there are no ingest nodes in this cluster unable to forward request to an ingest node.

There Are No Ingest Nodes In This Cluster Unable To Forward Request To An Ingest Node. How To Specify Node

Client Version: version.InfoMajor:1, Minor:18, GitVersion:v1.18.2, GitCommit:52c56ce7a8272c798dbc29846288d7cd9fbae032, GitTreeState:clean, BuildDate:2020-04-16T11:56:40Z, GoVersion:go1.13.9, Compiler:gc, Platform:linuxamd64.

Server Version: version.InfoMajor:1, Minor:18, GitVersion:v1.18.2, GitCommit:52c56ce7a8272c798dbc29846288d7cd9fbae032, GitTreeState:clean, BuildDate:2020-04-16T11:48:36Z, GoVersion:go1.13.9, Compiler:gc, Platform:linuxamd64.

Please paste the output of kubectl describe elasticsearch monitoring-elasticsearch -n elastic-monitoring and any logs from the operator.

We rolled out the elastic stack several times and reinstalled eck only once (just recently).

Youll have to check whether DNS resolution is configured correctly within the cluster and that there are no network policies or other configurations in place that prevent communication between pods andor nodes.

As a result the nodes will respond differently to same queries.

We can safely assume that any version starting from 2.x is working.

Graylog needs to know the address of at least one other Elasticsearch node given in the elasticsearchhosts setting.

Additionally you can specify an optional path prefix at the end of the URI.

While it might work when patch-levels differ, we highly encourage to keep versions consistent.

All of these actions need to be performed through the Graylog REST API in order to retain index consistency.

Therefore, we need to know which Elasticsearch version is running in the cluster.

This is why we do a single request to the first reachable Elasticsearch node and parse the version of the response it sent back.

There are some things which can go wrong at this point, or you might want to run an unsupported version.

If you are absolutely sure what you are doing, you can set the elasticsearchversion configuration variable.

It will disable auto-sensing, force Graylog to pretend that this Elasticsearch major version is running in the cluster, and load the corresponding support module.

To enable this feature, you need to set the elasticsearchdiscoveryenabled to true.

There Are No Ingest Nodes In This Cluster Unable To Forward Request To An Ingest Node. How To Specify Node

Optionally, you can define the a filter allowing to selectively includeexclude discovered nodes (details how to specify node filters are found in the Elasticsearch cluster documentation ) using the elasticsearchdiscoveryfilter setting, or tuning the frequency of the node discovery using the elasticsearchdiscoveryfrequency configuration option.

If your Elasticsearch clustes uses authentication, you need to specify the elasticsearchdiscoverydefaultuser and elasticsearchdiscoverydefaultpassword settings.

The usernamepassword specified in these settings will be used for all nodes discovered in the cluster.

It specified the scheme used for discovered nodes and must be consistent across all nodes in the cluster.

Otherwise the data is readable by anyone who has access to the machine over network.

We recommend to use around 50 of the available system memory for Elasticsearch (when.

It usually goes along with Elasticsearch INFO log messages like this.

The reasoning behind that is that short periods of misbehaviour are less problematic than short periods of unavailability.

When the nodes are able to replicate their data, they will attempt to converge the replicas and to achieve eventual consistency.

Master nodes coordinate their actions actively with others, ensuring that the data can be converged by non-masters.

The cluster nodes that are not master nodes are not allowed to make changes that would break the cluster.

When an Elasticsearch cluster is split into two sides, both thinking they are the master, data consistency is lost as the masters work independently on the data.