If I transform my single indexer to clustered indexer will I lose my old data?

[aasabatini]

Hi Folks,

I have a question, consider I have a simple architecture with 1 search head and 1 indexer.

I need to move a single indexer to clustered indexer.

I know I need to add another twin indexer server and cluster manager but my question is:

when I transform the single indexer to the clustered indexer I will lost all my old data? or the old data will replicate to the new indexer?

How do I manage the indexes.conf in that case?

[gcusello]

Hi @aasabatini,

as @PickleRick said, you can add your stand-alone indexer to a cluster without loosing your data.

The only issue is that the old data aren't automatically replicated.

To replicate them, you have two choices (both not immediate!):

• Solution 1:
  • reindex all data,
• solution 2:
  • assign to the new indes another name (e.g. if the original index is called "indexA", call the new one "indexA_clusterd",
  • then after cluster installation, manually copy all old indexes into all your Indexers,
  • change all your eventypes, from "index=IndexA" in "index=indexA OR index=indexA_clustered".

this is a temporary solution that works until the old data exceed the retentio period.

Ciao.

Giuseppe

[PickleRick]

There are some options - you can either add your indexer as an "additional" one next to a working cluster or add the indexer to a cluster. You will not lose the existing data but the existing non-clustered buckets will not get replicated. There's supposedly some procedure that Professional Services can do to convert buckets to clustered but it's not something a user or admin can do on his own.

[aasabatini]

Hi @PickleRick , @gcusello ,

thanks for your reply, I have another question.

If I archive the logs in the thawed path on the single indexer and I restore the data on the cluster indexer, could be works?

Regards

Ale

[gcusello]

Hi @aasabatini,

in this way, you can use the data for searching, but they aren't replicated, it's the same thing I hinted.

I understand that's a long work, but the approach I used is the one I described:

• use a different name for clustered versions of indexes,
• copy old buckets in each Indexers,
• modify eventtypes to use both the indexes. 

Also for this reason, when I teach a training, I hint to always use eventtypes instead of index= in searches.

Ciao.

Giuseppe