We are looking to make sure that all logs are captured and not lost with a use of a load balancer with virtual IP. This way the clients will always send to a single IP, but logs will get capture regardless of which log server might be down. Theoretically this should pose any issues, but I would like to check whether this will have any impact in a 2 or 3 node cluster in terms of the replicas. Since the logs will be coming into all the nodes, will NLS cluster figure this out and maintain redundancy?
Thanks!
Load Balancing syslog input to NLS
Re: Load Balancing syslog input to NLS
There should be no problem, the replication will happen across all nodes regardless of where the logs were originally sent. You need to make sure that your load balancer doesn't replace the source IP with the IP of the load balancer, otherwise the logs will show a source of your load balancer.
Re: Load Balancing syslog input to NLS
It is also worth noting that round robin DNS is an available option. Elasticsearch will handle shard/data load balancing automatically on the backend.
Re: Load Balancing syslog input to NLS
Thank you. This helps with our initial NLS design and making sure that we minimize any risk in losing any of the log data.
Re: Load Balancing syslog input to NLS
Did you have further questions or are we set to close this topic?
Former Nagios employee
Re: Load Balancing syslog input to NLS
Please close this topic. Much appreciated.