Error setting up the hot warm architecture

[Tejo Sai]

Hello, 

I followed this article : Index Lifecycle Management' to set up retention policy. while setting up the hot-warm architecture, to configure the warm node to add attribute  in the /etc/wazuh-indexer/opensearch.yml I am unable to restart the wazuh-indexer getting a error. 

Below attached are the screenshots:

1. results of cat /var/ossec/logs/ossec.log | grep "error|warn"

2. 2. configuration in the ossec.conf file

Please help me out.

Regards,

Tejo Sai

[hasitha.u...@wazuh.com]

Hi Tejo,

The documentation’s hot-warm architecture assumes you have multiple nodes to separate these roles. In a single-node setup, assigning a phase-specific attribute like warm disrupts the cluster.

If you remove node.attr.tempathis part from the opensearch.yml file, indexer will restart. Therefore, you need to have another indexer to configure warm phase.

• A hot node is typically fast and expensive due to its high computing resources.

• A warm node is slower and cheaper due to lower computing resources.
  

Ref: https://documentation.wazuh.com/current/user-manual/wazuh-indexer-cluster/index-lifecycle-management.html#set-up-hot-warm-architecture
You can design a hot-warm architecture where you first index your data to hot nodes and after a certain period move them to warm nodes. (This required multi-node architecture.)

Let me know if you need further assistance on this.

Regards,
Hasitha Upekshitha

[Tejo Sai]

Thanks Hasitha for your response,

I will remove those attributes from my single node setup. I am getting one more error on the dashboard from another  wazuh deployment. I attached the screenshot below for your reference.

Kindly help me resolve this issue.

Regards,

Tejo Sai Sreenivas Avadalaapuram

[hasitha.u...@wazuh.com]

Hi Tejo,

I would suggest you to please create a new post in the community channel with details about the new query. This will help us to provide more focused support on the issue that you are facing.

Regards,
Hasitha Upekshitha

[Tejo Sai]

Ok Hasitha. Thanks for responding