Dedicated Wazuh nodes

[UMHB-InfoSec]

I am investigating deploying Wazuh to some of my endpoints (~600). But, I don't know how much overhead I will be adding to my existing cluster.

I have some spare servers that I can add to my cluster but they are not as performant as my current search nodes and I don't want to degrade the over all performance by adding in these slower servers.

Is there a way that I can add these nodes as Wazuh only nodes? Also, directly correlated with that would be the question: is it possible to tell SO to ONLY use the slower nodes for Wazuh?

I have been searching the docs and the discussion list but did not find anything about this. If I missed it please point me in the right direction, I don't mind doing the leg work.

[dougburks]

Adding slower search nodes will most likely degrade your search performance. We recommend adding search nodes that are equal to or greater than your current search nodes.

[UMHB-InfoSec]

Thanks Doug.