?

If so, it seems that each cluster does not have a replica shard, causing the cluster status to show as yellow. I am curious about the reason behind configuring it this way.

[dougburks]

First question: If I want to purchase and register a paid Elasticsearch license, how many nodes should the license support in total?

For questions about paid Elastic licenses, please reach out to the Elastic sales team.

Second question: Upon checking, I noticed that Elasticsearch and Kibana are on the manager node, and the search nodes are clustered, with the manager node's Elasticsearch remote clustering the search nodes. Is this correct?

In Security Onion 2.3, each search node was its own independent Elastic cluster and the manager queried each of them via cross cluster search.

In Security Onion 2.4, search nodes should join the manager's cluster.

[f4ncyz4nz4]

Good morning,
Is it possible to set any options in order to have this independency between search nodes even in the 2.4 version?
Or Sec Onion 2.4 supports only search nodes joined with manager's cluster.

Furthermore, if all search nodes must join manager cluster, should they be in the same network of the manager?

Thanks for the attention.

[dougburks]

@f4ncyz4nz4

From #1720:

Start a new discussion instead of replying to somebody else's discussion
Please search to see if you can find similar discussions that may help you. However, in order to avoid confusion, please do NOT reply to somebody else's discussion with your own issue. Instead, please start a new discussion and in that new discussion you can provide a hyperlink to the related discussion.