0

I have setup a Cloudformation template to start an instance where Logstash and Elasticsearch (not embedded) are installed.

I have standard tcp input configured on Logstash and output it to an Elasticsearch cluster.

When I start multiple instances, all the Elasticsearch instance find each other, elect a Master, sync and everything. The issue is that when I do : 

curl -XGET 'http://localhost:9200/_cluster/nodes?pretty=1'

the master and only the master node shows me one additional node :

"8kLMLhP-RHGdgcYGlt3dEQ" : {
"name" : "Bling",
"transport_address" : "inet[/10.226.186.84:9301]",
"hostname" : "ip-10-226-186-84",
"version" : "0.90.9",
"attributes" : {
"client" : "true",
"data" : "false"
}

which is the logstash instance running on 9301. I don't get why it's doing that.

Bastien974
  • 1,896
  • 12
  • 44
  • 62

1 Answers1

0

http://logstash.net/docs/1.3.3/outputs/elasticsearch#protocol

By default, logstash is using protocol "node" that allows it to talk to Elasticsearch. It also makes the instance seen as an ES node, but without actually storing data.

Using the "transport" protocol force the use of the "host" variable, that seems to be incompatible with a cluster.

So I think it's not possible to remove logstash instance from an ES cluster, harmless though.

Bastien974
  • 1,896
  • 12
  • 44
  • 62