Load Balancing syslog input to NLS

[OptimusB]

We are looking to make sure that all logs are captured and not lost with a use of a load balancer with virtual IP. This way the clients will always send to a single IP, but logs will get capture regardless of which log server might be down. Theoretically this should pose any issues, but I would like to check whether this will have any impact in a 2 or 3 node cluster in terms of the replicas. Since the logs will be coming into all the nodes, will NLS cluster figure this out and maintain redundancy?

Thanks!

[ssax]

There should be no problem, the replication will happen across all nodes regardless of where the logs were originally sent. You need to make sure that your load balancer doesn't replace the source IP with the IP of the load balancer, otherwise the logs will show a source of your load balancer.

[jolson]

It is also worth noting that round robin DNS is an available option. Elasticsearch will handle shard/data load balancing automatically on the backend.

[OptimusB]

Thank you. This helps with our initial NLS design and making sure that we minimize any risk in losing any of the log data.

[tmcdonald]

Did you have further questions or are we set to close this topic?

[OptimusB]

Please close this topic. Much appreciated.