Multiple searchnodes with different storage capacities

[DJKorps]

Version

2.4.111

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

4+

RAM

16+

Storage for /

100+

Storage for /nsm

200+

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I am deploying more searchnodes and receivers.

Search nodes range from having 2tb of storage to 300gb (HDD and SSD)

Is there a way to deploy the search nodes to take the data from the SSD search nodes and move it to the HDD when storage is being cleaned during purges?

I am mainly looking to have SSD searchnodes do the pulling while the HDD search nodes be the retention.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

You can set up data tiers https://www.elastic.co/guide/en/elasticsearch/reference/current/data-tiers.html

You could have your smaller SSD nodes hold hot tier data and your HDD node hold the other tier data. As indices move through their ILM they will move to the node that houses the tier it is on.

[dougburks]

Also see https://docs.securityonion.net/en/2.4/elasticsearch.html#ilm.

[DJKorps]

I read through both articles but I must be missing something

Can these settings for tiering be set in SO advanced settings or does this have to be done inside each search nodes?

[DJKorps]

I think I found the setting in this recent post

#12091