Elasticsearch domains should use at least three data nodes

Documentos > Datadog Security > OOTB Rules > Elasticsearch domains should use at least three data nodes

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Description

This control checks whether Elasticsearch domains have at least three data nodes and ensures the zoneAwarenessEnabled setting is activated. To achieve high availability and fault tolerance, an Elasticsearch domain should be configured with at least three data nodes. This ensures that the cluster can continue to function even if one node fails.

Remediation

To modify the number of data nodes in an Elasticsearch domain:

Log in to the Amazon OpenSearch Service console.
Under Domains, choose the name of the domain you want to edit.
Click Edit domain.
Under Data nodes, set Number of nodes to a number greater than or equal to 3.
For three Availability Zone deployments, set to a multiple of three to ensure equal distribution across Availability Zones.
Click Submit.