ES components will fail when deployed with tolerations because sysctl isn't applied to those nodes. The solution would be to use the same tolerations from master and data nodes and applied them to sysctl ds.