Shard Allocation in 2.4 #13697
Unanswered
jimhranicky
asked this question in
2.4
Shard Allocation in 2.4
#13697
Replies: 1 comment
-
|
You can configure shards as you see fit for your deployment: |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Version
2.4.100
Installation Method
Security Onion ISO image
Description
configuration
Installation Type
Distributed
Location
on-prem with Internet access
Hardware Specs
Meets minimum requirements
CPU
8
RAM
64g
Storage for /
80g
Storage for /nsm
2T
Network Traffic Collection
tap
Network Traffic Speeds
more than 10Gbps
Status
Yes, all services on all nodes are running OK
Salt Status
No, there are no failures
Logs
No, there are no additional clues
Detail
Now that 2.4 is running a full ES cluster, restarting elasticsearch or rebooting a node makes the entire cluster unsearchable. It also seems that each zeek index has 3 primary shards. Would it be reasonable to change that to 2 primary shards and one replica? An extra replica shard for suricata could be optional as well.
Guidelines
Beta Was this translation helpful? Give feedback.
All reactions