Best Method for sending logs into a cluster

(Jake Smith) #1

Dear All,

If I have a three node cluster and am using NXlog to send the logs into a global input, what would be the best method.

If i specified three outputs in the nxlog configuration, I would get multiple log entries. If I used round robin DNS, the NXLog client would only resolve the address at service startup.

Is the solution to use something like Apache Kafka in front of the cluster ?




I have no experience with nxlog, so I can’t help the first part.
If you send the same log line for graylog, it won’t recognize the duplication, it will store it twice.
round-robin DNS- not exactly, the host cache the DNS, and will resolv it again after the timeout. But if one of your node goes offline, the DNS can’t handle it immidately.
We put an nginx or ipvs as a loadbalancer. (haproxy it also a good choice, but it can’t handle UDP. we need udp, so we use nginx ans ipvs (in different clusters))

(Jake Smith) #3

Hi macko003,

I think a HAProxy is the answer here for me.





if you use a TCP connection, you can also configure nxlog to restart the connection at regular intervals. That would allow the load balancer to balance load in cases where you for example add or remove nodes (for maintenance of the nodes) behind the load balancer.

(system) closed #5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.