Graylog multinode load balanced input

Hi all,
I’m trying to understand global inputs. I have a 3 node graylog cluster, host1,host3,host3. Host1 is the master and the inputs go to there. If I change the input (using logstash input on 5044) to global and set the bind address to, it just started a listener on all of the available interfaces on host1.

I have configured filebeats to load balance its output:

The documentation says every node will listen (server.conf — Graylog 4.0.0 documentation), however on host2 and host3, there is nothing listening on 5044, how do I get all three nodes listening?

many thanks

ok, seems to be working now. I can see in the logs that all three nodes have started the listener and filebeat has established connections to them. The only thing I don’t understand is when viewing system->nodes, they all show the same activity and all processing the same number of messages at the same time, I would have thought they would be different ?


1 Like


Global Input will listen to all IP address within your environemnt if set to default (
Below are three examples.

Or you can specify one address to use an INPUT.

If you do not click the tic box for Global, then you can create a INPUT for your Localhost which would be the name of graylog server/s.

That actually sounds normal to me, since there in a cluster.

Also have you seen this with elasticsearch? Since you posted the link above I noticed it stated EL 7.13
System requirements

Hope that helps