Graylog: elasticsearch has 2 nodes on the same machine

Question

I was checking out a machine where I've graylog and elastic installed (for graylog).

There's a thing that I can't really undestand, it seems that elasticsearch is running with two nodes on the same machine, which i would like to avoid.

here's the output:

me@server ~ # curl 'localhost:9200/_cat/nodes'
127.0.0.1 127.0.0.1  1 71 0.54 d * Candra
127.0.0.1 127.0.0.1 32 71 0.54 c - graylog-7d4bdfb9-23ac-45e9-a957-1f72b8848e2b

is this normal? how can i set it up to use just one node?

Answer 1

The second node is a lightweight client node (see the c in the 6th column) that Graylog is creating in order to connect to the cluster. It's perfectly normal as you can see in their official documentation:

Graylog hosts an embedded Elasticsearch node which is joining the Elasticsearch cluster as a client node.