diff --git a/modules/elk/jobspec.nomad.hcl b/modules/elk/jobspec.nomad.hcl
index 7dc7cad..e714771 100644
--- a/modules/elk/jobspec.nomad.hcl
+++ b/modules/elk/jobspec.nomad.hcl
@@ -6,12 +6,124 @@ job "elk" {
 
   group "node" {
 
-    count = 3
+    count = 2
 
     constraint {
       distinct_hosts = true
     }
 
+    constraint {
+      attribute = "${node.unique.name}"
+      operator  = "set_contains_any"
+      value     = "Hestia,Nyx"
+    }
+
+    network {
+      mode = "bridge"
+      port "http" {
+        static = 9200
+      }
+      port "transport" {
+        static = 9300
+      }
+      port "envoy_metrics" {
+        to = 9102
+      }
+    }
+
+    service {
+      provider = "consul"
+      port     = "9200"
+
+      meta {
+        envoy_metrics_port = "${NOMAD_HOST_PORT_envoy_metrics}"
+      }
+
+      connect {
+        sidecar_service {
+          proxy {
+            expose {
+              path {
+                path            = "/metrics"
+                protocol        = "http"
+                local_path_port = 9102
+                listener_port   = "envoy_metrics"
+              }
+            }
+            transparent_proxy {
+              exclude_inbound_ports  = ["9200", "9300"]
+              exclude_outbound_ports = [9200, 9300]
+            }
+          }
+        }
+      }
+    }
+
+    task "elasticsearch" {
+      driver = "docker"
+
+      config {
+        image = "docker.elastic.co/elasticsearch/elasticsearch:${var.elastic_version}"
+
+        ports = ["9200", "9300"]
+
+        volumes = [
+          "/mnt/docker/elastic-${node.unique.name}/config:/usr/share/elasticsearch/config",
+          "/mnt/docker/elastic-${node.unique.name}/data:/usr/share/elasticsearch/data",
+        ]
+
+        ulimit {
+          memlock = "-1:-1"
+        }
+
+        mount {
+          type   = "bind"
+          source = "local/unicast_hosts.txt"
+          target = "/usr/share/elasticsearch/config/unicast_hosts.txt"
+        }
+      }
+
+      env {
+        ES_PATH_CONF = "/usr/share/elasticsearch/config"
+      }
+
+      resources {
+        cpu    = 2000
+        memory = 2048
+      }
+
+      template {
+        data = <<-EOF
+          {{ range service "elk-node-elasticsearch-transport" }}
+          {{ .Address }}:{{ .Port }}
+          {{ end }}
+          EOF
+
+        destination = "local/unicast_hosts.txt"
+        change_mode = "noop"
+      }
+
+      service {
+        name     = "elk-node-elasticsearch-http"
+        provider = "consul"
+        port     = "http"
+      }
+
+      service {
+        name     = "elk-node-elasticsearch-transport"
+        provider = "consul"
+        port     = "transport"
+      }
+    }
+  }
+
+  group "tiebreaker" {
+
+    constraint {
+      attribute = "${node.unique.name}"
+      value     = "Neto"
+    }
+
     network {
       mode = "bridge"
       port "http" {