Multiple Master Eligible Nodes for SO

[JumpyWizard404]

Hi guys i have been testing Security Onion for our organization to use in combination with a multi master wazuh instance, and what i've come to find out is that when the manager goes down for any reason the entire cluster goes down cause the cluster manager role does not get transferred to any other node, also i've noticed only the manager is a cluster discover node so even if you add another master eligible node there's still a cluster fail because of discovery issues, so my question is has anyone done this before, i.e do i just accept that single point of failure? Any comments would be appreciated.

[cm-ops]

For HA, having multiple nodes with either the master role or master with voting_only roles would help in the event the master node is down. https://www.elastic.co/guide/en/elasticsearch/reference/8.18/node-roles-overview.html#master-node-role

To further the pipeline redundancy, if you do not have a receiver node, you should look into adding one of them as well - https://docs.securityonion.net/en/2.4/architecture.html#receiver-node