I use tribe nodes quite a lot at $work. It’s how we federate disparate ELK clusters and able to search across them. There are many reasons to have distinct ELK clusters in each data center and/or region.
Some of these are:
1. Elasticsearch does not work well when there is network latencies, which is guaranteed when your nodes are located geographically distant places. You could spend a lot of money to get fast network connection, or you can just have only local clusters. (Me? I pick saving money and avoiding head aches :-)).
2. It can get insanely expensive to create an ES cluster that span data centers/regions. The network bandwidth requirement, the data charges, the care and feeding of such a latency sensitive cluster…. OMG!
3. I don’t really think a 3rd reason is needed.
Although tribe nodes are great for federating ES clusters, there are some quirks in setting them up and caring for them (not as bad as ES clusters that span datacenter though).
One big gotcha for many people who are setting up tribe nodes for the first time is that tribe node can not create index. Tribe can only update, modify an existing index. What this mean is that if you point Kibana at a tribe node, you must first make sure you Kibana index is already created in one of the downstream ES cluster. Otherwise, you will have to create it yourself.
Otherwise, the first time you create an index pattern and tried to save it, you will get an error similar to the subject of this post.
MasterNotDiscoveredException
The error message is wrong and misleading. It has nothing to do with Master node. It has everything to do with tribe node not able to create (PUT) a Kibana index.
Personally, I prefer to make the Kibana index that I use with tribe to have its own unique name. So I run a dedicated Kibana instance pointing to the dedicated tribe (client) node.
Here are the steps I do to get a tribe node and its associated Kibana ready for use.
1. Configure the tribe node to know all the ES clusters I want to federate data from.
tribe.elasticsearch.yml:
cluster.name: toplevel_tribe
node.name: ${HOSTNAME}
node.master: false
node.data: false
tribe:
DC1-appservice:
cluster.name: logging-DC1
 network.host: 0.0.0.0
network.publish_host: ${HOSTNAME}
discovery.zen.ping.unicast.hosts:
- dc1-app13225.prod.example.com
- dc1-app13226.prod.example.com
- dc1-app13227.prod.example.com
DC2-appservice:
cluster.name: logging-DC2
 network.host: 0.0.0.0
network.publish_host: ${HOSTNAME}
discovery.zen.ping.unicast.hosts:
- dc2-app12281.prod.example.com
- dc2-app12282.prod.example.com
- dc2-app12283.prod.example.com
DC3.....etc to DCNN
my-es-dedicated-config-cluster:
cluster.name: es-config-CORP
 network.host: 0.0.0.0
network.publish_host: ${HOSTNAME}
discovery.zen.ping.unicast.hosts:
- corp-app1234.example.com
on_conflict: prefer_my-es-dedicated-config-cluster
2. Now pre-create the Kibana index in my-ES-dedicated-config-cluster. This is a small cluster in my admin/corp data center that is only for housing configurations, Kibana dashboards, etc.
3. A simpler and more correct way is to temporary point Kibana to the dedicated ES cluster (instead of the tribe).
Do this via this setting in your kibana.yml file:
# The Elasticsearch instance to use for all your queries.
elasticsearch.url: “http://ES-node:9200”
Start Kibana, let it create the index. Â Then stop it, change the setting back to point to your tribe node.
Doing it this way ensure that your kibana is correct.
curl command for pre-creating kibana (3 and 4) index:
curl -s -XPUT "http://localhost:9200/kibana3-int/" -d '{ "settings" : { "number_of_shards" : 3, "number_of_replicas" : 2 },
"mappings" : { "temp" : { "properties" : { "dashboard" : { "type" : "string" }, "group" : { "type" : "string" }, "title" : { "type" : "string" }, "user" : { "type" : "string" } } }, "dashboard" : { "properties" : { "dashboard" : { "type" : "string" }, "group" : { "type" : "string" }, "title" : { "type" : "string" }, "user" : { "type" : "string" } } } }'
# Kibana4
curl -s -XPUT "http://localhost:9200/TRIBENAME-kibana4" -d '{ "index.mapper.dynamic" : true, "settings" : { "number_of_shards" : 1, "number_of_replicas" : 0 },"mappings" : {"search" : {"_timestamp" : { },"properties" : {"columns" : {"type" : "string"},"description" : {"type" : "string"},"hits" : {"type" : "long"},"kibanaSavedObjectMeta" : {"properties" : {"searchSourceJSON" : {"type" : "string"}}},"sort" : {"type" : "string"},"title" : {"type" : "string"},"version" : {"type" : "long"}}},"dashboard" : {"_timestamp" : { },"properties" : {"description" : {"type" : "string"},"hits" : {"type" : "long"},"kibanaSavedObjectMeta" : {"properties" : {"searchSourceJSON" : {"type" : "string"}}},"optionsJSON" : {"type" : "string"},"panelsJSON" : {"type" : "string"},"timeRestore" : {"type" : "boolean"},"title" : {"type" : "string"},"uiStateJSON" : {"type" : "string"},"version" : {"type" : "long"}}},"visualization" : {"_timestamp" : { },"properties" : {"description" : {"type" : "string"},"kibanaSavedObjectMeta" : {"properties" : {"searchSourceJSON" : {"type" : "string"}}},"savedSearchId" : {"type" : "string"},"title" : {"type" : "string"},"uiStateJSON" : {"type" : "string"},"version" : {"type" : "long"},"visState" : {"type" : "string"}}},"config" : {"_timestamp" : { },"properties" : {"buildNum" : {"type" : "long"},"defaultIndex" : {"type" : "string"}}},"index-pattern" : {"_timestamp" : { },"properties" : {"customFormats" : {"type" : "string"},"fieldFormatMap" : {"type" : "string"},"fields" : {"type" : "string"},"intervalName" : {"type" : "string"},"timeFieldName" : {"type" : "string"},"title" : {"type" : "string"}}}}}'
LinkedIn 500M members celabratory picture.[/caption]