Deploy seaparted elastic cluster

Graylog Central (peer support)
1

Hello

I’ve deployed graylog before, but i used eveyrthing withing the same VM. Now, I would deploy in the following fashion

  • VM: with UI, mongo
  • VM1: one elastic
  • VM2: another elastic

I’ve VM1, VM2 setup and working, (i deployed with the Google Launcher)
I’ve VM running, but I can’t make graylog working…

the error is the following:
2017-05-26T09:50:28.855Z INFO [zen] [graylog-246fa479-e1b0-4e79-8722-5a4d1e6bd080] failed to send join request to master [{graylogelastic-1-vm}{A_ez-FwsTRSMe95EI2IqVw}{10.132.0.7}{10.132.0.7:9300}], reason [RemoteTransportException[[graylogelastic-1-vm][10.132.0.7:9300][internal:discovery/zen/join]]; nested: ConnectTransportException[[graylog-246fa479-e1b0-4e79-8722-5a4d1e6bd080][127.0.0.1:9350] connect_timeout[30s]]; nested: NotSerializableExceptionWrapper[connect_exception: Connection refused: /127.0.0.1:9350]; ]

do I’ve to install elastic also on the VM base? or what? it seems that it’s not able to join an elastic that should be on the same machine…

2

Hej @esseti

  • what Graylog Version are you going to install?
  • what Elasticsearch Version did you have installed?

You can check this blog post - special the Adding Elasticsearch nodes section what setting you need in your Graylog server.conf.

If that does not help, your configuration of Elasticsearch and Graylog is needed.

3

I solved
elasticsearch_discovery_zen_ping_unicast_hosts = graylogelastic-1-vm:9300, graylogelastic-2-vm:9300
elasticsearch_network_host = instance-1

where
graylogelastic-1-vm and graylogelastic-2-vm are the vm with elastic
and instance-1 is the VM where graylog is installed.

ps:
are these parameters correct for 2 nodes?
elasticsearch_shards = 2 elasticsearch_replicas = 1

4

@esseti

your shard and replica is configured to have two shards and one replica for each shard. That means 4 shards are configured.

If you need speed, take out the replica. If you need to be save reduce the shards by 1.

Or leave it and grow if needed without reconfigure that.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.