Just to be clear you're saying that the data role should be removed from the manager node. True?

[NeoLife-iT]

Just to be clear you're saying that the data role should be removed from the manager node. True?
When I did this Elasticsearch would not start on the manager node, and it would show a fault on the grid. IS this normal?

Originally posted by @Bal33p in #11062 (reply in thread)

[NeoLife-iT]

I am having this exact issue and looking for solution.

I had rebuild the cluster and want to full proof the architect of my distributed deployment. ..this is my 3rd installed slim down to just 1 node role each and try to avoid the elesaticsearch error when there are multiple search nodes.

Final Slim Down Cluster:

-1 Manager node
-1 Receiver node
-1 Search node
-1 Fleet node
-1 Forward/Sensor node

"Just to be clear you're saying that the data role should be removed from the manager node. True?
When I did this Elasticsearch would not start on the manager node, and it would show a fault on the grid. IS this normal?"

[reyesj2]

Did you move data off of the manager node before removing the data role? https://docs.securityonion.net/en/2.4/elasticsearch.html#elasticsearch-node-roles

Specifically, it links to elasticsearch docs and using cluster.routing.allocation.exclude._ip to exclude the manager ip from the allocation pool. Data migrates off the manager, once that is completed you can remove the data role and restart elasticsearch.

[NeoLife-iT]

yes! i moved all the data and run so-elasticsearch-query _cat/allocation?v
The manager node is not on the list.

• in kilbana - exclude the manager from elasticsearch routing.

#Exclude the Manager's IP from cluster routing to move shards off the Manager
PUT _cluster/settings
{
"persistent" : {
"cluster.routing.allocation.exclude._ip" : "10.2.9.99"
}
}

-in the admin config >advance > role - remove the data from the manager - synchronize the grid

and lastly i clear all the data

so-elastic-clear

-Also reboot the entire cluster - notice of reboot in the grid!

Thanks for replying. -- any other idea?

[cm-ops]

Are there any clues in the /opt/so/log/elasticsearch/securityonion.log?

[NeoLife-iT]

i found 2 un-assign shards = 2 red indice....how do i remove them?

ASSIGNED
[root@sos elasticsearch]# so-elasticsearch-indices-list | grep -vE "green|health" red open .logs-osquery_manager.action.responses-default kbUOQTjLQtGzkHNmhEo-Vg 1 0
red open .logs-osquery_manager.actions-default H2cb7gMsQtOsy01wGFVffw 1 0
[root@sos elasticsearch]#

[cm-ops]

You could remove them in Kibana > Stack Management > Index Management. Check the two boxes next to their names, then hit the blue manage index button and delete index.

Restart Kibana and those indices will be recreated.

[NeoLife-iT]

Thanks so much for your help. I am a happy camper now :-) ...will see if it is return to green

FYI:

my brand new cluster experience same issue...i only put 5 client on it and the index gone wild!!!..