Elasticsearch node goes missing after Data node role removed from

[jimrincan]

Version

2.4.210

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Distributed

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

32

Storage for /

4TB

Storage for /nsm

4TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Our work center has two recent installations of Security Onion Manager. Following the install guide, recommendation to remove the "Data" node role from Configuration->Elasticsearch->Config->so-roles->so-manager, we lose the so-elasticsearch node. It's not until I restore the data role, that we get so-elasticsearch node restored. Is there a workaround, or should we just keep the data role in place?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Did you route the Elastic data off the manager first?

PUT _cluster/settings
{
  "persistent" : {
    "cluster.routing.allocation.exclude._ip" : "10.0.0.1"
  }
}

Once all the shards are moved, then remove the data role.