How to remove node from elasticsearch cluster on runtime without down time

Question

Suppose I had 5 nodes in cluster and I had to remove 2 node on run-time. So how it can be done without affecting the indices?

I had continuous stream of data coming

Answer 1

You can decommission a node by telling the cluster to exclude it from allocation. (From the documentation here)

curl -XPUT localhost:9200/_cluster/settings -H 'Content-Type: application/json' -d '{
  "transient" :{
      "cluster.routing.allocation.exclude._ip" : "10.0.0.1"
   }
}';echo

This will cause Elasticsearch to allocate the shards on that node to the remaining nodes, without the state of the cluster changing to yellow or red (even if you have replication 0).

Once all the shards have been reallocated you can shutdown the node and do whatever you need to do there. Once you're done, include the node for allocation and Elasticsearch will rebalance the shards again.