Is it possible: modify a standalone installation in a distributed installation?

[stemanit]

Hi there, I am running a standalone installation. The focus is here only on the logging / parsing / kibana. Is there a way to transform this standalone installation into a different design, for example with 3 elasticsearch data nodes and 3 elasticsearch master nodes under the hood?
Thanks and kind regards!

[dougburks]

I haven't tried it myself, but in theory I think you should be able to join search nodes to a standalone. For more information, please see:
https://docs.securityonion.net/en/2.4/architecture.html#search-node
https://docs.securityonion.net/en/2.4/configuration.html#production-server-distributed-deployment

[stemanit]

Thanks dougburks, I ve been for quite some time an elastic admin. Pull up a new 'data node' was quite common. I will test what is possible with SecOn in this matter.
Cheers!

[eositis]

you can easily add any node type you would like. run the node install as usual. Once it gets to connecting to the manager node, it will fail and throw an alert, that will include the commandline to run on the manager node, to enable firewall access. I have added both search nodes and forwarder nodes to a standalone with no issue.

[stemanit]

Thanks eositis for your input! Much appriciated! I will go for a test myself in future.