Graylog multinode load balanced input

[darrinh (Darrin Hodges)]

Hi all,
I’m trying to understand global inputs. I have a 3 node graylog cluster, host1,host3,host3. Host1 is the master and the inputs go to there. If I change the input (using logstash input on 5044) to global and set the bind address to 0.0.0.0, it just started a listener on all of the available interfaces on host1.

I have configured filebeats to load balance its output:

Load balance the output hosts | Filebeat Reference [7.13] | Elastic

The documentation says every node will listen (server.conf — Graylog 4.0.0 documentation), however on host2 and host3, there is nothing listening on 5044, how do I get all three nodes listening?

many thanks
Darrin

[darrinh (Darrin Hodges)]

ok, seems to be working now. I can see in the logs that all three nodes have started the listener and filebeat has established connections to them. The only thing I don’t understand is when viewing system->nodes, they all show the same activity and all processing the same number of messages at the same time, I would have thought they would be different ?

thanks
Darrin

[gsmith]

Hello,

@darrinh

I’m trying to understand global inputs.

Global Input will listen to all IP address within your environemnt if set to default (0.0.0.0).
Below are three examples.

Or you can specify one address to use an INPUT.

If you do not click the tic box for Global, then you can create a INPUT for your Localhost which would be the name of graylog server/s.

@darrinh

The only thing I don’t understand is when viewing system->nodes, they all show the same activity and all processing the same number of messages at the same time, I would have thought they would be different

That actually sounds normal to me, since there in a cluster.

Also have you seen this with elasticsearch? Since you posted the link above I noticed it stated EL 7.13
System requirements

Hope that helps