chud wrote:
This is incorrect, you can use all instances for spreading the load for ingestion. Additionally, while you are correct in that with a 2 node cluster you have a replica, you are incorrect in thinking that it doesn't help performance.
Each of the nodes can not only be used for ingestion of logs, but additionally, they all participate in spreading the load when log data is being queried no matter which node you are logged into, they all share the load.
Excellent, that's good to hear.
So if the clients are configured currently to send to LogServer1's IP address, and then I spin up a LogServer2, how does the load get shared?
Do I put them behind a load balancer and change the IP the clients are sending to from LogServer1's IP to the load balancer's IP?
chud wrote:Do I put them behind a load balancer and change the IP the clients are sending to from LogServer1's IP to the load balancer's IP?
This is what you want to do.
There is actually a field in Admin -> Global Settings called "Cluster Hostname" if you fill this in with your load balancer hostname or even a round-robin DNS address, ALL of the "+ Add Log Source" wizard will use that in place of the IP of the server you are on.