I’m trying to understand global inputs. I have a 3 node graylog cluster, host1,host3,host3. Host1 is the master and the inputs go to there. If I change the input (using logstash input on 5044) to global and set the bind address to 0.0.0.0, it just started a listener on all of the available interfaces on host1.
I have configured filebeats to load balance its output:
ok, seems to be working now. I can see in the logs that all three nodes have started the listener and filebeat has established connections to them. The only thing I don’t understand is when viewing system->nodes, they all show the same activity and all processing the same number of messages at the same time, I would have thought they would be different ?