kibana是elkstack中的数据展示部分，由于kibana的只能配置一个elastisearch的url，所以要么通过负载均衡暴露9200，服务的质量取决于负载均衡后方的节点质量，由于后方都是data: true的节点，多多少少都有些压力，尤其是model部门跑批的时候，机器接近不可用，此时kibana体验贼差。
出于以上情况的考虑，引入中转节点，即data: false以及master: false的节点，该节点本身无持久化数据，压力很小；配置足够的cpu以及内存，让其能够有效的数据中转，聚合操作即可。
##################################################################
# /etc/elasticsearch/elasticsearch.yml
#
# Base configuration for a write heavy cluster
#
# Cluster / Node Basics
cluster.name: dota
# Node can have abritrary attributes we can use for routing
node.name: elk-example01cn-p009
node.max_local_storage_nodes: 1
node.master: false
node.data: false
# networking Settings
network.host: 10.40.9.116,127.0.0.1
http.port: 9200
transport.tcp.port: 9300
# dirs
path.data: /data/elasticsearch/data
path.repo: /data/ossfs
path.logs: /data/elasticsearch/logs
# Minimum nodes alive to constitute an operational cluster
discovery.zen.minimum_master_nodes: 1
# Unicast Discovery (disable multicast)
discovery.zen.ping.unicast.hosts: [elk-example01cn-p002.pek4.example.net,elk-example01cn-p001.pek3.example.net,elk-example01cn-p003.pek4.example.net,elk-example01cn-p007.pek3.example.net,elk-example01cn-p008.pek3.example.net]
server.port: 5601
server.host: elk-example01cn-p001.pek3.example.net
server.basePath: ""
server.maxPayloadBytes: 1048576
server.name: "elk-example01cn-p001.pek3.example.net"
elasticsearch.url: "http://10.40.9.116:9200"
elasticsearch.preserveHost: true
kibana.index: ".kibana"
kibana.defaultAppId: "discover"
elasticsearch.shardTimeout: 0
elasticsearch.requestTimeout: 240000
elasticsearch.startupTimeout: 10000
pid.file: /tmp/kibana.pid
logging.dest: stdout
logging.silent: false
logging.quiet: true
logging.verbose: false
ops.interval: 5000